patch: Add SLSA provenance to release assets #217
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
See https://slsa.dev/ for motivation. Creating a patch release to ensure these additions to the automated release process work. Note that the `release` job has been subdivided, because the SLSA provenance reusable workflow cannot be used as a step within a job, but must be used as a job on its own.
Reviewer's GuideThis PR refactors the semantic-release GitHub Actions workflow to centralize concurrency, compute and upload artifact hashes, generate SLSA provenance attestations, and introduce a dedicated publish job that hardens the runner, aggregates artifacts and provenance, and publishes to GitHub Releases and PyPI. Flow diagram for the new release and publish processflowchart TD
Start([Start]) --> Release[Release Job]
Release -->|If released| Hash[Hash Build Artifacts]
Hash --> Upload[Upload Build Artifacts]
Upload --> Provenance[Provenance Job]
Provenance --> Publish[Publish Job]
Publish -->|Download Artifacts & Provenance| Aggregate[Aggregate Artifacts]
Aggregate -->|Remove Provenance for PyPI| Clean[Clean Artifacts]
Clean -->|Publish| GitHub[GitHub Releases]
Clean -->|Publish| PyPI[PyPI]
GitHub --> End([End])
PyPI --> End
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey @jmgate - I've reviewed your changes - here's some feedback:
- In the provenance job, explicitly upload the generated provenance file (e.g. with actions/upload-artifact) so that the publish job’s download-artifact step can reliably fetch it.
- Add a validation step in the publish job to verify the downloaded provenance file matches the computed artifact hashes before publishing to ensure integrity.
- Consider parameterizing the artifact and provenance filenames/paths (instead of hardcoding in rm -f) to make future workflow updates less error-prone.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- In the provenance job, explicitly upload the generated provenance file (e.g. with actions/upload-artifact) so that the publish job’s download-artifact step can reliably fetch it.
- Add a validation step in the publish job to verify the downloaded provenance file matches the computed artifact hashes before publishing to ensure integrity.
- Consider parameterizing the artifact and provenance filenames/paths (instead of hardcoding in rm -f) to make future workflow updates less error-prone.
## Individual Comments
### Comment 1
<location> `.github/workflows/semantic-release.yml:42` </location>
<code_context>
- - name: Publish to PyPI
- uses: pypa/gh-action-pypi-publish@76f52bc884231f62b9a034ebfe128415bbaabdfc # release/v1
+ - name: Hash Build Artifacts
+ if: steps.release.outputs.released == 'true'
+ id: hash
+ run: |
+ cd dist
+ echo "hashes=$(find . -type f -exec sha256sum {} + | sort | base64 | tr -d '\n')" >> "$GITHUB_OUTPUT"
+
+ - name: Upload Build Artifacts
</code_context>
<issue_to_address>
The artifact hashing step may not be robust to non-ASCII filenames or large numbers of files.
Using `find . -type f -exec sha256sum {} + | sort | base64` may not handle filenames with spaces, newlines, or non-ASCII characters correctly. Consider `find . -type f -print0 | xargs -0 sha256sum` for better robustness. Also, be aware of potential command limits with very large file counts.
</issue_to_address>
<suggested_fix>
<<<<<<< SEARCH
echo "hashes=$(find . -type f -exec sha256sum {} + | sort | base64 | tr -d '\n')" >> "$GITHUB_OUTPUT"
=======
echo "hashes=$(find . -type f -print0 | xargs -0 sha256sum | sort | base64 | tr -d '\n')" >> "$GITHUB_OUTPUT"
>>>>>>> REPLACE
</suggested_fix>Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
| id: hash | ||
| run: | | ||
| cd dist | ||
| echo "hashes=$(find . -type f -exec sha256sum {} + | sort | base64 | tr -d '\n')" >> "$GITHUB_OUTPUT" |
There was a problem hiding this comment.
suggestion: The artifact hashing step may not be robust to non-ASCII filenames or large numbers of files.
Using find . -type f -exec sha256sum {} + | sort | base64 may not handle filenames with spaces, newlines, or non-ASCII characters correctly. Consider find . -type f -print0 | xargs -0 sha256sum for better robustness. Also, be aware of potential command limits with very large file counts.
Suggested change
| echo "hashes=$(find . -type f -exec sha256sum {} + | sort | base64 | tr -d '\n')" >> "$GITHUB_OUTPUT" | |
| echo "hashes=$(find . -type f -print0 | xargs -0 sha256sum | sort | base64 | tr -d '\n')" >> "$GITHUB_OUTPUT" |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #217 +/- ##
=========================================
Coverage 100.00% 100.00%
=========================================
Files 2 2
Lines 176 176
Branches 15 15
=========================================
Hits 176 176 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Type: Task
Description
See sandialabs/reverse_argparse#315.
Summary by Sourcery
Integrate SLSA provenance generation into the release pipeline by restructuring the semantic-release workflow into separate release, provenance, and publish jobs with artifact hashing, uploading, runner hardening, and cleanup steps.
New Features:
Enhancements:
CI: