From cce055020973dfa6da69a0daa88d95b38c89602d Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 26 Oct 2026 04:35:24 +0000 Subject: [PATCH 1/2] chore(deps): bump pypa/gh-action-pypi-publish from 1.14.1 to 1.14.3 Bumps [pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish) from 1.14.1 to 1.14.3. - [Release notes](https://github.com/pypa/gh-action-pypi-publish/releases) - [Commits](https://github.com/pypa/gh-action-pypi-publish/compare/ba38be9e461d3875417946c167d0b5f3d385a247...7245906fb61fa33a13554f9d5fb856fe61758086) --- updated-dependencies: - dependency-name: pypa/gh-action-pypi-publish dependency-version: 1.14.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] --- .github/workflows/publish.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 2a96424..813d17d 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -383,7 +383,7 @@ jobs: working-directory: release-bundle run: sha256sum --check artifact-sha256.txt - name: Publish through the configured PyPI Trusted Publisher - uses: pypa/gh-action-pypi-publish@ba38be9e461d3875417946c167d0b5f3d385a247 # v1.14.1, node24 + uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.1, node24 with: packages-dir: release-bundle/dist/ print-hash: true From ec6bcc1853deb2a3d9ef07929ef454eea8342b21 Mon Sep 17 00:00:00 2001 From: CometAPI Date: Mon, 26 Oct 2026 19:33:51 +0800 Subject: [PATCH 2/2] fix(ci): coordinate reviewed PyPI publisher upgrade --- .github/workflows/publish.yml | 2 +- AGENTS.md | 6 ++++-- CONTRIBUTING.md | 9 +++++++++ RELEASING.md | 15 ++++++++++----- scripts/check_workflows.py | 4 ++-- tests/test_release_workflow.py | 15 ++++++++++++--- 6 files changed, 38 insertions(+), 13 deletions(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 813d17d..f85f3b9 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -383,7 +383,7 @@ jobs: working-directory: release-bundle run: sha256sum --check artifact-sha256.txt - name: Publish through the configured PyPI Trusted Publisher - uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.1, node24 + uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.3, node24 with: packages-dir: release-bundle/dist/ print-hash: true diff --git a/AGENTS.md b/AGENTS.md index 42ae877..5668c39 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -134,10 +134,12 @@ Post-stable invariants: state read-only, and stop. Do not use another main push or recovery path until the exact external state is known and recovery is separately authorized. - Keep the PyPI publisher v1.14.1 pinned to the reviewed commit whose + Keep the PyPI publisher v1.14.3 pinned to the reviewed commit whose composite action uses the Node 24 `setup-python` fallback. The workflow checker must reject any other publisher SHA without changing the top-level - workflow, job, environment, or Trusted Publisher identity. + workflow, job, environment, or Trusted Publisher identity. Publisher upgrades + must update the workflow pin, semantic-checker constants, regression tests, + and current maintenance guidance together after reviewing upstream changes. 10. `README.md` is the distribution long description and must remain accurate before and after publication. Use `python -m pip install cometapi`, unversioned project links, and publication-neutral maintenance language. diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index f38b57c..3071ee8 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -51,6 +51,15 @@ direct wheel build with the locked Twine validator. Change the metadata format or backend pin only together with verified support in the validation and publication tools. +Dependabot can update a protected publisher Action SHA before its semantic +contract has been reviewed. Review the upstream action definition and runtime +dependencies, then update the workflow SHA and version comment, +`PYPI_PUBLISH_ACTION_SHA` and `PYPI_PUBLISH_ACTION_VERSION` in +`scripts/check_workflows.py`, regression coverage, and current maintenance +guidance in the same pull request. Run the complete checks above and retain the +exact-SHA rejection tests. Do not remove the guard or relax release conditions, +permissions, or protected-environment requirements to make an update pass. + If a check is unavailable, say so in the pull request rather than describing it as passing. diff --git a/RELEASING.md b/RELEASING.md index e8daa2c..d281c68 100644 --- a/RELEASING.md +++ b/RELEASING.md @@ -173,12 +173,17 @@ whose immutable action metadata selects `node24`. The semantic checker rejects any other pin so the workflow cannot silently regress to the deprecated Node 20 runtime. -The direct PyPI publisher v1.14.1 is pinned to the reviewed commit. Its only -action-definition change from the previously reviewed publisher is the -conditional `setup-python` fallback moving from Node 20 to Node 24; the +The direct PyPI publisher v1.14.3 is pinned to +`7245906fb61fa33a13554f9d5fb856fe61758086`. The reviewed +[upstream comparison](https://github.com/pypa/gh-action-pypi-publish/compare/ba38be9e461d3875417946c167d0b5f3d385a247...7245906fb61fa33a13554f9d5fb856fe61758086) +retains the composite action definition and Node 24 `setup-python` fallback. +Its runtime updates include Twine, Sigstore, and certifi plus hashed dependency +constraints. The certifi and Sigstore update addresses +[GHSA-5xjx-3w67-w9x9](https://github.com/pypa/gh-action-pypi-publish/security/advisories/GHSA-5xjx-3w67-w9x9). +The semantic checker requires this exact publisher SHA while preserving the top-level `publish.yml`, `publish` job, `pypi` environment, and Trusted -Publisher identity remain unchanged. The semantic checker requires this exact -publisher SHA. +Publisher identity. Local CI does not exercise OIDC publication or attestations; +those require the separately authorized release workflow. The job invokes the pinned action release-only first with `skip-github-pull-request: true`. That step cannot continue on error and is diff --git a/scripts/check_workflows.py b/scripts/check_workflows.py index 4a62f22..58af310 100644 --- a/scripts/check_workflows.py +++ b/scripts/check_workflows.py @@ -33,8 +33,8 @@ RELEASE_PLEASE_ACTION_VERSION = "5.0.0" RELEASE_PLEASE_ACTION_RUNTIME = "node24" RELEASE_PLEASE_ACTION = f"googleapis/release-please-action@{RELEASE_PLEASE_ACTION_SHA}" -PYPI_PUBLISH_ACTION_SHA = "ba38be9e461d3875417946c167d0b5f3d385a247" -PYPI_PUBLISH_ACTION_VERSION = "1.14.1" +PYPI_PUBLISH_ACTION_SHA = "7245906fb61fa33a13554f9d5fb856fe61758086" +PYPI_PUBLISH_ACTION_VERSION = "1.14.3" PYPI_PUBLISH_ACTION_RUNTIME = "node24" PYPI_PUBLISH_ACTION = f"pypa/gh-action-pypi-publish@{PYPI_PUBLISH_ACTION_SHA}" RELEASE_PLEASE_BRIDGE_VERSION = "0.1.0-alpha.1" diff --git a/tests/test_release_workflow.py b/tests/test_release_workflow.py index 872f125..b9890c9 100644 --- a/tests/test_release_workflow.py +++ b/tests/test_release_workflow.py @@ -500,13 +500,22 @@ def test_pypi_publisher_uses_reviewed_node24_action() -> None: check_publish_workflow(text, LIVE_SMOKE_WORKFLOW.read_text(encoding="utf-8")) -def test_pypi_publisher_rejects_another_full_sha() -> None: +@pytest.mark.parametrize( + "unreviewed_sha", + [ + "ba38be9e461d3875417946c167d0b5f3d385a247", + "dc37677b2e1c63e2034f94d8a5b11f265b73ba33", + "cef221092ed1bacb1cc03d23a2d87d1d172e277b", + ], + ids=["prior-1.14.1", "prior-1.14.2", "unreviewed"], +) +def test_pypi_publisher_rejects_another_full_sha(unreviewed_sha: str) -> None: text = PUBLISH_WORKFLOW.read_text(encoding="utf-8").replace( PYPI_PUBLISH_ACTION, - "pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b", + f"pypa/gh-action-pypi-publish@{unreviewed_sha}", 1, ) - with pytest.raises(RuntimeError, match=r"pypa/gh-action-pypi-publish@ba38be9"): + with pytest.raises(RuntimeError, match=re.escape(PYPI_PUBLISH_ACTION)): check_publish_workflow(text, LIVE_SMOKE_WORKFLOW.read_text(encoding="utf-8"))