ci/python-publish: bump, use trusted publishing

woodruffw commented 3 months ago

Fixes #2344.

Tasks

For all workflows, the workflow:

[x] Should be contained in a .yml file with the language or platform as its filename, in lower, kebab-cased format (for example, docker-image.yml). Special characters should be removed or replaced with words as appropriate (for example, "dotnet" instead of ".NET").
[x] Should use sentence case for the names of workflows and steps (for example, "Run tests").
[x] Should be named only by the name of the language or platform (for example, "Go", not "Go CI" or "Go Build").
[x] Should include comments in the workflow for any parts that are not obvious or could use clarification.
[x] Should specify least privileged permissions for GITHUB_TOKEN so that the workflow runs successfully.

For CI workflows, the workflow:

[x] Should be preserved under the ci directory.
[ ] Should include a matching ci/properties/*.properties.json file (for example, ci/properties/docker-publish.properties.json).
[x] Should run on push to branches: [ $default-branch ] and pull_request to branches: [ $default-branch ].
[x] Packaging workflows should run on release with types: [ created ].
[x] Publishing workflows should have a filename that is the name of the language or platform, in lower case, followed by "-publish" (for example, docker-publish.yml).

Some general notes:

[x] This workflow must only use actions that are produced by GitHub, in the actions organization, or
[x] This workflow must only use actions that are produced by the language or ecosystem that the workflow supports. These actions must be published to the GitHub Marketplace. We require that these actions be referenced using the full 40 character hash of the action's commit instead of a tag. Additionally, workflows must include the following comment at the top of the workflow file:
```
# This workflow uses actions that are not certified by GitHub.
# They are provided by a third-party and are governed by
# separate terms of service, privacy policy, and support
# documentation.
```
[x] Automation and CI workflows should not send data to any 3rd party service except for the purposes of installing dependencies.
[x] Automation and CI workflows cannot be dependent on a paid service or product.

woodruffw commented 3 months ago

xref https://github.com/actions/starter-workflows/issues/2344, https://github.com/github/docs/pull/32146

CC @di @jhutchings1

CC @webknjaz as well, as the maintainer of gh-action-pypi-publish 🙂

jhutchings1 commented 3 months ago

@juliandunn @N-Usha FYI, I've been in discussion with @woodruffw, @di and the PyPI team about this. This change switches from using token based authentication to OIDC, and would be a great benefit to the security posture of this community. Let me know if you have any questions I can help with to get the review prioritized by Actions engineering.

webknjaz commented 3 months ago

@woodruffw love that this is moving somewhere! Thank you for getting to this sooner than me :) I've been frustrated with how many people get pre-historic workflows by default and don't even know it...

One extra thing to consider — it might be useful to also stick Sigstore signing right into the starter. OTOH, giving people a link to the guide might be an alternative.

webknjaz commented 3 months ago

I've been in discussion with @woodruffw, @di and the PyPI team about this.

Linking some context: https://github.com/pypa/gh-action-pypi-publish/pull/123#issuecomment-1982201999

woodruffw commented 3 months ago

One extra thing to consider — it might be useful to also stick Sigstore signing right into the starter. OTOH, giving people a link to the guide might be an alternative.

I'd personally like to shy away from suggesting the Sigstore action here for now, if only because (with PEP 740) it'll become obsolete and integrated directly into the publishing flow 🙂

woodruffw commented 3 months ago

This should be good to go. I think it might make sense to review and land this before https://github.com/github/docs/pull/32146, since the workflow changes here will need to be reflected there as well.

woodruffw commented 1 month ago

Gentle ping for review here!

(@jhutchings1 I'm calling in that promise 😉)

woodruffw commented 2 weeks ago

Another gentle ping for review here: I believe this should be merged before https://github.com/github/docs/pull/32146 goes forwards, since those docs will link to this workflow.

jhutchings1 commented 2 weeks ago

@nebuk89 Can you help get this prioritized?

actions / starter-workflows

ci/python-publish: bump, use trusted publishing #2345

Tasks