mirror of
https://github.com/semantica-agi/semantica.git
synced 2026-09-02 04:00:40 +00:00
Mohd Kaif
56b174781f
Distribution and trust-signal infrastructure to make pip install semantica
frictionless in downstream CI, and to bring the release pipeline in line
with mature OSS practice.
- .github/actions/setup-semantica: reusable composite action other repos
can call to install + verify semantica in one step
- install-matrix.yml: verifies the published package installs and imports
cleanly across Ubuntu/macOS/Windows x Python 3.9-3.12, weekly and on
release; backs a new README badge
- scorecard.yml: OpenSSF Scorecard analysis, weekly and on push to main,
backing a new README badge
- release.yml: twine check gate before publish, catching a broken PyPI
long-description render before it ships
- CITATION.cff: enables GitHub's native "Cite this repository" button
- examples/ci/: copy-paste GitHub Actions, GitLab CI, and CircleCI
templates for projects adopting semantica
- GROWTH.md: tracked checklist of distribution channels, what's done vs
outstanding, with guardrails against inflating metrics artificially
Fixes folded in along the way:
- Re-pinned softprops/action-gh-release to the immutable v3.0.3 tag
instead of the floating v3, after verify-action-pins.sh caught the
mutable tag had drifted to a newer commit
- setup-semantica now passes extras/version through env vars instead of
interpolating ${{ inputs.* }} directly into the bash script, closing
a script-injection vector for callers deriving these from event data
- install-matrix now triggers on the Release workflow's completion
(workflow_run) instead of release: published, since the GitHub release
is created before the PyPI upload runs and the old trigger could race
the publish
- The workflow_run path derives the expected version from the triggering
tag and passes it into setup-semantica's version input, so pip
installs and verifies the exact release instead of whatever's latest
on PyPI at the time
- setup-semantica's pip caching is now opt-in (default disabled), since
actions/setup-python errors out with cache: 'pip' enabled when the
caller repo has no requirements.txt/pyproject.toml to key on
- examples/ci/github-actions.yml pins actions/checkout and
actions/setup-python to verified commit SHAs instead of mutable tags
- examples/ci templates guard the requirements.txt install step with
-f requirements.txt and call out pyproject.toml/Poetry/Pipenv as
alternatives, since not every project has a requirements.txt
78 lines
2.9 KiB
YAML
78 lines
2.9 KiB
YAML
name: Release
|
|
|
|
on:
|
|
push:
|
|
tags: ['v*']
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
release:
|
|
runs-on: ubuntu-latest
|
|
environment: pypi
|
|
concurrency:
|
|
group: release-${{ github.ref }}
|
|
cancel-in-progress: false
|
|
permissions:
|
|
contents: write # for the GitHub Release
|
|
id-token: write # for PyPI Trusted Publishing (OIDC) and attestation signing
|
|
attestations: write # for SLSA build provenance
|
|
# If you add another job to this workflow, give it its own explicit
|
|
# `permissions:` block rather than relying on the workflow-level default
|
|
# above (contents: read) - do not widen the workflow-level default.
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
|
|
- uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
|
|
with:
|
|
python-version: '3.11'
|
|
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
|
|
with:
|
|
node-version: '20'
|
|
cache: 'npm'
|
|
cache-dependency-path: explorer/package-lock.json
|
|
- name: Build Explorer frontend
|
|
working-directory: explorer
|
|
run: |
|
|
npm ci
|
|
npm run build
|
|
# Install the pinned dependency set (with hashes) so the sdist/wheel
|
|
# build runs against the same versions CI tests against.
|
|
- name: Install pinned build dependencies
|
|
run: pip install -r requirements-ci.txt
|
|
- run: pip install build
|
|
# wheel is build-time only (not in requirements-ci.txt) — install the
|
|
# same pinned version [build-system] declares so --no-isolation works.
|
|
- run: pip install wheel==0.48.0
|
|
- name: Build package (no isolation — pinned deps)
|
|
run: python -m build --no-isolation
|
|
- name: Verify Explorer frontend is packaged
|
|
run: |
|
|
python - <<'PY'
|
|
import zipfile
|
|
from pathlib import Path
|
|
|
|
wheels = list(Path("dist").glob("*.whl"))
|
|
assert wheels, "No wheel was built"
|
|
|
|
with zipfile.ZipFile(wheels[0]) as wheel:
|
|
names = set(wheel.namelist())
|
|
|
|
assert "semantica/static/index.html" in names, "Explorer index.html missing from wheel"
|
|
assert any(name.startswith("semantica/static/assets/") for name in names), "Explorer assets missing from wheel"
|
|
|
|
print("Explorer frontend is packaged")
|
|
PY
|
|
- name: Verify PyPI long-description will render
|
|
run: |
|
|
pip install twine==7.0.0
|
|
twine check dist/*
|
|
- name: Attest build provenance
|
|
uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4
|
|
with:
|
|
subject-path: 'dist/*'
|
|
- uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
|
|
with:
|
|
files: dist/*
|
|
- uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1
|