wrangle/gh_workflow_examples/build_python.yml at main · TomHennen/wrangle · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
# Copy this file to your repo at .github/workflows/build_python.yml
#
# Before first use:
# 1. Configure a Trusted Publisher on PyPI (project settings → Publishing)
#    - Owner: <your-github-org-or-user>
#    - Repository: <your-repo>
#    - Workflow name: build_python.yml
# 2. Disable legacy API token uploads on PyPI to prevent token-theft attacks
# 3. (Optional) Repeat on test.pypi.org for pre-release testing
#
# Publishing runs directly in this workflow (not inside wrangle's reusable
# workflow) because PyPI Trusted Publishing requires the OIDC token to come
# from your workflow, not a reusable workflow. See:
# https://github.com/pypi/warehouse/issues/11096
#
# Wrangle's reusable workflow generates SLSA provenance (Build L3); its
# `verify` job then verifies that provenance (fail-closed, via ampel against
# the wrangle PolicySet) and emits the signed VSA before declaring
# success. If verification fails, the workflow fails and `needs: [build]`
# blocks publish. The publish job below additionally re-verifies its own
# download against the signed VSA (wrangle/actions/verify-vsa) so the
# exact bytes sent to PyPI are the bytes that passed wrangle's policy.
#
# Trigger note: this workflow publishes when `should-release` is true.
# This template sets `release-events: tag-only` so only tag pushes
# publish — `workflow_dispatch` runs build + test + provenance + verify
# but does NOT publish, even from main. That is the safer default for a
# canonical security-tool template: a stolen workflow_dispatch invocation
# from any branch cannot mint a release. Switch to `non-pull-request`
# (publish on every non-PR event) or `main-and-tags` (push to main or
# tags) if your release model needs that.
name: Python Build

on:
  push:
    branches: ["main"]  # source scan + snapshot build on main (no publish); drop to skip per-merge builds
    tags: ["v*"]       # publish on version tags
  pull_request:
    branches: ["**"]   # build + test on PRs (no publish)
  workflow_dispatch:

jobs:
  build:
    # Maximum the caller grants; wrangle's internal jobs each drop to the subset they actually need.
    permissions:
      # The attach targets the GitHub Release for the tag, which wrangle creates if none exists.
      contents: write   # wrangle's verify job attaches the VSA to the release on tags; GitHub validates at startup even on non-tag runs
      id-token: write   # OIDC for Sigstore signing
      attestations: write   # wrangle's attest job writes GitHub-issued SLSA provenance
      actions: read  # source scan: Scorecard reads the Actions API
      security-events: write  # source-scan SARIF -> Security tab
    uses: TomHennen/wrangle/.github/workflows/build_and_publish_python.yml@v0.4.0 # zizmor: ignore[unpinned-uses] - immutable
    with:
      path: "."
      release-events: tag-only          # only tag pushes publish (recommended default)
      # python-version: ""              # optional: auto-detected from pyproject.toml
      # run-tests: true                 # optional: skip with false

  publish:
    # Gate on the should-release output. should-release is "true" only when
    # the wrangle workflow succeeded (which includes the verify job's
    # provenance verification). That job verified its own download on its
    # own runner; the verify-vsa step below re-checks THIS job's bytes.
    if: ${{ needs.build.outputs.should-release == 'true' }}
    needs: [build]
    runs-on: ubuntu-latest
    permissions:
      id-token: write   # OIDC for Trusted Publishing + PEP 740 attestations
    steps:
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: ${{ needs.build.outputs.dist-artifact-name }}
          path: dist/

      # Verify the downloaded dist against wrangle's signed VSA — the
      # full policy verdict — before any bytes leave this runner.
      - uses: TomHennen/wrangle/actions/verify-vsa@v0.4.0 # zizmor: ignore[unpinned-uses] - immutable
        with:
          path: dist/
          resource-uri: ${{ needs.build.outputs.resource-uri }}

      - uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
        with:
          attestations: true
          packages-dir: dist/
          # repository-url: "https://test.pypi.org/legacy/"  # for TestPyPI