Repository navigation
feat: releases ship with PEP 740 attestations #1
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Sign probe (temporary, #24) | |
| on: pull_request | |
| permissions: | |
| contents: read | |
| id-token: write | |
| jobs: | |
| sign: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: astral-sh/setup-uv@v7 | |
| - name: Render | |
| run: | | |
| uvx --with jinja2-time copier copy --defaults --trust --vcs-ref HEAD \ | |
| --data project_name=demo-lib --data project_description="Demo" \ | |
| --data author_name="Bedrock Python" --data author_email="maintainers@example.com" \ | |
| . "${RUNNER_TEMP}/demo-lib" | |
| - name: Build, then the generated sign step exactly as rendered | |
| working-directory: ${{ runner.temp }}/demo-lib | |
| run: | | |
| uv build | |
| SIGN=$(uv run --no-project --with pyyaml python -c ' | |
| import yaml | |
| steps = yaml.safe_load(open(".github/workflows/publish.yml"))["jobs"]["publish"]["steps"] | |
| print(next(s["run"] for s in steps if "pypi-attestations" in s.get("run", "")))') | |
| echo "$SIGN" | |
| eval "$SIGN" | |
| ls -la dist | |
| - name: Verify against this workflow's identity | |
| working-directory: ${{ runner.temp }}/demo-lib | |
| run: | | |
| uvx pypi-attestations verify attestation \ | |
| --identity "https://github.com/${GITHUB_REPOSITORY}/.github/workflows/sign-probe.yml@${GITHUB_REF}" \ | |
| dist/*.whl dist/*.tar.gz | |
| uvx pypi-attestations inspect dist/*.whl.publish.attestation | head -20 |