From 162f7de948df5d25572b052a4bd30593fd523171 Mon Sep 17 00:00:00 2001 From: adityamehra Date: Thu, 25 Jun 2026 13:25:10 -0700 Subject: [PATCH 1/3] feat(ci): add PyPI release workflow for splunk-ao Co-authored-by: Cursor --- .github/workflows/release-splunk-ao.yaml | 69 ++++++++++++++++++++++++ 1 file changed, 69 insertions(+) create mode 100644 .github/workflows/release-splunk-ao.yaml diff --git a/.github/workflows/release-splunk-ao.yaml b/.github/workflows/release-splunk-ao.yaml new file mode 100644 index 0000000..3c5027b --- /dev/null +++ b/.github/workflows/release-splunk-ao.yaml @@ -0,0 +1,69 @@ +name: Release splunk-ao to PyPI + +on: + workflow_dispatch: + inputs: + version: + description: 'Version to release (e.g., 0.1.0, 1.2.3). Must match the version in pyproject.toml or will override it.' + required: true + type: string + +jobs: + build: + name: Build package + runs-on: ubuntu-latest + outputs: + version: ${{ steps.get-version.outputs.version }} + steps: + - uses: actions/checkout@v4 + + - name: Set up Python + uses: actions/setup-python@v5 + with: + python-version: '3.11' + + - name: Install Poetry + run: pipx install poetry==2.4.1 + + - name: Set version + env: + INPUT_VERSION: ${{ inputs.version }} + run: | + poetry version "$INPUT_VERSION" + sed -i "s/__version__ = \".*\"/__version__ = \"${INPUT_VERSION}\"/" src/splunk_ao/__init__.py + + - name: Get current version + id: get-version + run: echo "version=$(poetry version --short)" >> "$GITHUB_OUTPUT" + + - name: Build package + run: poetry build + + - name: Upload distributables + uses: actions/upload-artifact@v4 + with: + name: splunk-ao-${{ steps.get-version.outputs.version }} + path: dist/ + + publish: + name: Publish to PyPI + needs: build + runs-on: ubuntu-latest + permissions: + id-token: write # Required for OIDC trusted publishing + environment: + name: pypi + url: https://pypi.org/project/splunk-ao/ + + steps: + - name: Download distributables + uses: actions/download-artifact@v4 + with: + name: splunk-ao-${{ needs.build.outputs.version }} + path: dist/ + + - name: Publish to PyPI + uses: pypa/gh-action-pypi-publish@release/v1 + with: + verbose: true + print-hash: true From 4a4b74aa0cf1dc96974dfcbaf40180525424432a Mon Sep 17 00:00:00 2001 From: adityamehra Date: Mon, 29 Jun 2026 13:37:40 -0700 Subject: [PATCH 2/3] chore: pin actions to commit SHAs and add version validation - Replace mutable action refs (v4, v5, release/v1) with full commit SHAs to match the supply-chain convention established in ci-tests.yaml - Add upfront version format validation in the Set version step to reject Poetry bump keywords (patch, major, etc.) and malformed inputs - Switch pyproject.toml update to sed (consistent with adk/a2a workflows) to remove ambiguity between Poetry bump rules and literal versions Co-authored-by: Cursor --- .github/workflows/release-splunk-ao.yaml | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) diff --git a/.github/workflows/release-splunk-ao.yaml b/.github/workflows/release-splunk-ao.yaml index 3c5027b..7f8b0f2 100644 --- a/.github/workflows/release-splunk-ao.yaml +++ b/.github/workflows/release-splunk-ao.yaml @@ -4,7 +4,7 @@ on: workflow_dispatch: inputs: version: - description: 'Version to release (e.g., 0.1.0, 1.2.3). Must match the version in pyproject.toml or will override it.' + description: 'Version to release (e.g., 0.1.0, 1.2.3). Must be an explicit PEP 440 version — bump keywords like "patch" or "minor" are not accepted.' required: true type: string @@ -15,10 +15,10 @@ jobs: outputs: version: ${{ steps.get-version.outputs.version }} steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Set up Python - uses: actions/setup-python@v5 + uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6 with: python-version: '3.11' @@ -29,7 +29,11 @@ jobs: env: INPUT_VERSION: ${{ inputs.version }} run: | - poetry version "$INPUT_VERSION" + if ! printf '%s' "$INPUT_VERSION" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+([abprc.][0-9]+)*$'; then + echo "::error::Invalid version '${INPUT_VERSION}'. Expected an explicit PEP 440 version (e.g. 0.1.0, 1.2.3b1). Bump keywords like 'patch' or 'major' are not accepted." + exit 1 + fi + sed -i "s/^version = \".*\"/version = \"${INPUT_VERSION}\"/" pyproject.toml sed -i "s/__version__ = \".*\"/__version__ = \"${INPUT_VERSION}\"/" src/splunk_ao/__init__.py - name: Get current version @@ -40,7 +44,7 @@ jobs: run: poetry build - name: Upload distributables - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: splunk-ao-${{ steps.get-version.outputs.version }} path: dist/ @@ -57,13 +61,13 @@ jobs: steps: - name: Download distributables - uses: actions/download-artifact@v4 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 with: name: splunk-ao-${{ needs.build.outputs.version }} path: dist/ - name: Publish to PyPI - uses: pypa/gh-action-pypi-publish@release/v1 + uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # release/v1 with: verbose: true print-hash: true From dcb3e260418a6a06e16e920c0a26fafa4e7700dc Mon Sep 17 00:00:00 2001 From: adityamehra Date: Mon, 29 Jun 2026 14:06:36 -0700 Subject: [PATCH 3/3] fix: broaden version regex and add build job least-privilege permissions - Fix regex to correctly accept rc, .dev, and .post PEP 440 forms: old: ([abprc.][0-9]+)* incorrectly rejects rc1 and .dev0 new: ((a|b|rc)[0-9]+)?(\.post[0-9]+)?(\.dev[0-9]+)? - Add permissions: contents: read to the build job so it does not inherit the default repo-wide GITHUB_TOKEN scope Co-authored-by: Cursor --- .github/workflows/release-splunk-ao.yaml | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/.github/workflows/release-splunk-ao.yaml b/.github/workflows/release-splunk-ao.yaml index 7f8b0f2..fabfbcf 100644 --- a/.github/workflows/release-splunk-ao.yaml +++ b/.github/workflows/release-splunk-ao.yaml @@ -4,7 +4,7 @@ on: workflow_dispatch: inputs: version: - description: 'Version to release (e.g., 0.1.0, 1.2.3). Must be an explicit PEP 440 version — bump keywords like "patch" or "minor" are not accepted.' + description: 'Version to release (e.g., 0.1.0, 1.2.3, 1.2.3rc1, 1.2.3.post1). Must be an explicit version — bump keywords like "patch" or "minor" are not accepted.' required: true type: string @@ -12,6 +12,8 @@ jobs: build: name: Build package runs-on: ubuntu-latest + permissions: + contents: read outputs: version: ${{ steps.get-version.outputs.version }} steps: @@ -29,8 +31,8 @@ jobs: env: INPUT_VERSION: ${{ inputs.version }} run: | - if ! printf '%s' "$INPUT_VERSION" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+([abprc.][0-9]+)*$'; then - echo "::error::Invalid version '${INPUT_VERSION}'. Expected an explicit PEP 440 version (e.g. 0.1.0, 1.2.3b1). Bump keywords like 'patch' or 'major' are not accepted." + if ! printf '%s' "$INPUT_VERSION" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+((a|b|rc)[0-9]+)?(\.post[0-9]+)?(\.dev[0-9]+)?$'; then + echo "::error::Invalid version '${INPUT_VERSION}'. Expected an explicit version like 0.1.0, 1.2.3rc1, or 1.2.3.post1. Bump keywords like 'patch' or 'major' are not accepted." exit 1 fi sed -i "s/^version = \".*\"/version = \"${INPUT_VERSION}\"/" pyproject.toml