nautobot / cookiecutter-nautobot-app

Cookiecutter template for creating new Nautobot Apps.
https://docs.nautobot.com/projects/cookiecutter-nautobot-app/en/latest/
Apache License 2.0
16 stars 5 forks source link

Replace third party action in release process #176

Open cmsirbu opened 1 month ago

cmsirbu commented 1 month ago

The action svenstaro/upload-release-action is used to upload the wheels into the GH release. Using actions from third-parties is a security concern when tokens with write permissions are involved.

Release files can be uploaded using github tooling as follows:

      - run: "gh release upload ${{ github.event.release.tag_name }} dist/*.{tar.gz,whl}"
        env:
          GH_TOKEN: "${{ github.token }}"

The code above should be adapted and tested in nautobot-app-dev-example with the updated release checklist steps.

bryanculver commented 1 month ago

DoD