Skip to content

Commit 8d54649

Browse files
DK96-OSDK96-OS
authored
Release 3.1 (#14)
(sigstore#134): * schedule-selftest: reduce nagging --------- Signed-off-by: William Woodruff <[email protected]> (sigstore#140): * requirements: sigstore ~3.0 * selftest: update filenames * action: update another path * action: remove deprecated settings * README: remove old docs --------- Signed-off-by: William Woodruff <[email protected]> (sigstore#145): * action: use a venv to prevent PEP 668 errors * action: use sys.executable * fight with Windows * setup: minimum Python is 3.8 (This has been true for a while) --------- Signed-off-by: William Woodruff <[email protected]> (sigstore#142): * action: flip `release-signing-artifacts` --------- Signed-off-by: William Woodruff <[email protected]> (sigstore#146): * action: remove old output settings * selftest: remove old test ref --------- Signed-off-by: William Woodruff <[email protected]> Cleanup workflows (sigstore#148): * Workflows: remove default input arg from action call * workflows: Remove unnecessary selftest release-signing-artifacts defaults to "true" so the removed test now duplicates the previous test. We could try testing the release-signing-artifacts == "false" but that's a bit trickier since it could only be done in a release event... * workflows: Drop recently removed job from needs-list --------- Signed-off-by: Jussi Kukkonen <[email protected]> Prep 3.0.0 (sigstore#143): --------- Signed-off-by: William Woodruff <[email protected]> (sigstore#152): * build(deps): bump peter-evans/create-issue-from-file from 5.0.0 to 5.0.1 in the actions group --------- Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> (sigstore#154): * Fix remaining reference to 2.1.1 in README --------- Signed-off-by: Stefanie Molin <[email protected]> (sigstore#151): * Enable debugging also if ACTIONS_STEP_DEBUG==true --------- Co-authored-by: rindeal <[email protected]> Co-authored-by: William Woodruff <[email protected]> Upgrade Dependencies: * Update requirements.txt - upgrade sigstore 3.1, upgrade requests 2.32 --------- Signed-off-by: DK96-OS <[email protected]>
1 parent 2e36515 commit 8d54649

File tree

8 files changed

+153
-307
lines changed

8 files changed

+153
-307
lines changed

‎.github/workflows/release.yml

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,4 +23,3 @@ jobs:
2323
id: sigstore-python
2424
with:
2525
inputs: action.yml action.py
26-
release-signing-artifacts: true

‎.github/workflows/schedule-selftest.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -37,10 +37,10 @@ jobs:
3737
EOF
3838
3939
- name: Open issue
40-
uses: peter-evans/create-issue-from-file@24452a72d85239eacf1468b0f1982a9f3fec4c94 # v5.0.0
40+
uses: peter-evans/create-issue-from-file@e8ef132d6df98ed982188e460ebb3b5d4ef3a9cd # v5.0.1
4141
with:
4242
title: "[CI] Self-test failure"
4343
# created in the previous step
4444
content-filepath: /tmp/issue.md
4545
labels: bug
46-
assignees: woodruffw,tetsuo-cpp,tnytown
46+
assignees: woodruffw

‎.github/workflows/selftest.yml

Lines changed: 29 additions & 57 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,8 @@ jobs:
1919
- ubuntu-latest
2020
- macos-latest
2121
- windows-latest
22+
# TODO: Can be removed when 24.04 becomes ubuntu-latest.
23+
- ubuntu-24.04
2224
runs-on: ${{ matrix.os }}
2325
if: (github.event_name != 'pull_request') || !github.event.pull_request.head.repo.fork
2426
steps:
@@ -36,40 +38,31 @@ jobs:
3638
- name: Check outputs
3739
shell: bash
3840
run: |
39-
[[ -f ./test/artifact.txt.sigstore ]] || exit 1
41+
[[ -f ./test/artifact.txt.sigstore.json ]] || exit 1
4042
41-
selftest-whitespace:
43+
selftest-runner-python:
4244
strategy:
4345
matrix:
4446
os:
4547
- ubuntu-latest
46-
- macos-latest
47-
- windows-latest
48+
# TODO: Can be removed when 24.04 becomes ubuntu-latest.
49+
- ubuntu-24.04
4850
runs-on: ${{ matrix.os }}
4951
if: (github.event_name != 'pull_request') || !github.event.pull_request.head.repo.fork
5052
steps:
5153
- uses: actions/checkout@v4
52-
- uses: actions/setup-python@v5
53-
if: ${{ matrix.os != 'ubuntu-latest' }}
54-
with:
55-
python-version: "3.x"
5654
- name: Sign artifact and publish signature
5755
uses: ./
5856
id: sigstore-python
5957
with:
60-
inputs: |
61-
./test/artifact.txt
62-
./test/white\ space.txt
63-
./test/"more white space.txt"
58+
inputs: ./test/artifact.txt
6459
internal-be-careful-debug: true
6560
- name: Check outputs
6661
shell: bash
6762
run: |
68-
[[ -f ./test/artifact.txt.sigstore ]] || exit 1
69-
[[ -f ./test/white\ space.txt ]] || exit 1
70-
[[ -f ./test/more\ white\ space.txt ]] || exit 1
63+
[[ -f ./test/artifact.txt.sigstore.json ]] || exit 1
7164
72-
selftest-release-signing-artifacts-no-op:
65+
selftest-whitespace:
7366
strategy:
7467
matrix:
7568
os:
@@ -88,15 +81,17 @@ jobs:
8881
uses: ./
8982
id: sigstore-python
9083
with:
91-
inputs: ./test/artifact.txt
92-
# The trigger for this test is not a release, so this has no effect
93-
# (but does not break the workflow either).
94-
release-signing-artifacts: true
84+
inputs: |
85+
./test/artifact.txt
86+
./test/white\ space.txt
87+
./test/"more white space.txt"
9588
internal-be-careful-debug: true
9689
- name: Check outputs
9790
shell: bash
9891
run: |
99-
[[ -f ./test/artifact.txt.sigstore ]] || exit 1
92+
[[ -f ./test/artifact.txt.sigstore.json ]] || exit 1
93+
[[ -f ./test/white\ space.txt ]] || exit 1
94+
[[ -f ./test/more\ white\ space.txt ]] || exit 1
10095
10196
selftest-xfail-invalid-inputs:
10297
runs-on: ubuntu-latest
@@ -140,7 +135,7 @@ jobs:
140135
internal-be-careful-debug: true
141136
- name: Check outputs
142137
run: |
143-
[[ -f ./test/artifact.txt.sigstore ]] || exit 1
138+
[[ -f ./test/artifact.txt.sigstore.json ]] || exit 1
144139
145140
selftest-glob:
146141
runs-on: ubuntu-latest
@@ -156,9 +151,9 @@ jobs:
156151
internal-be-careful-debug: true
157152
- name: Check outputs
158153
run: |
159-
[[ -f ./test/artifact.txt.sigstore ]] || exit 1
160-
[[ -f ./test/artifact1.txt.sigstore ]] || exit 1
161-
[[ -f ./test/artifact2.txt.sigstore ]] || exit 1
154+
[[ -f ./test/artifact.txt.sigstore.json ]] || exit 1
155+
[[ -f ./test/artifact1.txt.sigstore.json ]] || exit 1
156+
[[ -f ./test/artifact2.txt.sigstore.json ]] || exit 1
162157
163158
selftest-xfail-glob-input-expansion:
164159
runs-on: ubuntu-latest
@@ -200,14 +195,14 @@ jobs:
200195
internal-be-careful-debug: true
201196
- name: Check outputs
202197
run: |
203-
[[ -f ./test/artifact.txt.sigstore ]] || exit 1
204-
[[ -f ./test/artifact1.txt.sigstore ]] || exit 1
205-
[[ -f ./test/artifact2.txt.sigstore ]] || exit 1
206-
[[ -f ./test/another1.txt.sigstore ]] || exit 1
207-
[[ -f ./test/another2.txt.sigstore ]] || exit 1
208-
[[ -f ./test/subdir/hello1.txt.sigstore ]] || exit 1
209-
[[ -f ./test/subdir/hello2.txt.sigstore ]] || exit 1
210-
[[ -f ./test/subdir/hello3.txt.sigstore ]] || exit 1
198+
[[ -f ./test/artifact.txt.sigstore.json ]] || exit 1
199+
[[ -f ./test/artifact1.txt.sigstore.json ]] || exit 1
200+
[[ -f ./test/artifact2.txt.sigstore.json ]] || exit 1
201+
[[ -f ./test/another1.txt.sigstore.json ]] || exit 1
202+
[[ -f ./test/another2.txt.sigstore.json ]] || exit 1
203+
[[ -f ./test/subdir/hello1.txt.sigstore.json ]] || exit 1
204+
[[ -f ./test/subdir/hello2.txt.sigstore.json ]] || exit 1
205+
[[ -f ./test/subdir/hello3.txt.sigstore.json ]] || exit 1
211206
212207
selftest-upload-artifacts:
213208
runs-on: ubuntu-latest
@@ -229,30 +224,9 @@ jobs:
229224
- name: Verify presence of uploaded files
230225
run: |
231226
[[ -f ./artifact.txt ]] || exit 1
232-
[[ -f ./artifact.txt.sigstore ]] || exit 1
227+
[[ -f ./artifact.txt.sigstore.json ]] || exit 1
233228
working-directory: ./test/uploaded
234229

235-
selftest-custom-paths:
236-
runs-on: ubuntu-latest
237-
if: (github.event_name != 'pull_request') || !github.event.pull_request.head.repo.fork
238-
steps:
239-
- uses: actions/checkout@v4
240-
- name: Sign artifact and publish signature
241-
uses: ./
242-
id: sigstore-python
243-
with:
244-
inputs: ./test/artifact.txt
245-
signature: ./test/custom_signature.sig
246-
certificate: ./test/custom_certificate.crt
247-
bundle: ./test/custom_bundle.sigstore
248-
staging: true
249-
internal-be-careful-debug: true
250-
- name: Check outputs
251-
run: |
252-
[[ -f ./test/custom_signature.sig ]] || exit 1
253-
[[ -f ./test/custom_certificate.crt ]] || exit 1
254-
[[ -f ./test/custom_bundle.sigstore ]] || exit 1
255-
256230
selftest-verify:
257231
runs-on: ubuntu-latest
258232
if: (github.event_name != 'pull_request') || !github.event.pull_request.head.repo.fork
@@ -346,13 +320,11 @@ jobs:
346320
needs:
347321
- selftest
348322
- selftest-whitespace
349-
- selftest-release-signing-artifacts-no-op
350323
- selftest-xfail-invalid-inputs
351324
- selftest-staging
352325
- selftest-glob
353326
- selftest-glob-multiple
354327
- selftest-upload-artifacts
355-
- selftest-custom-paths
356328
- selftest-verify
357329
- selftest-xfail-verify-missing-options
358330
- selftest-identity-token

‎CHANGELOG.md

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
# Changelog
2+
3+
All notable changes to `gh-action-sigstore-python` will be documented in this file.
4+
5+
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
6+
7+
All versions prior to 3.0.0 are untracked.
8+
9+
## [Unreleased]
10+
11+
## [3.0.0]
12+
13+
### Added
14+
15+
* `inputs` now allows recursive globbing with `**`
16+
([#106](https://github.com/sigstore/gh-action-sigstore-python/pull/106))
17+
18+
### Removed
19+
20+
* The following settings have been removed: `fulcio-url`, `rekor-url`,
21+
`ctfe`, `rekor-root-pubkey`
22+
([#140](https://github.com/sigstore/gh-action-sigstore-python/pull/140))
23+
* The following output settings have been removed: `signature`,
24+
`certificate`, `bundle`
25+
([#146](https://github.com/sigstore/gh-action-sigstore-python/pull/146))
26+
27+
28+
### Changed
29+
30+
* `inputs` is now parsed according to POSIX shell lexing rules, improving
31+
the action's consistency when used with filenames containing whitespace
32+
or other significant characters
33+
([#104](https://github.com/sigstore/gh-action-sigstore-python/pull/104))
34+
35+
* `inputs` is now optional *if* `release-signing-artifacts` is true
36+
*and* the action's event is a `release` event. In this case, the action
37+
takes no explicit inputs, but signs the source archives already attached
38+
to the associated release
39+
([#110](https://github.com/sigstore/gh-action-sigstore-python/pull/110))
40+
41+
* The default suffix has changed from `.sigstore` to `.sigstore.json`,
42+
per Sigstore's client specification
43+
([#140](https://github.com/sigstore/gh-action-sigstore-python/pull/140))
44+
45+
* `release-signing-artifacts` now defaults to `true`
46+
([#142](https://github.com/sigstore/gh-action-sigstore-python/pull/142))
47+
48+
### Fixed
49+
50+
* The `release-signing-artifacts` setting no longer causes a hard error
51+
when used under the incorrect event
52+
([#103](https://github.com/sigstore/gh-action-sigstore-python/pull/103))
53+
54+
* Various deprecations present in `sigstore-python`'s 2.x series have been
55+
resolved
56+
([#140](https://github.com/sigstore/gh-action-sigstore-python/pull/140))
57+
58+
* This workflow now supports CI runners that use PEP 668 to constrain global
59+
package prefixes
60+
([#145](https://github.com/sigstore/gh-action-sigstore-python/pull/145))
61+
62+
63+
[Unreleased]: https://github.com/sigstore/gh-action-sigstore-python/compare/v3.0.0...HEAD
64+
[3.0.0]: https://github.com/sigstore/gh-action-sigstore-python/compare/v2.1.1...v3.0.0

0 commit comments

Comments
 (0)