In #270, @facutuesca💰 made a follow-up to their previous PR #250, making the hints show up more granularly. This effectively makes sure that the suggestion to enable Trusted Publishing does not get displayed when it's already in use. It also makes the message nicer in a few places on the UI.
🛠️ Internal Dependencies
@mosfet80💰 updated a few internal linter versions in #266, #267, and #271, no user impact. This is usually automated otherwise.
In #250 and #258, @facutuesca💰 added a nudge message with a magic link to pre-fill the creation of new Trusted Publishers configurations on PyPI. The users are now suggested to configure tokenless publishing by clicking a link printed in the job summary when it's detected that they publish to PyPI or TestPyPI. Just like magic! 🦄
🙏 Special Thanks to @henryiii💰 for promptly pointing up possible fixes for #263.
v1.10.1
🚑🔏 Oopsie... We missed a tiny bug in the attestations feature the other day
The problem was that the distribution file validity check was failing on any valid distribution being present and ready to be signed. What a silly mistake! It's now been fixed via https://github.com/pypa/gh-action-pypi-publish/commit/0ab0b79, though. So everything's good!
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
- `@dependabot ignore minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
- `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency
- `@dependabot unignore ` will remove the ignore condition of the specified dependency and ignore conditions
Bumps the dependencies group with 3 updates in the / directory: actions/checkout, codecov/codecov-action and pypa/gh-action-pypi-publish.
Updates
actions/checkoutfrom 4.1.7 to 4.2.1Release notes
Sourced from actions/checkout's releases.
Changelog
Sourced from actions/checkout's changelog.
... (truncated)
Commits
eef6144Prepare 4.2.1 release (#1925)6b42224Add workflow file for publishing releases to immutable action package (#1919)de5a000Check out other refs/* by commit if provided, fall back to ref (#1924)d632683Prepare 4.2.0 release (#1878)6d193bfBump braces from 3.0.2 to 3.0.3 (#1777)db0cee9Bump the minor-npm-dependencies group across 1 directory with 4 updates (#1872)b684943Add Ref and Commit outputs (#1180)2d7d9f7Provide explanation for where user email came from (#1869)9a9194fBump docker/build-push-action from 5.3.0 to 6.5.0 (#1832)dd960bdBump docker/login-action in the minor-actions-dependencies group (#1831)Updates
codecov/codecov-actionfrom 4.5.0 to 4.6.0Release notes
Sourced from codecov/codecov-action's releases.
... (truncated)
Commits
b9fd7d1chore(release):4.6.0 (#1587)6f7612cfix: bump eslint parser deps (#1586)26c7e28build(deps): bump actions/checkout from 4.1.7 to 4.2.0 (#1583)6f744f7build(deps): bump github/codeql-action from 3.26.8 to 3.26.9 (#1584)543c3d4chore: fix typo of OSS (#1578)e379426build(deps-dev): bump@vercel/nccfrom 0.38.1 to 0.38.2 (#1577)42656e4build(deps): bump github/codeql-action from 3.26.7 to 3.26.8 (#1575)2296b6bbuild(deps-dev): bump eslint from 8.57.0 to 8.57.1 (#1571)bd77bc3build(deps): bump github/codeql-action from 3.26.6 to 3.26.7 (#1569)180b964build(deps-dev): bump@types/jestfrom 29.5.12 to 29.5.13 (#1567)Updates
pypa/gh-action-pypi-publishfrom 1.10.0 to 1.10.3Release notes
Sourced from pypa/gh-action-pypi-publish's releases.
... (truncated)
Commits
f760068Merge pull request #271 from mosfet80/patch-36edc294Fix node.js v16 deprecation self-smoke-test-action.yml85a5a80Merge pull request #270 from trail-of-forks/fix-magic-link-summary954318bMerge pull request #267 from mosfet80/patch-224791c7Merge pull request #266 from mosfet80/patch-1d8c8948Fix magic link nudge formatting in job summarya1ce384Check for Trusted Publishing in magic link logic00b87c8Update check-jsonschema and pre-commit libsa571f1eUpdate pylint lib897895fMerge pull request #262 from trail-of-forks/ww/bump-attestations-reqDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show