MCP server and markdown checking #2
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # SPDX-FileCopyrightText: © 2025, 2026 open-nudge <https://github.com/open-nudge> | |
| # SPDX-FileContributor: szymonmaszke <github@maszke.co> | |
| # | |
| # SPDX-License-Identifier: Apache-2.0 | |
| --- | |
| name: "Release" | |
| on: | |
| release: | |
| types: | |
| - "published" | |
| permissions: {} # yamllint disable-line rule:braces | |
| # post runs on release changelog action | |
| # Only keep one release running at a time | |
| # The latest release will be the one that is kept | |
| concurrency: | |
| group: > | |
| ${{ github.workflow_ref }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| # Do not run the release for Renovate Bot updates. | |
| # For it, run changelog generation and that should be it. | |
| jobs: | |
| sboms: | |
| name: "SBOMs" | |
| permissions: | |
| actions: "read" # https://github.com/github/codeql-action/issues/2117 | |
| security-events: "write" # Needed to upload SARIF file to security tab | |
| id-token: "write" # Needed to get GH Token to attest | |
| attestations: "write" # Needed to upload attestation | |
| artifact-metadata: "write" # Needed to create artifact metadata | |
| contents: "read" | |
| # yamllint disable rule:line-length | |
| uses: "open-nudge/opentemplate/.github/workflows/release-sboms-reusable.yml@main" # zizmor: ignore[unpinned-uses] | |
| # yamllint enable rule:line-length | |
| with: | |
| upload-grype-artifact: true | |
| upload-grype-sarif: true | |
| sarifs: | |
| name: "SARIFs" | |
| permissions: | |
| actions: "read" # https://github.com/github/codeql-action/issues/2117 | |
| security-events: "write" # Needed to upload SARIF file to security tab | |
| contents: "read" | |
| # yamllint disable rule:line-length | |
| uses: "open-nudge/opentemplate/.github/workflows/release-sarifs-reusable.yml@main" # zizmor: ignore[unpinned-uses] | |
| # yamllint enable rule:line-length | |
| tests: | |
| name: "Tests" | |
| permissions: | |
| contents: "read" | |
| # yamllint disable rule:line-length | |
| uses: "./.github/workflows/tests-reusable.yml" | |
| # yamllint enable rule:line-length | |
| docs: | |
| name: "Docs" | |
| permissions: | |
| contents: "write" # Needed to write documentation to gh-pages directly | |
| # yamllint disable rule:line-length | |
| uses: "open-nudge/opentemplate/.github/workflows/run-reusable.yml@main" # zizmor: ignore[unpinned-uses] | |
| # yamllint enable rule:line-length | |
| with: | |
| # Double checkout used to refresh the content of generated docs, which | |
| # happens on some linux distributions at least. | |
| # yamllint disable rule:line-length | |
| command: | | |
| export TAG="$(echo ${{ github.event.release.tag_name }} | cut -d. -f1,2)" | |
| pdm run mike deploy "${TAG}" --branch "site-${{ github.sha }}" --ignore-remote-status | |
| git checkout "site-${{ github.sha }}" -- . | |
| mv "${TAG}" "site-${{ github.sha }}" | |
| # yamllint enable rule:line-length | |
| group: "docs" | |
| core: true | |
| fetch-depth: 0 | |
| full-checkout: true | |
| additional-allowed-endpoints: > | |
| fonts.google.com:443 | |
| fonts.gstatic.com:443 | |
| upload-name: >- | |
| ${{ format('site-{0}', github.sha) }} | |
| upload-path: >- | |
| ${{ format('site-{0}', github.sha) }} | |
| # Works regardless of repo type | |
| package-create: | |
| name: "Package Create" | |
| permissions: | |
| contents: "read" | |
| # yamllint disable rule:line-length | |
| uses: "open-nudge/opentemplate/.github/workflows/run-reusable.yml@main" # zizmor: ignore[unpinned-uses] | |
| # yamllint enable rule:line-length | |
| with: | |
| command: "pdm build -v" | |
| core: true | |
| upload-name: "dist-${{ github.sha }}" | |
| upload-path: "dist" | |
| fetch-depth: 0 | |
| sparse-checkout: | | |
| src/** | |
| changelog: | |
| name: "Changelog" | |
| if: > | |
| always() | |
| needs: | |
| - "package-create" | |
| permissions: | |
| contents: "read" | |
| pull-requests: "read" # Needed to read PR metadata during changelog gen | |
| # yamllint disable rule:line-length | |
| uses: "open-nudge/opentemplate/.github/workflows/run-reusable.yml@main" # zizmor: ignore[unpinned-uses] | |
| # yamllint enable rule:line-length | |
| with: | |
| download: true | |
| full-checkout: true | |
| download-name: "dist-${{ github.sha }}" | |
| # yamllint disable rule:line-length | |
| command: | | |
| mkdir -p CHANGELOGS-${{ github.sha }} | |
| export PYTHON_PACKAGE_VERSION=$(basename dist-${{ github.sha }}/dist/*.tar.gz | cut -d '-' -f 2) | |
| pdm run changelog > CHANGELOGS-${{ github.sha }}/CHANGELOG-${{ github.sha }}.md | |
| pdm run changelog-latest > CHANGELOGS-${{ github.sha }}/LATEST.md | |
| # yamllint enable rule:line-length | |
| group: "release" | |
| # Full history to generate full changelog | |
| fetch-depth: 0 | |
| upload-name: "CHANGELOGS-${{ github.sha }}" | |
| upload-path: "CHANGELOGS-${{ github.sha }}" | |
| package-upload: | |
| name: "Package Upload (${{ matrix.repository.name }})" | |
| needs: | |
| - "sboms" | |
| - "sarifs" | |
| - "tests" | |
| - "docs" | |
| - "package-create" | |
| - "changelog" | |
| permissions: | |
| id-token: "write" # Needed to sign the provenance | |
| runs-on: "ubuntu-latest" | |
| timeout-minutes: 30 | |
| strategy: | |
| fail-fast: true | |
| matrix: | |
| repository: | |
| - url: "https://upload.pypi.org/legacy/" | |
| endpoints: > | |
| fulcio.sigstore.dev:443 | |
| ghcr.io:443 | |
| pkg-containers.githubusercontent.com:443 | |
| pypi.org:443 | |
| pypi.python.org:443 | |
| rekor.sigstore.dev:443 | |
| tuf-repo-cdn.sigstore.dev:443 | |
| upload.pypi.org:443 | |
| attestations: true | |
| name: "PyPI" | |
| skip: "${{ github.event.repository.private }}" | |
| # Example for a test repository | |
| # - url: "https://test.pypi.org/simple/" | |
| # endpoints: | | |
| # test.pypi.org:443 | |
| # files.pythonhosted.org:443 | |
| # attestations: true | |
| # name: "PyPI Test" | |
| # skip: > | |
| # ${{ github.event.repository.visibility != 'public' }} | |
| # Change to the opentemplate reusable workflow | |
| # once the issue below is resolved for SLSA3 compatibility | |
| # https://github.com/pypi/warehouse/issues/11096 | |
| steps: | |
| - name: "Harden Runner" | |
| # yamllint disable rule:line-length | |
| uses: "step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450" # v2.19.1 | |
| # yamllint enable rule:line-length | |
| with: | |
| disable-sudo: true | |
| egress-policy: "block" | |
| allowed-endpoints: "${{ matrix.repository.endpoints }}" | |
| - name: "Download artifacts" | |
| # yamllint disable rule:line-length | |
| uses: "actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c" # v8.0.1 | |
| with: | |
| name: "dist-${{ github.sha }}" | |
| path: "dist" | |
| - name: "Upload python package" | |
| if: > | |
| ! matrix.repository.skip | |
| # yamllint disable rule:line-length | |
| uses: "pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e" # v1.13.0 | |
| # yamllint enable rule:line-length | |
| with: | |
| repository-url: "${{ matrix.repository.url }}" | |
| packages-dir: "dist" | |
| attestations: "${{ matrix.repository.attestations }}" | |
| print-hash: true | |
| skip-existing: true | |
| - name: "Rename artifacts" | |
| # yamllint disable rule:indentation | |
| run: | | |
| # Add GITHUB_SHA to artifacts before the first dot | |
| for f in dist/*; do | |
| base=$(basename "${f}") | |
| dir=$(dirname "${f}") | |
| prefix="${base%%-*}" | |
| suffix="${base#"${prefix}"}" | |
| mv "${f}" "${dir}/${prefix}-${GITHUB_SHA}${suffix}" | |
| done | |
| # yamllint enable rule:indentation | |
| - name: "Upload artifacts" | |
| # yamllint disable rule:line-length | |
| uses: "actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a" # v7.0.1 | |
| # yamllint enable rule:line-length | |
| with: | |
| name: "dist-${{ github.sha }}" | |
| path: "dist" | |
| retention-days: 1 | |
| overwrite: true | |
| if-no-files-found: "error" | |
| slsa-provenance: | |
| name: "SLSA Provenance" | |
| needs: | |
| - "package-upload" | |
| if: > | |
| github.event.repository.visibility == 'public' | |
| permissions: | |
| actions: "read" # https://github.com/github/codeql-action/issues/2117 | |
| contents: "write" # Needed to upload SARIF file to CodeQL | |
| id-token: "write" # Needed to sign the provenance | |
| # yamllint disable rule:line-length | |
| uses: "open-nudge/opentemplate/.github/workflows/release-slsa-provenance-reusable.yml@main" # zizmor: ignore[unpinned-uses] | |
| # yamllint enable rule:line-length | |
| with: | |
| upload-assets: true | |
| github-upload: | |
| name: "GitHub Upload" | |
| needs: | |
| - "slsa-provenance" | |
| permissions: | |
| contents: "write" # Needed to push to the release | |
| # yamllint disable rule:line-length | |
| uses: "open-nudge/opentemplate/.github/workflows/release-upload.yml@main" # zizmor: ignore[unpinned-uses] | |
| # yamllint enable rule:line-length | |
| with: | |
| tag: "${{ github.event.release.tag_name }}" | |
| ... |