search

pyupio / safety

Safety checks Python dependencies for known security vulnerabilities and suggests the proper remediations for vulnerabilities detected.
https://safetycli.com/product/safety-cli
MIT License
1.66k stars 141 forks source link

GitHub Actions Workflow `main/create-gh-release` appear to be broken #472

Open Daverball opened 1 year ago

Daverball commented 1 year ago

Description

The Releases on GitHub for all >=2.3.0 don't contain the binaries you are building on the CI. I can still see that the artifacts were created in the GitHub Actions run summary for those versions, but they are not being added to the release as a download.

But the workflow runs for older versions don't look much better, so I'm not sure if in the past you just manually downloaded the artifacts and attached them to the release, because it doesn't look like that part ever worked. At least I couldn't find a workflow run that seemed to do that part correctly.

yeisonvargasf commented 1 year ago

You are right; there is a WIP about this; I created #459.

CI/CD will be revamped soon.

Daverball commented 1 year ago

On that note: I think it would be nice to publish a sha256_sum for every binary in the release notes, so we can verify the integrity of the download. Currently I'm just manually downloading the release once and calculating the sum myself, so that all our servers can run the check on the download before replacing their binary with a newer version.