zhou/gh-action-pypi-publish
1
0
Fork 0
mirror of https://gitcode.com/gh_mirrors/gh/gh-action-pypi-publish.git synced 2026-07-02 18:27:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Expose PEP 740 attestations functionality

Browse Source 
PR #236

This patch adds PEP 740 attestation generation to the workflow: when the Trusted Publishing flow is used, this will generate a publish attestation for each distribution being uploaded. These generated attestations are then fed into `twine`, which newly supports them via `--attestations`.

Ref: https://github.com/pypi/warehouse/issues/15871
This commit is contained in:
William Woodruff
2024-08-31 20:50:29 -04:00
committed by GitHub
parent fb9fc6a4e6
commit 8a08d61689
7 changed files with 274 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
requirements/runtime.in
+6 -1
View File
@@ -1,9 +1,14 @@
twine
# NOTE: Used to detect an ambient OIDC credential for OIDC publishing.
# NOTE: Used to detect an ambient OIDC credential for OIDC publishing,
# NOTE: as well as PEP 740 attestations.
id ~= 1.0
# NOTE: This is pulled in transitively through `twine`, but we also declare
# NOTE: it explicitly here because `oidc-exchange.py` uses it.
# Ref: https://github.com/di/id
requests
# NOTE: Used to generate attestations.
pypi-attestations ~= 0.0.11
sigstore ~= 3.2.0