diff --git a/.github/workflows/ci-supported-pythons.yml b/.github/workflows/ci-supported-pythons.yml
index a480d6c..cc91c73 100644
--- a/.github/workflows/ci-supported-pythons.yml
+++ b/.github/workflows/ci-supported-pythons.yml
@@ -16,12 +16,12 @@ jobs:
runs-on: ubuntu-latest
steps:
- - uses: actions/checkout@v4
+ - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
repository: hynek/structlog
path: structlog
fetch-depth: 0
- - uses: actions/checkout@v4
+ - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
path: action
- uses: ./action
@@ -51,13 +51,13 @@ jobs:
# matrix: ${{ fromJson(needs.build-package.outputs.python-versions) }}
steps:
- - uses: actions/setup-python@v5
+ - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
with:
python-version: ${{ matrix.python-version }}
allow-prereleases: true
- name: Download built packages from the build-package job.
- uses: actions/download-artifact@v4
+ uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
with:
name: Packages
path: dist
@@ -83,7 +83,7 @@ jobs:
runs-on: ubuntu-latest
steps:
- - uses: actions/setup-python@v5
+ - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
with:
python-version: "3.x"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 4373cfc..215071c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -18,13 +18,13 @@ jobs:
runs-on: ubuntu-latest
steps:
- - uses: actions/checkout@v4
+ - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
repository: hynek/argon2-cffi-bindings
submodules: recursive
path: hynek/argon2-cffi-bindings
- - uses: actions/checkout@v4
+ - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
path: action
@@ -41,17 +41,16 @@ jobs:
fail-fast: false
matrix:
os:
- - ubuntu-20.04
- ubuntu-22.04
- ubuntu-24.04
steps:
- - uses: actions/checkout@v4
+ - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
repository: hynek/structlog
path: structlog
- - uses: actions/checkout@v4
+ - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
path: action
@@ -61,19 +60,22 @@ jobs:
path: structlog
upload-name-suffix: "-structlog-${{ matrix.os }}"
- - run: echo Packages can be found at ${{ steps.baipp.outputs.dist }} and in artifact ${{ steps.baipp.outputs.artifact-name }}
+ - run: >
+ echo "Packages for ${{ steps.baipp.outputs.package_name }} (${{ steps.baipp.outputs.package_version }})
+ can be found at ${{ steps.baipp.outputs.dist }}
+ and in artifact ${{ steps.baipp.outputs.artifact-name }}"
check-pytest:
name: Build & verify the pytest package.
runs-on: ubuntu-latest
steps:
- - uses: actions/checkout@v4
+ - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
repository: pytest-dev/pytest
path: pytest
- - uses: actions/checkout@v4
+ - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
path: action
@@ -98,6 +100,6 @@ jobs:
steps:
- name: Decide whether the needed jobs succeeded or failed
- uses: re-actors/alls-green@release/v1
+ uses: re-actors/alls-green@05ac9388f0aebcb5727afa17fcccfecd6f8ec5fe # v1.2.2
with:
jobs: ${{ toJSON(needs) }}
diff --git a/.github/workflows/update-dependencies.yml b/.github/workflows/update-dependencies.yml
index 637abd6..65c0040 100644
--- a/.github/workflows/update-dependencies.yml
+++ b/.github/workflows/update-dependencies.yml
@@ -17,7 +17,7 @@ jobs:
# It doesn't matter if it's deleted when merged, it'll be re-created
BRANCH_NAME: auto-dependency-upgrades
steps:
- - uses: actions/checkout@v4
+ - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
# START PYTHON DEPENDENCIES
- name: Install uv
diff --git a/CHANGELOG.md b/CHANGELOG.md
index b2e7f77..e4bced1 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,24 @@ All notable changes to this project will be documented in this file.
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+## [2.13.0](https://github.com/hynek/build-and-inspect-python-package/compare/v2.12.0...2.13.0)
+
+### Added
+
+- New output: `package_name` is the name of the built package as stored in metadata.
+ [#162](https://github.com/hynek/build-and-inspect-python-package/pull/162)
+
+- The package name is now part of the action summary which is helpful when you build more than one package from a repository.
+ [#169](https://github.com/hynek/build-and-inspect-python-package/pull/169)
+
+
+### Changed
+
+- All GitHub actions are now pinned to exact hashes for better reproducibility and mild security improvements[^st].
+
+[^st]: Chosen prefix SHA-1 hash collision attacks [exist](https://eprint.iacr.org/2020/014.pdf). Against serious attackers, this is but security theater.
+
+
## [2.12.0](https://github.com/hynek/build-and-inspect-python-package/compare/v2.11.0...v2.12.0)
### Changed
diff --git a/README.md b/README.md
index 630dcb2..b908a71 100644
--- a/README.md
+++ b/README.md
@@ -9,7 +9,7 @@
**Builds your package**[^backend].
[`SOURCE_DATE_EPOCH`](https://reproducible-builds.org/specs/source-date-epoch/) is set to the timestamp of the last commit, giving you reproducible builds with meaningful file timestamps.
-[^backend]: Works with any [PEP 517](https://peps.python.org/pep-0517/)-compatible build backend. This includies Hatchling, Flit, Setuptools, PDM, and Poetry.
+[^backend]: Works with any [PEP 517](https://peps.python.org/pep-0517/)-compatible build backend. This includes Hatchling, Flit, Setuptools, PDM, and Poetry.
Uploads the **built *wheel* and the source distribution (*SDist*) as GitHub Actions artifacts**, so you can download and inspect them from the Summary view of a run, or [**upload them to PyPI automatically**][automated] once the verification succeeds.
@@ -161,6 +161,8 @@ While *build-and-inspect-python-package* will build a wheel for you by default,
This is useful if you only want to define a matrix based on Python versions, because then you can just assign this to `strategy.matrix`.
+- `package_name`: The name of the package as extracted from the package metadata.
+
- `package_version`: The version of the package as extracted from the package metadata.
This is useful, for example, for displaying the PyPI URL on the GitHub UI for the publishing job:
@@ -173,7 +175,7 @@ While *build-and-inspect-python-package* will build a wheel for you by default,
needs: baipp
environment:
name: pypi
- url: https://pypi.org/project/structlog/${{ needs.baipp.outputs.package-version }}
+ url: https://pypi.org/project/${{ needs.baipp.outputs.package-name }}/${{ needs.baipp.outputs.package-version }}
```
### Artifacts
diff --git a/action.yml b/action.yml
index 3810915..170be54 100644
--- a/action.yml
+++ b/action.yml
@@ -44,6 +44,9 @@ outputs:
supported Python versions. In other words, you can assign it directly to
the 'strategy.matrix' key.
value: ${{ steps.metadata-setter.outputs.supported_python_classifiers_json_job_matrix_value }}
+ package_name:
+ description: The name of the package.
+ value: ${{ steps.metadata-setter.outputs.package_name }}
package_version:
description: The version of the package as declared in the metadata.
value: ${{ steps.metadata-setter.outputs.package_version }}
@@ -52,7 +55,7 @@ runs:
using: composite
steps:
- - uses: actions/setup-python@v5
+ - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
id: python-baipp
with:
python-version: "3.x"
@@ -78,7 +81,7 @@ runs:
shell: bash
- name: Setup uv cache
- uses: actions/cache@v4
+ uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
with:
path: ${{ env.UV_CACHE_DIR }}
key: baipp-${{ env.REQS_HASH }}
@@ -134,14 +137,10 @@ runs:
- name: Attest GitHub build provenance
if: ${{ inputs.attest-build-provenance-github == 'true' }}
- uses: actions/attest-build-provenance@v1
+ uses: actions/attest-build-provenance@ef244123eb79f2f7a7e75d99086184180e6d0018 # v1.4.4
with:
subject-path: "/tmp/baipp/dist/*"
- - name: Add contents header
- shell: bash
- run: echo -e '\n### Package Contents' >> $GITHUB_STEP_SUMMARY
-
- name: Set output
id: dist-location-setter
shell: bash
@@ -153,7 +152,7 @@ runs:
working-directory: ${{ inputs.path }}
- name: Upload built artifacts.
- uses: actions/upload-artifact@v4
+ uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
with:
name: ${{ steps.artifact.outputs.name }}
path: /tmp/baipp/dist/*
@@ -175,39 +174,79 @@ runs:
--strict
/tmp/baipp/dist/*
- - name: Show package contents hierarchically, including metadata.
- shell: bash
+ - name: Extract built package
working-directory: ${{ inputs.path }}
+ shell: bash
run: |
cd /tmp/baipp/dist
mkdir -p out/sdist
tar xf *.tar.gz -C out/sdist
+ if [[ "${{ inputs.skip-wheel }}" != 'true' ]]; then
+ mkdir -p out/wheels
+ /tmp/baipp/bin/python -m wheel unpack --dest out/wheels *.whl
+ fi
+
+ - name: Extract packaging metadata
+ id: metadata-setter
+ shell: bash
+ working-directory: /tmp/baipp/dist/out/sdist/
+ run: |
+ cat */PKG-INFO | python -c '
+ import email.parser
+ import json, pathlib, re, sys
+
+ pkg_info = email.parser.Parser().parsestr(sys.stdin.read())
+
+ version_tokens = []
+ for classifier in pkg_info.get_all("Classifier", []):
+ if match := re.match(r"Programming Language :: Python :: (\d+\.\d+)$", classifier):
+ version_tokens.append(match.group(1))
+
+ package_name = pkg_info.get("Name")
+ if package_name is None:
+ raise RuntimeError("Package name is not set")
+
+ pathlib.Path("package_name.txt").write_text(package_name)
+
+ package_version = pkg_info.get("Version", "0.0.0")
+
+ print(f"package_name={package_name}")
+ print(f"package_version={package_version}")
+ print(f"supported_python_classifiers_json_array={json.dumps(version_tokens)}")
+ print(f"""supported_python_classifiers_json_job_matrix_value={json.dumps({"python-version": version_tokens})}""")
+ ' >> $GITHUB_OUTPUT
+
+ echo -e "\n### Contents of the $(cat package_name.txt) package" >> $GITHUB_STEP_SUMMARY
+ rm -f package_name.txt
+
+
+ - name: Show package contents hierarchically, including metadata.
+ working-directory: /tmp/baipp/dist/out/sdist/
+ shell: bash
+ run: |
if ! command -v tree &> /dev/null; then
sudo apt-get install tree
fi
echo -e '\nSDist contents
\n' >> $GITHUB_STEP_SUMMARY
- (cd /tmp/baipp/dist/out/sdist && tree -Da --timefmt="%Y-%m-%dT%H:%M:%SZ" * | sed 's/^/ /' | tee -a $GITHUB_STEP_SUMMARY)
+ tree -Da --timefmt="%Y-%m-%dT%H:%M:%SZ" * | sed 's/^/ /' | tee -a $GITHUB_STEP_SUMMARY
echo -e '\nWheel contents
\n' >> $GITHUB_STEP_SUMMARY
- (cd /tmp/baipp/dist/out/wheels && tree -a * | sed 's/^/ /' | tee -a $GITHUB_STEP_SUMMARY)
+ (cd ../wheels && tree -a * | sed 's/^/ /' | tee -a $GITHUB_STEP_SUMMARY)
echo -e '\nMetadata
\n' >> $GITHUB_STEP_SUMMARY
- cat out/sdist/*/PKG-INFO | sed 's/^/ /' | tee -a $GITHUB_STEP_SUMMARY
+ cat */PKG-INFO | sed 's/^/ /' | tee -a $GITHUB_STEP_SUMMARY
echo -e '\n