Skip to content

Commit f861bc8

Browse files
MichaelGHSegMichaelGHSeg
committed
Harden CI: Artifactory OIDC, uv/pyproject.toml, PyPI Trusted Publishing
- Add Artifactory OIDC composite action for build-time dep resolution - Replace main.yml + tests.yml with fork-aware ci.yml (uv, SHA-pinned) - Add deploy.yml: PyPI Trusted Publishing, PEP 740 attestations, no stored tokens - Migrate setup.py to pyproject.toml (hatchling) + uv.lock - Update devbox.json to use uv - Update e2e-tests.yml: remove E2E_TESTS_TOKEN, SHA-pin actions, fork-aware
1 parent fadb7bb commit f861bc8

9 files changed

Lines changed: 787 additions & 134 deletions

File tree

‎.github/actions/artifactory-oidc/action.yml‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
name: "Artifactory OIDC Auth"
2+
description: "Exchange GitHub OIDC token for Artifactory access token and configure uv/pip"
3+
4+
inputs:
5+
artifactory-url:
6+
description: "Base Artifactory platform URL. Falls back to ARTIFACTORY_URL env var."
7+
required: false
8+
default: ""
9+
oidc-provider-name:
10+
description: "OIDC provider name configured in Artifactory"
11+
required: false
12+
default: "github-actions"
13+
pypi-repo:
14+
description: "Artifactory virtual PyPI repository name"
15+
required: false
16+
default: "virtual-pypi-thirdparty"
17+
18+
runs:
19+
using: "composite"
20+
steps:
21+
- name: Exchange GitHub OIDC token for Artifactory token
22+
shell: bash
23+
env:
24+
INPUT_ARTIFACTORY_URL: ${{ inputs.artifactory-url }}
25+
OIDC_PROVIDER_NAME: ${{ inputs.oidc-provider-name }}
26+
PYPI_REPO: ${{ inputs.pypi-repo }}
27+
run: |
28+
set -euo pipefail
29+
ARTIFACTORY_URL="${INPUT_ARTIFACTORY_URL:-${ARTIFACTORY_URL:-}}"
30+
if [ -z "${ARTIFACTORY_URL}" ]; then
31+
echo "::error::ARTIFACTORY_URL is not set (pass as input or set as env var)"; exit 1
32+
fi
33+
34+
OIDC_JWT=$(curl -sS \
35+
"${ACTIONS_ID_TOKEN_REQUEST_URL}&audience=${ARTIFACTORY_URL}" \
36+
-H "Authorization: Bearer ${ACTIONS_ID_TOKEN_REQUEST_TOKEN}" | jq -r '.value')
37+
38+
if [ -z "$OIDC_JWT" ] || [ "$OIDC_JWT" = "null" ]; then
39+
echo "::error::Failed to obtain GitHub OIDC token"; exit 1
40+
fi
41+
42+
RESP=$(curl -sS "${ARTIFACTORY_URL}/access/api/v1/oidc/token" \
43+
-H 'Content-Type: application/json' \
44+
-d "{\"grant_type\":\"urn:ietf:params:oauth:grant-type:token-exchange\",
45+
\"subject_token_type\":\"urn:ietf:params:oauth:token-type:id_token\",
46+
\"subject_token\":\"${OIDC_JWT}\",
47+
\"provider_name\":\"${OIDC_PROVIDER_NAME}\"}")
48+
49+
ART_TOKEN=$(echo "$RESP" | jq -r '.access_token // empty')
50+
51+
if [ -z "$ART_TOKEN" ]; then
52+
echo "::error::OIDC token exchange failed."
53+
echo "$RESP" | jq 'if .access_token then .access_token="<redacted>" else . end' 2>/dev/null || echo "$RESP"
54+
exit 1
55+
fi
56+
echo "::add-mask::$ART_TOKEN"
57+
58+
HOST=$(echo "${ARTIFACTORY_URL}" | sed -E 's#^https?://##')
59+
INDEX_URL="https://:${ART_TOKEN}@${HOST}/artifactory/api/pypi/${PYPI_REPO}/simple/"
60+
61+
echo "::add-mask::${INDEX_URL}"
62+
echo "UV_INDEX_URL=${INDEX_URL}" >> "$GITHUB_ENV"
63+
echo "PIP_INDEX_URL=${INDEX_URL}" >> "$GITHUB_ENV"
64+
echo "Configured to resolve through Artifactory (${PYPI_REPO})"

‎.github/workflows/ci.yml‎

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
name: CI
2+
3+
on:
4+
push:
5+
branches: [master]
6+
pull_request:
7+
workflow_dispatch:
8+
9+
permissions:
10+
id-token: write
11+
contents: read
12+
13+
env:
14+
ARTIFACTORY_URL: ${{ vars.ARTIFACTORY_URL }}
15+
16+
jobs:
17+
lint:
18+
name: Lint
19+
runs-on: ${{ github.event.pull_request.head.repo.fork && 'ubuntu-latest' || 'ubuntu-x64' }}
20+
steps:
21+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
22+
- name: Authenticate with Artifactory
23+
if: ${{ !github.event.pull_request.head.repo.fork }}
24+
uses: ./.github/actions/artifactory-oidc
25+
- uses: astral-sh/setup-uv@0c5e2b8115b80b4c7c5ddf6ffdd634974642d182 # v5
26+
with:
27+
version: "0.9.26"
28+
- uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
29+
with:
30+
python-version: "3.11"
31+
- run: uv sync --frozen --all-extras
32+
- run: uv run ruff check .
33+
- run: uv run ruff format --check .
34+
35+
test:
36+
name: Test - Python ${{ matrix.python-version }}
37+
runs-on: ${{ github.event.pull_request.head.repo.fork && 'ubuntu-latest' || 'ubuntu-x64' }}
38+
strategy:
39+
fail-fast: false
40+
matrix:
41+
python-version: ["3.9", "3.10", "3.11", "3.12", "3.13"]
42+
steps:
43+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
44+
- name: Authenticate with Artifactory
45+
if: ${{ !github.event.pull_request.head.repo.fork }}
46+
uses: ./.github/actions/artifactory-oidc
47+
- uses: astral-sh/setup-uv@0c5e2b8115b80b4c7c5ddf6ffdd634974642d182 # v5
48+
with:
49+
version: "0.9.26"
50+
- uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
51+
with:
52+
python-version: ${{ matrix.python-version }}
53+
- run: uv sync --frozen --all-extras
54+
- run: uv run pytest
55+
56+
build:
57+
name: Build Package
58+
runs-on: ${{ github.event.pull_request.head.repo.fork && 'ubuntu-latest' || 'ubuntu-x64' }}
59+
steps:
60+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
61+
- name: Authenticate with Artifactory
62+
if: ${{ !github.event.pull_request.head.repo.fork }}
63+
uses: ./.github/actions/artifactory-oidc
64+
- uses: astral-sh/setup-uv@0c5e2b8115b80b4c7c5ddf6ffdd634974642d182 # v5
65+
with:
66+
version: "0.9.26"
67+
- uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
68+
with:
69+
python-version: "3.11"
70+
- name: Build package
71+
run: uv build
72+
- name: Verify installable
73+
run: |
74+
python -m venv test-env
75+
. test-env/bin/activate
76+
pip install dist/*.whl
77+
python -c "import segment.analytics; print(f'OK: {segment.analytics.__version__}')"
78+
79+
all-checks:
80+
name: All Checks Passed
81+
needs: [lint, test, build]
82+
runs-on: ubuntu-latest
83+
if: always()
84+
steps:
85+
- name: Check all job statuses
86+
run: |
87+
if [ "${{ needs.lint.result }}" != "success" ] || \
88+
[ "${{ needs.test.result }}" != "success" ] || \
89+
[ "${{ needs.build.result }}" != "success" ]; then
90+
echo "One or more checks failed"
91+
exit 1
92+
fi

‎.github/workflows/deploy.yml‎

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
name: Deploy
2+
3+
on:
4+
release:
5+
types: [published]
6+
7+
env:
8+
ARTIFACTORY_URL: ${{ vars.ARTIFACTORY_URL }}
9+
10+
jobs:
11+
test:
12+
name: Test - Python ${{ matrix.python-version }}
13+
runs-on: ${{ github.repository_owner == 'twilio' && 'ubuntu-x64' || 'ubuntu-latest' }}
14+
if: github.repository_owner == 'twilio'
15+
permissions:
16+
contents: read
17+
id-token: write
18+
timeout-minutes: 20
19+
strategy:
20+
fail-fast: false
21+
matrix:
22+
python-version: ["3.9", "3.10", "3.11", "3.12", "3.13"]
23+
steps:
24+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
25+
- name: Authenticate with Artifactory
26+
uses: ./.github/actions/artifactory-oidc
27+
- uses: astral-sh/setup-uv@0c5e2b8115b80b4c7c5ddf6ffdd634974642d182 # v5
28+
with:
29+
version: "0.9.26"
30+
- uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
31+
with:
32+
python-version: ${{ matrix.python-version }}
33+
- run: uv sync --frozen --all-extras
34+
- run: uv run pytest
35+
36+
deploy:
37+
name: Publish to PyPI
38+
needs: [test]
39+
runs-on: ${{ github.repository_owner == 'twilio' && 'ubuntu-x64' || 'ubuntu-latest' }}
40+
if: github.repository_owner == 'twilio'
41+
environment: pypi
42+
permissions:
43+
contents: read
44+
id-token: write
45+
attestations: write
46+
steps:
47+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
48+
- name: Authenticate with Artifactory
49+
uses: ./.github/actions/artifactory-oidc
50+
- uses: astral-sh/setup-uv@0c5e2b8115b80b4c7c5ddf6ffdd634974642d182 # v5
51+
with:
52+
version: "0.9.26"
53+
- uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
54+
with:
55+
python-version: "3.12"
56+
57+
- name: Validate tag format and version match
58+
run: |
59+
TAG="${GITHUB_REF#refs/tags/}"
60+
if [[ ! "$TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+ ]]; then
61+
echo "::error::Release tag must be in the form v1.2.3 (got '$TAG')"
62+
exit 1
63+
fi
64+
VERSION="${TAG#v}"
65+
PKG_VERSION=$(python -c "
66+
import tomllib
67+
with open('pyproject.toml', 'rb') as f:
68+
print(tomllib.load(f)['project']['version'])
69+
")
70+
if [ "$VERSION" != "$PKG_VERSION" ]; then
71+
echo "::error::Tag $TAG does not match pyproject.toml version $PKG_VERSION"
72+
exit 1
73+
fi
74+
75+
- name: Build package
76+
run: uv build
77+
78+
- name: Publish to PyPI
79+
uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0

‎.github/workflows/e2e-tests.yml‎

Lines changed: 16 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -1,52 +1,46 @@
1-
# E2E Tests for analytics-python
2-
# Copy this file to: analytics-python/.github/workflows/e2e-tests.yml
3-
#
4-
# This workflow:
5-
# 1. Checks out the SDK and sdk-e2e-tests repos
6-
# 2. Installs the SDK and e2e-cli dependencies
7-
# 3. Runs the e2e test suite
8-
91
name: E2E Tests
102

113
on:
124
push:
13-
branches: [main, master]
5+
branches: [master]
146
pull_request:
15-
branches: [main, master]
7+
branches: [master]
168
workflow_dispatch:
179
inputs:
1810
e2e_tests_ref:
1911
description: 'Branch or ref of sdk-e2e-tests to use'
2012
required: false
2113
default: 'main'
2214

15+
permissions:
16+
id-token: write
17+
contents: read
18+
19+
env:
20+
ARTIFACTORY_URL: ${{ vars.ARTIFACTORY_URL }}
21+
2322
jobs:
2423
e2e-tests:
25-
# Skip on fork PRs where repo secrets aren't available
26-
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
27-
runs-on: ubuntu-latest
28-
24+
runs-on: ${{ github.event.pull_request.head.repo.fork && 'ubuntu-latest' || 'ubuntu-x64' }}
25+
if: ${{ github.event_name != 'pull_request' || !github.event.pull_request.head.repo.fork }}
2926
steps:
3027
- name: Checkout SDK
31-
uses: actions/checkout@v4
28+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
3229
with:
3330
path: sdk
3431

3532
- name: Checkout sdk-e2e-tests
36-
uses: actions/checkout@v4
33+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
3734
with:
3835
repository: segmentio/sdk-e2e-tests
3936
ref: ${{ inputs.e2e_tests_ref || 'main' }}
40-
token: ${{ secrets.E2E_TESTS_TOKEN }}
4137
path: sdk-e2e-tests
4238

43-
- name: Setup Python
44-
uses: actions/setup-python@v5
39+
- uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
4540
with:
4641
python-version: '3.11'
4742

48-
- name: Setup Node.js
49-
uses: actions/setup-node@v4
43+
- uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4
5044
with:
5145
node-version: '20'
5246

@@ -67,7 +61,7 @@ jobs:
6761
6862
- name: Upload test results
6963
if: always()
70-
uses: actions/upload-artifact@v4
64+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
7165
with:
7266
name: e2e-test-results
7367
path: sdk-e2e-tests/test-results/

‎.github/workflows/main.yml‎

Lines changed: 0 additions & 57 deletions
This file was deleted.

0 commit comments

Comments
 (0)