Skip to content

Commit

Permalink
[8.2.x] Attest package provenance (#12335)
Browse files Browse the repository at this point in the history
Co-authored-by: Bruno Oliveira <nicoddemus@gmail.com>
  • Loading branch information
github-actions[bot] and nicoddemus authored May 17, 2024
1 parent bb5a125 commit f3dd93a
Show file tree
Hide file tree
Showing 3 changed files with 10 additions and 2 deletions.
9 changes: 8 additions & 1 deletion .github/workflows/deploy.yml
Original file line number Diff line number Diff line change
Expand Up @@ -19,14 +19,21 @@ jobs:
SETUPTOOLS_SCM_PRETEND_VERSION: ${{ github.event.inputs.version }}
timeout-minutes: 10

# Required by attest-build-provenance-github.
permissions:
id-token: write
attestations: write

steps:
- uses: actions/checkout@v4
with:
fetch-depth: 0
persist-credentials: false

- name: Build and Check Package
uses: hynek/build-and-inspect-python-package@v2.4.0
uses: hynek/build-and-inspect-python-package@v2.5.0
with:
attest-build-provenance-github: 'true'

deploy:
if: github.repository == 'pytest-dev/pytest'
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/test.yml
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,7 @@ jobs:
fetch-depth: 0
persist-credentials: false
- name: Build and Check Package
uses: hynek/build-and-inspect-python-package@v2.4.0
uses: hynek/build-and-inspect-python-package@v2.5.0

build:
needs: [package]
Expand Down
1 change: 1 addition & 0 deletions changelog/12333.trivial.rst
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
pytest releases are now attested using the recent `Artifact Attestation <https://github.blog/2024-05-02-introducing-artifact-attestations-now-in-public-beta/>` support from GitHub, allowing users to verify the provenance of pytest's sdist and wheel artifacts.

0 comments on commit f3dd93a

Please sign in to comment.