Skip to content

DEVOPS-1154: address warnings upon publishing Python packages from GitHub #166

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
RomFloreani wants to merge 4 commits into
base: develop
Choose a base branch
from
Open

DEVOPS-1154: address warnings upon publishing Python packages from GitHub #166

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
54f61fe
DEVOPS-1154 update workflow refs and PyPI publish flow
Jul 27, 2026
6ac6944
Updating the signing
Jul 27, 2026
b9a1485
Cleaning up the code to use an action for future
Jul 29, 2026
9499d0c
New test with refactoring
RomFloreani Aug 17, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/issue_to_jira.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ permissions: {}
jobs:
call-workflow-create-jira-issue:
if: startsWith(github.repository, 'MiraGeoscience/') # run on the Mira repo only
uses: MiraGeoscience/CI-tools/.github/workflows/reusable-jira-issue_to_jira.yml@v3
uses: MiraGeoscience/CI-tools/.github/workflows/reusable-jira-issue_to_jira.yml@DEVOPS-1154
permissions:
contents: read
issues: write
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/pr_jira_actions.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ on:
jobs:
call-workflow-pr_jira_actions:
if: github.event.action != 'edited' || github.event.changes.title != null
uses: MiraGeoscience/CI-tools/.github/workflows/reusable-jira-pr_actions.yml@v3
uses: MiraGeoscience/CI-tools/.github/workflows/reusable-jira-pr_actions.yml@DEVOPS-1154
permissions:
contents: read
pull-requests: write
Expand Down
32 changes: 29 additions & 3 deletions .github/workflows/python_deploy_dev.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@
jobs:
call-workflow-conda-publish:
name: Publish development conda package on JFrog Artifactory
uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_rattler_package.yml@v3
uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_rattler_package.yml@DEVOPS-1154
permissions:
contents: write
with:
Expand All @@ -29,7 +29,7 @@
JFROG_ARTIFACTORY_TOKEN: ${{ secrets.JFROG_ARTIFACTORY_TOKEN }}
call-workflow-pypi-publish:
name: Publish development pypi package (JFrog Artifactory, TestPyPI)
uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_pypi_package.yml@v3
uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_pypi_package.yml@DEVOPS-1154
permissions:
contents: write
with:
Expand All @@ -41,4 +41,30 @@
secrets:
JFROG_ARTIFACTORY_URL: ${{ secrets.JFROG_ARTIFACTORY_URL }}
JFROG_ARTIFACTORY_TOKEN: ${{ secrets.JFROG_ARTIFACTORY_TOKEN }}
PYPI_TOKEN: ${{ secrets.TEST_PYPI_TOKEN }}
publish-pypi-package:
name: Publish development Python package to TestPyPI
needs: call-workflow-pypi-publish
if: ${{ needs.call-workflow-pypi-publish.result == 'success' }}
runs-on: ubuntu-latest
permissions:
contents: read
id-token: write
steps:
- name: Download build artifact
uses: MiraGeoscience/CI-tools/.github/actions/reusable-python-download_dist@DEVOPS-1154
with:
source: artifact
artifact-name: mira-simpeg-pip-package-build
# Intentionally a direct step here, not nested in a reusable workflow or
# composite action: PyPI trusted publishing checks the OIDC token's
# workflow_ref, which only matches this repo's own workflow file when the
# publish step runs at the top level (job_workflow_ref is unsupported by
# PyPI - see pypi/warehouse#11096). pypa/gh-action-pypi-publish also
# self-resolves its own docker image from github.action_repository/
# action_ref, which breaks the same way when nested more than one level
# deep (see MiraGeoscience/CI-tools DEVOPS-1154 and actions/runner#2473).
- name: Publish package to TestPyPI
uses: pypa/gh-action-pypi-publish@v1.14.1

Check failure on line 67 in .github/workflows/python_deploy_dev.yml

View workflow job for this annotation

GitHub Actions / Zizmor analysis (annotate) / Security Scan

unpinned-uses 

python_deploy_dev.yml:67: unpinned action reference: action is not pinned to a hash (required by blanket policy)
with:
packages-dir: dist-download/
repository-url: https://test.pypi.org/legacy/
35 changes: 31 additions & 4 deletions .github/workflows/python_deploy_prod.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@
call-workflow-conda-release:
name: Publish production Conda package on JFrog Artifactory
if: ${{ github.event_name == 'release' || github.event.inputs.publish-conda == 'true' }}
uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-release_conda_assets.yml@v3
uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-release_conda_assets.yml@DEVOPS-1154
permissions:
contents: write
with:
Expand All @@ -39,9 +39,9 @@
JFROG_ARTIFACTORY_URL: ${{ secrets.JFROG_ARTIFACTORY_URL }}
JFROG_ARTIFACTORY_TOKEN: ${{ secrets.JFROG_ARTIFACTORY_TOKEN }}
call-workflow-pypi-release:
name: Publish production PyPI package (JFrog Artifactory, PyPI)
name: Publish production PyPI package (JFrog Artifactory)
if: ${{ github.event_name == 'release' || github.event.inputs.publish-pypi == 'true' }}
uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-release_pypi_assets.yml@v3
uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-release_pypi_assets.yml@DEVOPS-1154
permissions:
contents: write
with:
Expand All @@ -51,4 +51,31 @@
secrets:
JFROG_ARTIFACTORY_URL: ${{ secrets.JFROG_ARTIFACTORY_URL }}
JFROG_ARTIFACTORY_TOKEN: ${{ secrets.JFROG_ARTIFACTORY_TOKEN }}
PYPI_TOKEN: ${{ secrets.PYPI_TOKEN }}
publish-pypi-release:
name: Publish production Python package to PyPI
needs: call-workflow-pypi-release
if: ${{ (github.event_name == 'release' || github.event.inputs.publish-pypi == 'true') && needs.call-workflow-pypi-release.result == 'success' }}
runs-on: ubuntu-latest
permissions:
contents: read
id-token: write
steps:
- name: Download release assets
uses: MiraGeoscience/CI-tools/.github/actions/reusable-python-download_dist@DEVOPS-1154
with:
source: release
release-tag: ${{ github.event.release.tag_name || github.event.inputs.release-tag }}
github-token: ${{ secrets.GITHUB_TOKEN }}
# Intentionally a direct step here, not nested in a reusable workflow or
# composite action: PyPI trusted publishing checks the OIDC token's
# workflow_ref, which only matches this repo's own workflow file when the
# publish step runs at the top level (job_workflow_ref is unsupported by
# PyPI - see pypi/warehouse#11096). pypa/gh-action-pypi-publish also
# self-resolves its own docker image from github.action_repository/
# action_ref, which breaks the same way when nested more than one level
# deep (see MiraGeoscience/CI-tools DEVOPS-1154 and actions/runner#2473).
- name: Publish package to PyPI
uses: pypa/gh-action-pypi-publish@v1.14.1

Check failure on line 78 in .github/workflows/python_deploy_prod.yml

View workflow job for this annotation

GitHub Actions / Zizmor analysis (annotate) / Security Scan

unpinned-uses 

python_deploy_prod.yml:78: unpinned action reference: action is not pinned to a hash (required by blanket policy)
with:
packages-dir: dist-download/
repository-url: https://upload.pypi.org/legacy/
4 changes: 2 additions & 2 deletions .github/workflows/security_scan.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,7 +32,7 @@ jobs:
security-events: write
contents: read
actions: read
uses: MiraGeoscience/CI-tools/.github/workflows/reusable-zizmor-advanced-security.yml@v3
uses: MiraGeoscience/CI-tools/.github/workflows/reusable-zizmor-advanced-security.yml@DEVOPS-1154

call-workflow-zizmor-advanced-security:
name: Zizmor analysis (annotate)
Expand All @@ -42,4 +42,4 @@ jobs:
checks: write
contents: read
actions: read
uses: MiraGeoscience/CI-tools/.github/workflows/reusable-zizmor-annotate.yml@v3
uses: MiraGeoscience/CI-tools/.github/workflows/reusable-zizmor-annotate.yml@DEVOPS-1154
Loading