mirror of
https://github.com/semantica-agi/semantica.git
synced 2026-09-04 04:01:07 +00:00
KaifAhmad1
48737629d9
Scorecard's Pinned-Dependencies check requires pip installs to be hash-verified, not just version-pinned - our existing pkg==X.Y.Z pins (and even pip install -r requirements-ci.txt, despite that file already carrying hashes) still scored a 4 because the pin/hash isn't visible on the command line itself. Adds .github/requirements/*.txt: hash-locked files generated via `uv pip compile --generate-hashes` for every pip target that isn't already requirements-ci.txt, covering standalone CI tooling (build, wheel, twine, uv, pip-audit, safety/bandit/semgrep/jq, pip/setuptools bootstrap) and the project's own local-source installs. The latter (`pip install -e ".[explorer]"`, `pip install -e .`) can't be hash-pinned directly since there's nothing to hash for a local source tree; split into `pip install --no-deps -e .` plus a separate hash-pinned install of the actual fetched dependencies instead. Also adds --require-hashes to every `-r requirements-ci.txt` install so hash verification is enforced explicitly rather than only implied by the file's own content. Simplifies the Dockerfile in the process: it now installs from the same pre-generated explorer-extra.txt (copied in at build time) instead of extracting constraints from requirements-ci.txt at build time, which also means setuptools gets its CVE-2025-47273 fix as a side effect of the hash-pinned install rather than a separate upgrade step. benchmark.yml: pip install -r benchmarks/requirements.txt is left unpinned - that directory doesn't exist in this repo, so there's nothing to generate hashes from. Pre-existing breakage, unrelated to this change.
92 lines
3.6 KiB
YAML
92 lines
3.6 KiB
YAML
name: Release
|
|
|
|
on:
|
|
push:
|
|
tags: ['v*']
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
release:
|
|
runs-on: ubuntu-latest
|
|
environment: pypi
|
|
concurrency:
|
|
group: release-${{ github.ref }}
|
|
cancel-in-progress: false
|
|
permissions:
|
|
contents: write # for the GitHub Release
|
|
id-token: write # for PyPI Trusted Publishing (OIDC), attestation signing, and Sigstore
|
|
attestations: write # for SLSA build provenance
|
|
# If you add another job to this workflow, give it its own explicit
|
|
# `permissions:` block rather than relying on the workflow-level default
|
|
# above (contents: read) - do not widen the workflow-level default.
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
|
|
- uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
|
|
with:
|
|
python-version: '3.11'
|
|
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
|
|
with:
|
|
node-version: '20'
|
|
cache: 'npm'
|
|
cache-dependency-path: explorer/package-lock.json
|
|
- name: Build Explorer frontend
|
|
working-directory: explorer
|
|
run: |
|
|
npm ci
|
|
npm run build
|
|
# Install the pinned dependency set (with hashes) so the sdist/wheel
|
|
# build runs against the same versions CI tests against.
|
|
- name: Install pinned build dependencies
|
|
run: pip install -r requirements-ci.txt --require-hashes
|
|
# build is a dev-time dependency; wheel is build-time only (neither is
|
|
# in requirements-ci.txt) — install the same pinned versions
|
|
# [build-system] declares so --no-isolation works below.
|
|
- run: pip install -r .github/requirements/build-tools.txt --require-hashes
|
|
- name: Build package (no isolation — pinned deps)
|
|
run: python -m build --no-isolation
|
|
- name: Verify Explorer frontend is packaged
|
|
run: |
|
|
python - <<'PY'
|
|
import zipfile
|
|
from pathlib import Path
|
|
|
|
wheels = list(Path("dist").glob("*.whl"))
|
|
assert wheels, "No wheel was built"
|
|
|
|
with zipfile.ZipFile(wheels[0]) as wheel:
|
|
names = set(wheel.namelist())
|
|
|
|
assert "semantica/static/index.html" in names, "Explorer index.html missing from wheel"
|
|
assert any(name.startswith("semantica/static/assets/") for name in names), "Explorer assets missing from wheel"
|
|
|
|
print("Explorer frontend is packaged")
|
|
PY
|
|
- name: Verify PyPI long-description will render
|
|
run: |
|
|
pip install -r .github/requirements/twine.txt --require-hashes
|
|
twine check dist/*
|
|
- name: Attest build provenance
|
|
uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4
|
|
with:
|
|
subject-path: 'dist/*'
|
|
# attest-build-provenance publishes to the GH attestations API only, which
|
|
# OpenSSF Scorecard's Signed-Releases check does not inspect - it looks for
|
|
# signature files attached as release assets. Sign here too so
|
|
# `dist/*.sigstore.json` bundles ship alongside the wheel/sdist on the
|
|
# GitHub Release itself.
|
|
- name: Sign artifacts with Sigstore
|
|
uses: sigstore/gh-action-sigstore-python@790bc6befb9d733738f18d8f895854b453640ec9 # v3.5.0
|
|
with:
|
|
inputs: |
|
|
dist/*.whl
|
|
dist/*.tar.gz
|
|
- uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
|
|
with:
|
|
files: |
|
|
dist/*.whl
|
|
dist/*.tar.gz
|
|
dist/*.sigstore.json
|
|
- uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1
|