GeezerVison is showing github.com — powertools-lambda-python/.github/workflows/pre-release.yml at develop · siwyd/powertools-lambda-python

Expand file tree

pre-release.yml

Copy path

View runs

More file actions

Latest commit

History

264 lines (232 loc) · 10.9 KB

pre-release.yml

Copy path

File metadata and controls

264 lines (232 loc) · 10.9 KB

Raw

Copy raw file

Download raw file

Open symbols panel

Edit and raw actions

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

213

214

215

216

217

218

219

220

221

222

223

224

225

226

227

228

229

230

231

232

233

234

235

236

237

238

239

240

241

242

243

244

245

246

247

248

249

250

251

252

253

254

255

256

257

258

259

260

261

262

263

264

name: Pre-Release

# PRE-RELEASE PROCESS

# === Automated activities ===

# 1. [Seal] Bump to release version and export source code with integrity hash

# 2. [Quality check] Restore sealed source code, run tests, linting, security and complexity base line

# 3. [Build] Restore sealed source code, create and export hashed build artifact for PyPi release (wheel, tarball)

# 4. [Provenance] Generates provenance for build, signs attestation with GitHub OIDC claims to confirm it came from this release pipeline, commit, org, repo, branch, hash, etc.

# 5. [Release] Restore built artifact, and publish package to PyPi prod repository

# 6. [PR to bump version] Restore sealed source code, and create a PR to update trunk with latest released project metadata

# NOTE

# See MAINTAINERS.md "Releasing a new version" for release mechanisms

# Every job is isolated and starts a new fresh container.

env:

RELEASE_COMMIT: ${{ github.sha }}

on:

workflow_dispatch:

inputs:

version:

description: "Pre-release version to publish (e.g., 3.24.0a0)"

required: true

type: string

skip_code_quality:

description: "Skip tests, linting, and baseline. Only use if release fail for reasons beyond our control and you need a quick release."

default: false

type: boolean

required: false

skip_pypi:

description: "Skip publishing to PyPi. Used for testing release steps."

default: false

type: boolean

required: false

permissions:

contents: read

jobs:

# This job bumps the package version to the pre-release version

# creates an integrity hash from the source code

# uploads the artifact with the integrity hash as the key name

# so subsequent jobs can restore from a trusted point in time to prevent tampering

seal:

# ignore forks

if: github.repository == 'aws-powertools/powertools-lambda-python'

runs-on: ubuntu-latest

permissions:

contents: read

outputs:

integrity_hash: ${{ steps.seal_source_code.outputs.integrity_hash }}

artifact_name: ${{ steps.seal_source_code.outputs.artifact_name }}

RELEASE_VERSION: ${{ steps.release_version.outputs.RELEASE_VERSION }}

steps:

- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

with:

ref: ${{ env.RELEASE_COMMIT }}

- name: Set release version

id: release_version

run: echo "RELEASE_VERSION=${{ inputs.version }}" >> "$GITHUB_OUTPUT"

- name: Verify pre-release version semantics

run: |

if [[ ! "${{ inputs.version }}" =~ ^[0-9]+\.[0-9]+\.[0-9]+[a-b][0-9]+$ ]]; then

echo "Version ${{ inputs.version }} doesn't look like a pre-release version (e.g., 3.24.0a0); aborting"

exit 1

- name: Update version in pyproject.toml

run: sed -i 's/^version = ".*"/version = "${{ inputs.version }}"/' pyproject.toml

- name: Update version in version.py

run: sed -i 's/^VERSION = ".*"/VERSION = "${{ inputs.version }}"/' aws_lambda_powertools/shared/version.py

- name: Seal and upload

id: seal_source_code

uses: ./.github/actions/seal

with:

artifact_name_prefix: "source"

# This job runs our automated test suite, complexity and security baselines

# it ensures previously merged have been tested as part of the pull request process

# NOTE

# we don't upload the artifact after testing to prevent any tampering of our source code dependencies

quality_check:

needs: seal

runs-on: ubuntu-latest

permissions:

contents: read

steps:

# NOTE: we need actions/checkout to configure git first (pre-commit hooks in make dev)

- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

with:

ref: ${{ env.RELEASE_COMMIT }}

- name: Restore sealed source code

uses: ./.github/actions/seal-restore

with:

integrity_hash: ${{ needs.seal.outputs.integrity_hash }}

artifact_name: ${{ needs.seal.outputs.artifact_name }}

- name: Debug cache restore

run: cat pyproject.toml

- name: Install poetry

run: pipx install git+https://github.com/python-poetry/poetry@bd500dd3bdfaec3de6894144c9cedb3a9358be84 # v2.0.1

- name: Set up Python

uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0

with:

python-version: "3.14"

cache: "poetry"

- name: Install dependencies

run: make dev

- name: Run all tests, linting and baselines

run: make pr

# This job creates a release artifact (tar.gz, wheel)

# it checks out code from release commit for custom actions to work

# then restores the sealed source code (overwrites any potential tampering)

# it's done separately from release job to enforce least privilege.

# We export just the final build artifact for release

build:

runs-on: ubuntu-latest

needs: [quality_check, seal]

permissions:

contents: read

outputs:

integrity_hash: ${{ steps.seal_build.outputs.integrity_hash }}

artifact_name: ${{ steps.seal_build.outputs.artifact_name }}

attestation_hashes: ${{ steps.encoded_hash.outputs.attestation_hashes }}

steps:

# NOTE: we need actions/checkout to configure git first (pre-commit hooks in make dev)

- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

with:

ref: ${{ env.RELEASE_COMMIT }}

- name: Restore sealed source code

uses: ./.github/actions/seal-restore

with:

integrity_hash: ${{ needs.seal.outputs.integrity_hash }}

artifact_name: ${{ needs.seal.outputs.artifact_name }}

- name: Install poetry

run: pipx install git+https://github.com/python-poetry/poetry@bd500dd3bdfaec3de6894144c9cedb3a9358be84 # v2.0.1

- name: Set up Python

uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0

with:

python-version: "3.14"

cache: "poetry"

- name: Build python package and wheel

run: poetry build

- name: Seal and upload

id: seal_build

uses: ./.github/actions/seal

with:

artifact_name_prefix: "build"

files: "dist/"

# NOTE: SLSA retraces our build to its artifact to ensure it wasn't tampered

# coupled with GitHub OIDC, SLSA can then confidently sign it came from this release pipeline+commit+branch+org+repo+actor+integrity hash

- name: Create attestation encoded hash for provenance

id: encoded_hash

working-directory: dist

run: echo "attestation_hashes=$(sha256sum ./* | base64 -w0)" >> "$GITHUB_OUTPUT"

# This job creates a provenance file that describes how our release was built (all steps)

# after it verifies our build is reproducible within the same pipeline

# it confirms that its own software and the CI build haven't been tampered with (Trust but verify)

# lastly, it creates and sign an attestation (multiple.intoto.jsonl) that confirms

# this build artifact came from this GitHub org, branch, actor, commit ID, inputs that triggered this pipeline, and matches its integrity hash

# NOTE: supply chain threats review (we protect against all of them now): https://slsa.dev/spec/v1.0/threats-overview

provenance:

needs: [seal, build]

permissions:

contents: write # nested job explicitly require despite upload assets being set to false

actions: read # To read the workflow path.

id-token: write # To sign the provenance.

# NOTE: provenance fails if we use action pinning... it's a Github limitation

# because SLSA needs to trace & attest it came from a given branch; pinning doesn't expose that information

# https://github.com/slsa-framework/slsa-github-generator/blob/main/internal/builders/generic/README.md#referencing-the-slsa-generator

uses: slsa-framework/slsa-github-generator/.github/workflows/[email protected]

with:

base64-subjects: ${{ needs.build.outputs.attestation_hashes }}

upload-assets: false # we upload its attestation in create_tag job, otherwise it creates a new release

# This job uses release artifact to publish to PyPi

# it exchanges JWT tokens with GitHub to obtain PyPi credentials

# since it's already registered as a Trusted Publisher.

# It uses the sealed build artifact (.whl, .tar.gz) to release it

release:

needs: [build, seal, provenance]

environment: pre-release

runs-on: ubuntu-latest

permissions:

id-token: write # OIDC for PyPi Trusted Publisher feature

env:

RELEASE_VERSION: ${{ needs.seal.outputs.RELEASE_VERSION }}

steps:

# NOTE: we need actions/checkout in order to use our local actions (e.g., ./.github/actions)

- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

with:

ref: ${{ env.RELEASE_COMMIT }}

- name: Restore sealed source code

uses: ./.github/actions/seal-restore

with:

integrity_hash: ${{ needs.build.outputs.integrity_hash }}

artifact_name: ${{ needs.build.outputs.artifact_name }}

- name: Upload to PyPi prod

if: ${{ !inputs.skip_pypi }}

uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0

# Creates a PR with the latest version we've just released

# since our trunk is protected against any direct pushes from automation

bump_version:

needs: [release, seal, provenance]

permissions:

contents: write # create-pr action creates a temporary branch

pull-requests: write # create-pr action creates a PR using the temporary branch

runs-on: ubuntu-latest

steps:

# NOTE: we need actions/checkout to authenticate and configure git first

- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

with:

ref: ${{ env.RELEASE_COMMIT }}

- name: Restore sealed source code

uses: ./.github/actions/seal-restore

with:

integrity_hash: ${{ needs.seal.outputs.integrity_hash }}

artifact_name: ${{ needs.seal.outputs.artifact_name }}

- name: Download provenance

uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0

with:

name: ${{needs.provenance.outputs.provenance-name}}

- name: Update provenance

run: mkdir -p "${PROVENANCE_DIR}" && mv "${PROVENANCE_FILE}" "${PROVENANCE_DIR}/"

env:

PROVENANCE_FILE: ${{ needs.provenance.outputs.provenance-name }}

PROVENANCE_DIR: provenance/${{ needs.seal.outputs.RELEASE_VERSION}}

- name: Create PR

id: create-pr

uses: ./.github/actions/create-pr

with:

files: "pyproject.toml aws_lambda_powertools/shared/version.py provenance/"

temp_branch_prefix: "ci-bump"

pull_request_title: "chore(ci): new pre-release ${{ needs.seal.outputs.RELEASE_VERSION }}"

github_token: ${{ secrets.GITHUB_TOKEN }}