Skip to content

feat(ci): add Test PyPI release workflow for splunk-ao #44

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
adityamehra wants to merge 3 commits into
base: main
Choose a base branch
from
Open

feat(ci): add Test PyPI release workflow for splunk-ao #44

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
93106aa
feat(ci): add Test PyPI release workflow for splunk-ao
adityamehra Jun 25, 2026
b338f45
feat(ci): run build on PRs, gate publish to workflow_dispatch only
adityamehra Jun 25, 2026
9a22c3c
feat(ci): auto-publish .dev pre-release to Test PyPI on PR pushes
adityamehra Jun 25, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
83 changes: 83 additions & 0 deletions .github/workflows/release-splunk-ao-test.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,83 @@
name: Release splunk-ao to Test PyPI

on:
pull_request: # Publishes a .dev pre-release on every PR push

@fercor-cisco fercor-cisco Jul 7, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟠 major (security): Publishing to Test PyPI on the pull_request event needs a security review. pull_request runs on PRs from forks as well; while GitHub withholds repo secrets and constrains the id-token for fork PRs (so the OIDC publish should fail rather than succeed for a fork), you are still running poetry build on untrusted PR code and then feeding its artifact into a publish job wired to a trusted-publisher environment. Please confirm: (1) whether fork PRs are expected/allowed to reach the publish job at all, and (2) whether the testpypi environment's protection rules (branch restrictions / required reviewers) actually block unwanted publishes. Safer options: gate the publish job with if: github.event.pull_request.head.repo.full_name == github.repository (skip forks), or restrict the trigger to internal branches.

🤖 Generated by Astra

workflow_dispatch:
inputs:
version:
description: 'Version to publish (e.g., 1.2.3, 2.0.0b1). Leave empty to use the version in pyproject.toml as-is.'
required: false
type: string
Comment on lines +3 to +10

@fercor-cisco fercor-cisco Jul 7, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 minor (bug): No concurrency group is defined and the dev version is derived from github.run_number. Re-running a previous workflow run reuses the same run_number, producing the same X.Y.Z.dev<n> version; pypa/gh-action-pypi-publish errors on an already-existing version by default, so a re-run will fail at the publish step. Consider adding a concurrency group (cancel-in-progress for PR builds) and/or setting skip-existing: true on the publish step to make re-runs idempotent.

Suggested change
on:
pull_request: # Publishes a .dev pre-release on every PR push
workflow_dispatch:
inputs:
version:
description: 'Version to publish (e.g., 1.2.3, 2.0.0b1). Leave empty to use the version in pyproject.toml as-is.'
required: false
type: string
on:
pull_request: # Publishes a .dev pre-release on every PR push
workflow_dispatch:
inputs:
version:
description: 'Version to publish (e.g., 1.2.3, 2.0.0b1). Leave empty to use the version in pyproject.toml as-is.'
required: false
type: string
concurrency:
group: release-test-pypi-${{ github.ref }}
cancel-in-progress: true

🤖 Generated by Astra


jobs:
build:
name: Build package
runs-on: ubuntu-latest
outputs:
version: ${{ steps.get-version.outputs.version }}
steps:
- uses: actions/checkout@v4

- name: Set up Python
uses: actions/setup-python@v5
with:
python-version: '3.11'

- name: Install Poetry
run: pipx install poetry==2.4.1

# PR builds: append .dev<run_number> so the clean version (e.g. 0.1.0)
# is never consumed on Test PyPI and can still be used for the real release.
- name: Set pre-release version
if: github.event_name == 'pull_request'
run: |
VERSION_BASE="$(poetry version --short)"
PRE_VERSION="${VERSION_BASE}.dev${{ github.run_number }}"
poetry version "$PRE_VERSION"
sed -i "s/__version__ = \".*\"/__version__ = \"${PRE_VERSION}\"/" src/splunk_ao/__init__.py

# Manual dispatch: use the supplied version if provided.
- name: Override version
if: github.event_name == 'workflow_dispatch' && inputs.version != ''
env:
INPUT_VERSION: ${{ inputs.version }}
run: |
poetry version "$INPUT_VERSION"
sed -i "s/__version__ = \".*\"/__version__ = \"${INPUT_VERSION}\"/" src/splunk_ao/__init__.py

- name: Get current version
id: get-version
run: echo "version=$(poetry version --short)" >> "$GITHUB_OUTPUT"

- name: Build package
run: poetry build

- name: Upload distributables
uses: actions/upload-artifact@v4
with:
name: splunk-ao-${{ steps.get-version.outputs.version }}
path: dist/

publish:
name: Publish to Test PyPI
needs: build
runs-on: ubuntu-latest
permissions:
id-token: write # Required for OIDC trusted publishing
environment:
name: testpypi
url: https://test.pypi.org/project/splunk-ao/

steps:
- name: Download distributables
uses: actions/download-artifact@v4
with:
name: splunk-ao-${{ needs.build.outputs.version }}
path: dist/

- name: Publish to Test PyPI
uses: pypa/gh-action-pypi-publish@release/v1
with:
repository-url: https://test.pypi.org/legacy/
verbose: true
print-hash: true
Loading