From c5eb6a3b07e42f3c44ce6ea5f2f98fdc482742da Mon Sep 17 00:00:00 2001 From: Brian Love Date: Sun, 30 Aug 2026 13:15:32 -0700 Subject: [PATCH] ci+chore: PEP 740 attestations via astral-sh/attest-action; middleware 0.0.3 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Restores what #873 traded away, without reintroducing the toolchain skew. uv publish UPLOADS attestation files found beside the dists by default (--no-attestations is the opt-out) — it just doesn't MINT them. Astral's own publishing example pairs it with astral-sh/attest-action for exactly that. One toolchain end to end, attestations back. - attest step gated to the real release (a dry run uploads nothing for attestations to accompany); SHA pin f589a42a verified against tag v0.0.6 (lightweight tag, commit direct); the action's input is (glob) — caught by reading action.yml at the pinned SHA, not the README - middleware bumped to 0.0.3: attestations are only provable on a fresh upload, and PyPI versions are immutable. No code change; consumers pin >=0.0.2 and are unaffected. The 0.0.3 upload doubles as the verification (simple-API provenance must flip from 'none') Verified locally: 0.0.2 artifacts pass current twine check (Metadata 2.5), YAML parses. Co-Authored-By: Claude Opus 5 --- .github/workflows/publish-middleware-python.yml | 11 +++++++++++ packages/threadplane-middleware/pyproject.toml | 2 +- packages/threadplane-middleware/uv.lock | 2 +- 3 files changed, 13 insertions(+), 2 deletions(-) diff --git a/.github/workflows/publish-middleware-python.yml b/.github/workflows/publish-middleware-python.yml index 2fa6a257b..9d9f66db1 100644 --- a/.github/workflows/publish-middleware-python.yml +++ b/.github/workflows/publish-middleware-python.yml @@ -76,6 +76,17 @@ jobs: working-directory: packages/threadplane-middleware run: uv publish --dry-run dist/* + # PEP 740 attestations: `uv publish` uploads attestation files found + # next to the dists (on by default) but does not mint them — Astral's + # own publishing example pairs it with their attest-action for exactly + # this. Generated for the real release only; a dry run uploads nothing + # for them to accompany. SHA pin verified against tag v0.0.6. + - name: Generate PEP 740 attestations + if: ${{ inputs.dry_run == false }} + uses: astral-sh/attest-action@f589a42a7efb6fe400b4f400de60b4bc90390027 # v0.0.6 + with: + paths: packages/threadplane-middleware/dist/* + # uv publish, not the pypa action: the pinned action image's twine # rejected the Metadata-Version 2.5 that current `uv build` emits # ("InvalidDistribution: '2.5' is not a valid metadata version"), while diff --git a/packages/threadplane-middleware/pyproject.toml b/packages/threadplane-middleware/pyproject.toml index 642fcbbe7..ec3a1ba85 100644 --- a/packages/threadplane-middleware/pyproject.toml +++ b/packages/threadplane-middleware/pyproject.toml @@ -4,7 +4,7 @@ build-backend = "hatchling.build" [project] name = "threadplane-middleware" -version = "0.0.2" +version = "0.0.3" description = "LangGraph middleware for binding client-declared tool stubs and routing client tool calls to END so the browser executes them." readme = "README.md" license = { text = "MIT" } diff --git a/packages/threadplane-middleware/uv.lock b/packages/threadplane-middleware/uv.lock index 94ba66c98..deef2479e 100644 --- a/packages/threadplane-middleware/uv.lock +++ b/packages/threadplane-middleware/uv.lock @@ -763,7 +763,7 @@ wheels = [ [[package]] name = "threadplane-middleware" -version = "0.0.2" +version = "0.0.3" source = { editable = "." } dependencies = [ { name = "langchain-core" },