Skip to content

Commit 036b071

Browse files
oberstetoberstet
committed
Preserve verified artifact chain-of-custody in release pipeline (#207)
Expand #207 beyond Discussions to bring the release pipeline into structural alignment with the rest of the WAMP group: build once, upload-verified, download-verified, publish the same bytes. Previously main.yml uploaded a verified package artifact that nothing ever downloaded (orphaned chain-of-custody), and release.yml rebuilt the wheel, sdist and docs from source — so the published bytes were not the ones tested. main.yml: - build-package: drop the redundant 3x interpreter matrix (the universal py3-none-any wheel is identical across interpreters) and build the full release fileset once — wheel AND source distribution — uploaded verified as `package`. (The documentation job already uploads the built HTML as a verified `documentation` artifact.) release.yml (both the nightly and the stable/PyPI jobs): - Replace the inline rebuilds (just build / build-sourcedist / docs) with download-artifact-verified of `package` and `documentation` from the triggering main run (run id from check-main-workflow.main_run_id), then archive the downloaded docs and publish those exact artifacts. The PyPI job still runs check-release-fileset on the verified payload. download-artifact-verified prefix-matches the meta-checksum-suffixed names, so `name: package` / `name: documentation` resolve without a discovery job. Verified locally: both workflows parse as valid YAML; `just build` + `just build-sourcedist` produce exactly the wheel + sdist that the release now downloads; no `just build*`/`just docs` remain in release.yml. The cross-run download path is release-event-only and will be exercised at the next nightly/stable release. Note: This work was completed with AI assistance (Claude Code).
1 parent 29d6487 commit 036b071

3 files changed

Lines changed: 52 additions & 86 deletions

File tree

‎.github/workflows/main.yml‎

Lines changed: 15 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -182,10 +182,6 @@ jobs:
182182
PR_REPO: ${{ needs.identifiers.outputs.pr_repo }}
183183
PR_BRANCH: ${{ needs.identifiers.outputs.pr_branch }}
184184

185-
strategy:
186-
matrix:
187-
python-env: [cpy314, cpy311, pypy311]
188-
189185
steps:
190186
- name: Checkout code
191187
uses: actions/checkout@v4
@@ -219,28 +215,33 @@ jobs:
219215
uses: actions/cache@v4
220216
with:
221217
path: ${{ env.UV_CACHE_DIR }}
222-
key: uv-cache-ubuntu-build-${{ matrix.python-env }}-${{
218+
key: uv-cache-ubuntu-build-${{
223219
hashFiles('pyproject.toml') }}
224220
restore-keys: |
225-
uv-cache-ubuntu-build-${{ matrix.python-env }}-
226221
uv-cache-ubuntu-build-
227222
228223
- name: Create Python environment and install tools
229224
run: |
230-
just create ${{ matrix.python-env }}
231-
just install-tools ${{ matrix.python-env }}
232-
233-
- name: Build package
234-
run: just build ${{ matrix.python-env }}
225+
just create cpy311
226+
just install-tools cpy311
227+
228+
# Build the full release fileset once (txaio is pure-Python: a single
229+
# universal wheel + source distribution). This is the canonical artifact
230+
# that the release workflow downloads (verified) and publishes - so what
231+
# is tested here is exactly what ships (chain-of-custody).
232+
- name: Build wheel and source distribution
233+
run: |
234+
just build cpy311
235+
just build-sourcedist cpy311
235236
236237
- name: List built artifacts
237238
run: |
238-
echo "Built artifacts for ${{ matrix.python-env }}:"
239+
echo "Built release fileset (wheel + sdist):"
239240
ls -la dist/
240241
241-
- name: Upload build artifacts
242+
- name: Upload build artifacts (verified)
242243
uses: wamp-proto/wamp-cicd/actions/upload-artifact-verified@main
243244
with:
244-
name: package-${{ matrix.python-env }}
245+
name: package
245246
path: dist/
246247
retention-days: 14

‎.github/workflows/release.yml‎

Lines changed: 36 additions & 72 deletions
Original file line numberDiff line numberDiff line change
@@ -113,56 +113,38 @@ jobs:
113113
with:
114114
submodules: recursive
115115

116-
- name: Install Just
117-
env:
118-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
119-
run: |
120-
curl --proto '=https' --tlsv1.2 -sSf https://just.systems/install.sh | bash -s -- --to ~/bin
121-
echo "$HOME/bin" >> $GITHUB_PATH
122-
123-
- name: Install uv
124-
env:
125-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
126-
run: |
127-
curl -LsSf https://astral.sh/uv/install.sh | sh
128-
source $HOME/.cargo/env
129-
echo "$HOME/.cargo/bin" >> $GITHUB_PATH
130-
131-
- name: Setup uv cache
132-
uses: actions/cache@v4
116+
# Chain-of-custody: download the exact, checksum-verified artifacts built
117+
# and uploaded by the main workflow, instead of rebuilding them here.
118+
- name: Download verified package (wheel + sdist)
119+
uses: wamp-proto/wamp-cicd/actions/download-artifact-verified@main
133120
with:
134-
path: ${{ env.UV_CACHE_DIR }}
135-
key: uv-cache-ubuntu-release-${{ hashFiles('pyproject.toml') }}
136-
restore-keys: |
137-
uv-cache-ubuntu-release-
138-
139-
- name: Build wheel package
140-
run: just build cpy311
141-
142-
- name: Build source distribution
143-
run: just build-sourcedist cpy311
121+
name: package
122+
path: ${{ github.workspace }}/dist/
123+
run-id: ${{ needs.check-main-workflow.outputs.main_run_id }}
124+
github-token: ${{ secrets.GITHUB_TOKEN }}
144125

145-
- name: Build documentation
146-
run: |
147-
just create cpy314
148-
just install-tools cpy314
149-
just docs cpy314
126+
- name: Download verified documentation
127+
uses: wamp-proto/wamp-cicd/actions/download-artifact-verified@main
128+
with:
129+
name: documentation
130+
path: ${{ github.workspace }}/docs/_build/html/
131+
run-id: ${{ needs.check-main-workflow.outputs.main_run_id }}
132+
github-token: ${{ secrets.GITHUB_TOKEN }}
150133

151134
- name: Create documentation archive
152135
run: |
153-
cd docs/_build/html
154-
tar -czf ../../../dist/txaio-docs.tar.gz *
155-
cd ../../..
136+
( cd docs/_build/html && tar --exclude='CHECKSUMS.sha256' -czf "${GITHUB_WORKSPACE}/dist/txaio-docs.tar.gz" * )
156137
157138
- name: Generate checksums
158139
run: |
159140
cd dist
141+
rm -f CHECKSUMS.sha256
160142
sha256sum * > CHECKSUMS-ALL.sha256
161143
cat CHECKSUMS-ALL.sha256
162144
163-
- name: List built packages
145+
- name: List release files
164146
run: |
165-
echo "Built packages:"
147+
echo "Release files:"
166148
ls -lh dist/
167149
168150
- name: Create development GitHub release
@@ -229,50 +211,32 @@ jobs:
229211
with:
230212
submodules: recursive
231213

232-
- name: Install Just
233-
env:
234-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
235-
run: |
236-
curl --proto '=https' --tlsv1.2 -sSf https://just.systems/install.sh | bash -s -- --to ~/bin
237-
echo "$HOME/bin" >> $GITHUB_PATH
238-
239-
- name: Install uv
240-
env:
241-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
242-
run: |
243-
curl -LsSf https://astral.sh/uv/install.sh | sh
244-
source $HOME/.cargo/env
245-
echo "$HOME/.cargo/bin" >> $GITHUB_PATH
246-
247-
- name: Setup uv cache
248-
uses: actions/cache@v4
214+
# Chain-of-custody: publish the exact, checksum-verified artifacts built
215+
# and uploaded by the main workflow - do not rebuild them here.
216+
- name: Download verified package (wheel + sdist)
217+
uses: wamp-proto/wamp-cicd/actions/download-artifact-verified@main
249218
with:
250-
path: ${{ env.UV_CACHE_DIR }}
251-
key: uv-cache-ubuntu-release-${{ hashFiles('pyproject.toml') }}
252-
restore-keys: |
253-
uv-cache-ubuntu-release-
254-
255-
- name: Build wheel package
256-
run: just build cpy311
219+
name: package
220+
path: ${{ github.workspace }}/dist/
221+
run-id: ${{ needs.check-main-workflow.outputs.main_run_id }}
222+
github-token: ${{ secrets.GITHUB_TOKEN }}
257223

258-
- name: Build source distribution
259-
run: just build-sourcedist cpy311
260-
261-
- name: Build documentation
262-
run: |
263-
just create cpy314
264-
just install-tools cpy314
265-
just docs cpy314
224+
- name: Download verified documentation
225+
uses: wamp-proto/wamp-cicd/actions/download-artifact-verified@main
226+
with:
227+
name: documentation
228+
path: ${{ github.workspace }}/docs/_build/html/
229+
run-id: ${{ needs.check-main-workflow.outputs.main_run_id }}
230+
github-token: ${{ secrets.GITHUB_TOKEN }}
266231

267232
- name: Create documentation archive
268233
run: |
269-
cd docs/_build/html
270-
tar -czf ../../../dist/txaio-docs.tar.gz *
271-
cd ../../..
234+
( cd docs/_build/html && tar --exclude='CHECKSUMS.sha256' -czf "${GITHUB_WORKSPACE}/dist/txaio-docs.tar.gz" * )
272235
273236
- name: Generate checksums (for GitHub release)
274237
run: |
275238
cd dist
239+
rm -f CHECKSUMS.sha256
276240
sha256sum * > CHECKSUMS-ALL.sha256
277241
cat CHECKSUMS-ALL.sha256
278242

‎docs/changelog.rst‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@ This document contains a reverse-chronological list of changes to txaio.
1717

1818
**Other**
1919

20+
* Preserve verified artifact chain-of-custody in the release pipeline, aligning txaio with the rest of the WAMP group. The wheel, source distribution and documentation are now built **once** in the ``main`` workflow and uploaded with ``upload-artifact-verified``; the ``release`` workflow ``download-artifact-verified``\s those exact, checksum-verified artifacts (by ``main`` run id) and publishes them, instead of rebuilding from source. This guarantees that what is tested is what is shipped (`#207 <https://github.com/crossbario/txaio/issues/207>`_)
2021
* Auto-publish a GitHub Discussions announcement for nightly and stable releases: a new ``release-post-comment.yml`` workflow runs after the ``release`` workflow, finds the freshly-created GitHub Release and posts its notes into the Discussions ``cicd`` category. The category is resolved by name (case-insensitive), so no repo-specific category id is hard-coded. Requires GitHub Discussions enabled on the repository with a ``cicd`` category (`#207 <https://github.com/crossbario/txaio/issues/207>`_)
2122
* Align artifact handling with the rest of the WAMP group: CI now uploads build, coverage and documentation artifacts via the shared ``upload-artifact-verified`` action (SHA256 chain-of-custody), and the release workflow validates the exact PyPI payload — the universal ``py3-none-any`` wheel plus the source distribution — with the shared, fail-closed ``check-release-fileset`` action before publishing (`#212 <https://github.com/crossbario/txaio/issues/212>`_)
2223
* Remove three permanently-skipped legacy tests that exercised the ``@asyncio.coroutine`` decorator. That decorator was removed in Python 3.11 (txaio's minimum supported version), so the tests could no longer run on any supported interpreter and only emitted skips (`#152 <https://github.com/crossbario/txaio/issues/152>`_)

0 commit comments

Comments
 (0)