Attach wheel, sdist, and PEP 740 attestations to GitHub release#151
Merged
Conversation
OpenSSF Scorecard's Signed-Releases check only inspects GitHub release assets, not PyPI. Today the release page only carries the CycloneDX SBOM, so Scorecard reports the release as unsigned and lacking provenance even though PyPI has full PEP 740 attestations. pypa/gh-action-pypi-publish writes <dist>.publish.attestation files next to each wheel and sdist when attestations are enabled (the action's default). Surface those files, plus the wheel and sdist themselves, by extending the existing release-upload step to attach everything in one shot. Scorecard recognizes .publish.attestation as PEP 740 provenance and the check will pass on the next release. The release page now mirrors what PyPI carries: artifacts, signatures, and the SBOM. No new workflow steps, no new dependencies; just a wider upload glob in the step that already runs.
Owner
Author
|
RPMs are flaking until the version is fixed |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
pypa/gh-action-pypi-publishalready writes<dist>.publish.attestationfiles intodist/(attestations are on by default in the pinned version)..publish.attestationfiles, and the SBOM in one shot. Scorecard recognizes.publish.attestationas PEP 740 provenance.Effect
Test plan
.whl,.tar.gz, two.publish.attestationfiles, plus the SBOM