Skip to content

Commit 2aa23d2

Browse files
gorandodiggorandodig
committed
ci: record releases in Linear, pin and update workflow actions
A linear-release job records each PyPI release, gated on a successful publish. It is a separate job because the publish job has no checkout and holds only id-token: write for Trusted Publishing. The release is identified by the tag. publish-to-pypi.yml is SHA-pinned. pypa/gh-action-pypi-publish was on the release/v1 branch ref, which moves on every push, next to the PyPI OIDC token. Other workflows stay on tags. Bumped checkout v7, setup-python v7, cache v6, upload-artifact v7, download-artifact v8. Slack action v4.0.0 needs webhook-type from v2 on. The e2e notification now passes the job's own webhook secret rather than the default one. Codecov v3 disabled: its Node runtime is gone from the runners. Coverage is still computed and printed. Dependabot now covers github-actions alongside pip.
1 parent b710c29 commit 2aa23d2

7 files changed

Lines changed: 79 additions & 34 deletions

File tree

‎.github/dependabot.yml‎

Lines changed: 18 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,4 +8,21 @@ updates:
88
commit-message:
99
prefix: "dependabot"
1010
labels:
11-
- "dependencies"
11+
- "dependencies"
12+
13+
# Keeps the SHA-pinned actions in publish-to-pypi.yml patched.
14+
- package-ecosystem: "github-actions"
15+
directory: "/"
16+
schedule:
17+
interval: "weekly"
18+
open-pull-requests-limit: 5
19+
commit-message:
20+
prefix: "ci"
21+
labels:
22+
- "dependencies"
23+
- "github-actions"
24+
groups:
25+
actions-minor-and-patch:
26+
update-types:
27+
- "minor"
28+
- "patch"

‎.github/workflows/e2e.yml‎

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -11,9 +11,9 @@ jobs:
1111
runs-on: ubuntu-latest
1212
timeout-minutes: 15
1313
steps:
14-
- uses: actions/checkout@v4
14+
- uses: actions/checkout@v7
1515

16-
- uses: actions/setup-python@v5
16+
- uses: actions/setup-python@v7
1717
with:
1818
python-version: '3.12'
1919

@@ -39,7 +39,7 @@ jobs:
3939

4040
- name: Upload generated outputs on failure
4141
if: failure()
42-
uses: actions/upload-artifact@v4
42+
uses: actions/upload-artifact@v7
4343
with:
4444
name: e2e-outputs-linux
4545
path: /tmp/pytest-of-runner/**/container_work*/**
@@ -48,9 +48,9 @@ jobs:
4848
runs-on: windows-latest
4949
timeout-minutes: 15
5050
steps:
51-
- uses: actions/checkout@v4
51+
- uses: actions/checkout@v7
5252

53-
- uses: actions/setup-python@v5
53+
- uses: actions/setup-python@v7
5454
with:
5555
python-version: '3.12'
5656

@@ -81,8 +81,10 @@ jobs:
8181
8282
- name: Send failure notification to Slack
8383
if: ${{ env.SLACK_WEBHOOK_URL != '' }}
84-
uses: slackapi/slack-github-action@v1.24.0
84+
uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d # v4.0.0
8585
with:
86+
webhook: ${{ env.SLACK_WEBHOOK_URL }}
87+
webhook-type: incoming-webhook
8688
payload: |
8789
{
8890
"text": ${{ toJSON(format('[Codeplain Client] E2E tests FAILED on {0}. See <{1}/{2}/actions/runs/{3}|the run log>.', steps.platforms.outputs.failed, github.server_url, github.repository, github.run_id)) }}

‎.github/workflows/lint-and-test.yml‎

Lines changed: 19 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -12,13 +12,13 @@ jobs:
1212
name: Black Formatting
1313
runs-on: ubuntu-latest
1414
steps:
15-
- uses: actions/checkout@v4
15+
- uses: actions/checkout@v7
1616
- name: Set up Python
17-
uses: actions/setup-python@v5
17+
uses: actions/setup-python@v7
1818
with:
1919
python-version: ${{ env.PYTHON_VERSION }}
2020
- name: Cache pip
21-
uses: actions/cache@v4
21+
uses: actions/cache@v6
2222
with:
2323
path: ~/.cache/pip
2424
key: ${{ runner.os }}-pip-${{ hashFiles('requirements.txt') }}
@@ -33,13 +33,13 @@ jobs:
3333
name: Import Sorting
3434
runs-on: ubuntu-latest
3535
steps:
36-
- uses: actions/checkout@v4
36+
- uses: actions/checkout@v7
3737
- name: Set up Python
38-
uses: actions/setup-python@v5
38+
uses: actions/setup-python@v7
3939
with:
4040
python-version: ${{ env.PYTHON_VERSION }}
4141
- name: Cache pip
42-
uses: actions/cache@v4
42+
uses: actions/cache@v6
4343
with:
4444
path: ~/.cache/pip
4545
key: ${{ runner.os }}-pip-${{ hashFiles('requirements.txt') }}
@@ -54,13 +54,13 @@ jobs:
5454
name: Flake8 Linting
5555
runs-on: ubuntu-latest
5656
steps:
57-
- uses: actions/checkout@v4
57+
- uses: actions/checkout@v7
5858
- name: Set up Python
59-
uses: actions/setup-python@v5
59+
uses: actions/setup-python@v7
6060
with:
6161
python-version: ${{ env.PYTHON_VERSION }}
6262
- name: Cache pip
63-
uses: actions/cache@v4
63+
uses: actions/cache@v6
6464
with:
6565
path: ~/.cache/pip
6666
key: ${{ runner.os }}-pip-${{ hashFiles('requirements.txt') }}
@@ -75,13 +75,13 @@ jobs:
7575
name: MyPy Type Checking
7676
runs-on: ubuntu-latest
7777
steps:
78-
- uses: actions/checkout@v4
78+
- uses: actions/checkout@v7
7979
- name: Set up Python
80-
uses: actions/setup-python@v5
80+
uses: actions/setup-python@v7
8181
with:
8282
python-version: ${{ env.PYTHON_VERSION }}
8383
- name: Cache pip
84-
uses: actions/cache@v4
84+
uses: actions/cache@v6
8585
with:
8686
path: ~/.cache/pip
8787
key: ${{ runner.os }}-pip-${{ hashFiles('requirements.txt') }}
@@ -96,9 +96,9 @@ jobs:
9696
name: Run Tests
9797
runs-on: ubuntu-latest
9898
steps:
99-
- uses: actions/checkout@v4
99+
- uses: actions/checkout@v7
100100
- name: Set up Python
101-
uses: actions/setup-python@v5
101+
uses: actions/setup-python@v7
102102
with:
103103
python-version: ${{ env.PYTHON_VERSION }}
104104
- name: Configure git for tests
@@ -107,7 +107,7 @@ jobs:
107107
git config --global user.name "Test Runner"
108108
git config --global init.defaultBranch main
109109
- name: Cache pip
110-
uses: actions/cache@v4
110+
uses: actions/cache@v6
111111
with:
112112
path: ~/.cache/pip
113113
key: ${{ runner.os }}-pip-${{ hashFiles('requirements.txt') }}
@@ -122,5 +122,7 @@ jobs:
122122
coverage run -m pytest tests/ -v
123123
coverage xml
124124
coverage report
125-
- name: Upload coverage reports
126-
uses: codecov/codecov-action@v3
125+
# Disabled: v3's Node runtime is gone from the runners. Re-enable with a
126+
# current major version, which renamed several inputs.
127+
# - name: Upload coverage reports
128+
# uses: codecov/codecov-action@v3

‎.github/workflows/lint-powershell.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ jobs:
1616
name: Parse under Windows PowerShell 5.1
1717
runs-on: windows-latest
1818
steps:
19-
- uses: actions/checkout@v4
19+
- uses: actions/checkout@v7
2020

2121
# The install scripts are fetched over HTTP and executed on stock Windows,
2222
# where powershell.exe (5.1) is the default shell. 5.1 reads BOM-less files
@@ -96,7 +96,7 @@ jobs:
9696
name: Parse under PowerShell 7
9797
runs-on: windows-latest
9898
steps:
99-
- uses: actions/checkout@v4
99+
- uses: actions/checkout@v7
100100

101101
- name: Parse each script with 7
102102
shell: pwsh

‎.github/workflows/nofity-slack-on-main-merge.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -12,11 +12,11 @@ jobs:
1212
if: github.event.pull_request.merged == true
1313
steps:
1414
- name: Send notification to Slack
15-
uses: slackapi/slack-github-action@v1.24.0
15+
uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d # v4.0.0
1616
with:
17+
webhook: ${{ secrets.SLACK_WEBHOOK_URL }}
18+
webhook-type: incoming-webhook
1719
payload: |
1820
{
1921
"text": ${{ toJSON(format('[Codeplain Client] PR <{0}|#{1}: {2}> was merged to main by `{3}`.', github.event.pull_request.html_url, github.event.pull_request.number, github.event.pull_request.title, github.actor)) }}
2022
}
21-
env:
22-
SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}

‎.github/workflows/publish-install-script.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ jobs:
1818
SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
1919

2020
steps:
21-
- uses: actions/checkout@v4
21+
- uses: actions/checkout@v7
2222

2323
- name: Upload install scripts to R2
2424
env:

‎.github/workflows/publish-to-pypi.yml‎

Lines changed: 28 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ jobs:
1919
SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
2020

2121
steps:
22-
- uses: actions/checkout@v4
22+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
2323
with:
2424
# hatch-vcs derives the version from git tags, so we need full history.
2525
fetch-depth: 0
@@ -46,7 +46,7 @@ jobs:
4646
ls -l dist/
4747
4848
- name: Store the distribution packages
49-
uses: actions/upload-artifact@v4
49+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
5050
with:
5151
name: python-package-distributions
5252
path: dist/
@@ -81,13 +81,13 @@ jobs:
8181

8282
steps:
8383
- name: Download distribution packages
84-
uses: actions/download-artifact@v4
84+
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
8585
with:
8686
name: python-package-distributions
8787
path: dist/
8888

8989
- name: Publish to PyPI
90-
uses: pypa/gh-action-pypi-publish@release/v1
90+
uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1
9191

9292
- name: Notify Slack (success)
9393
if: ${{ success() && env.SLACK_WEBHOOK_URL != '' }}
@@ -102,3 +102,27 @@ jobs:
102102
curl -s -X POST "$SLACK_WEBHOOK_URL" \
103103
-H 'Content-type: application/json' \
104104
--data "{\"text\":\"*Codeplain Client*: Publishing \`${{ github.ref_name }}\` to PyPI FAILED :x:. See <${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|the run log>.\"}"
105+
106+
# Runs only after the package is on PyPI. Kept as its own job so the publish job
107+
# keeps its minimal permissions and no checkout.
108+
linear-release:
109+
name: Record release in Linear
110+
needs: publish-to-pypi
111+
runs-on: ubuntu-latest
112+
113+
permissions:
114+
contents: read
115+
116+
steps:
117+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
118+
with:
119+
# The scan needs full history.
120+
fetch-depth: 0
121+
122+
# Non-fatal: the package is already published.
123+
- name: Record release in Linear
124+
continue-on-error: true
125+
uses: linear/linear-release-action@0a25abab892a91062ebf42260dbb2ce6277aa205 # v0.16.0
126+
with:
127+
access_key: ${{ secrets.LINEAR_ACCESS_KEY }}
128+
version: ${{ github.ref_name }}

0 commit comments

Comments
 (0)