Skip to content

feat(ci): add PyPI release workflow for splunk-ao-adk #52

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
adityamehra merged 3 commits into from
Jun 29, 2026
Merged

feat(ci): add PyPI release workflow for splunk-ao-adk #52

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
319b6b4
feat(ci): add PyPI release workflow for splunk-ao-adk
adityamehra Jun 25, 2026
aa77a2d
chore: pin actions to commit SHAs and add version validation
adityamehra Jun 29, 2026
a84e2ee
fix: broaden version regex and add build job least-privilege permissions
adityamehra Jun 29, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
79 changes: 79 additions & 0 deletions .github/workflows/release-splunk-ao-adk.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,79 @@
name: Release splunk-ao-adk to PyPI

on:
workflow_dispatch:
inputs:
version:
description: 'Version to release (e.g., 0.1.0, 1.2.3, 1.2.3rc1, 1.2.3.post1). Must be an explicit version — bump keywords like "patch" or "minor" are not accepted.'
required: true
type: string

jobs:
build:
name: Build package
runs-on: ubuntu-latest
permissions:
contents: read
defaults:
run:
working-directory: splunk-ao-adk
outputs:
version: ${{ steps.get-version.outputs.version }}
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

- name: Set up Python
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
with:
python-version: '3.11'

- name: Set version
env:
INPUT_VERSION: ${{ inputs.version }}
run: |
if ! printf '%s' "$INPUT_VERSION" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+((a|b|rc)[0-9]+)?(\.post[0-9]+)?(\.dev[0-9]+)?$'; then
echo "::error::Invalid version '${INPUT_VERSION}'. Expected an explicit version like 0.1.0, 1.2.3rc1, or 1.2.3.post1. Bump keywords like 'patch' or 'major' are not accepted."
exit 1
fi
sed -i "s/^version = \".*\"/version = \"${INPUT_VERSION}\"/" pyproject.toml
sed -i "s/__version__ = \".*\"/__version__ = \"${INPUT_VERSION}\"/" src/splunk_ao_adk/__init__.py

- name: Get current version
id: get-version
run: |
VERSION=$(grep '^version = ' pyproject.toml | sed 's/version = "\(.*\)"/\1/')
echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
Comment on lines +38 to +45

@fercor-cisco fercor-cisco Jun 29, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 minor (bug): The sed substitution is not verified to have actually matched. If the version = "..." line format in pyproject.toml ever drifts (e.g. no surrounding spaces, or version moved under a different table), sed silently no-ops, and the subsequent Get current version step greps the unchanged file. The result: the build/artifact/publish would proceed with the stale version rather than the requested one, with no error — a silent wrong-version release. Since the version is already validated, you can both simplify and harden by deriving the output directly from the validated input and asserting the file was patched.

Suggested change
sed -i "s/^version = \".*\"/version = \"${INPUT_VERSION}\"/" pyproject.toml
sed -i "s/__version__ = \".*\"/__version__ = \"${INPUT_VERSION}\"/" src/splunk_ao_adk/__init__.py
- name: Get current version
id: get-version
run: |
VERSION=$(grep '^version = ' pyproject.toml | sed 's/version = "\(.*\)"/\1/')
echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
sed -i "s/^version = \".*\"/version = \"${INPUT_VERSION}\"/" pyproject.toml
sed -i "s/__version__ = \".*\"/__version__ = \"${INPUT_VERSION}\"/" src/splunk_ao_adk/__init__.py
if ! grep -q "^version = \"${INPUT_VERSION}\"" pyproject.toml; then
echo "::error::Failed to set version in pyproject.toml — version line format may have changed."
exit 1
fi
if ! grep -q "__version__ = \"${INPUT_VERSION}\"" src/splunk_ao_adk/__init__.py; then
echo "::error::Failed to set __version__ in src/splunk_ao_adk/__init__.py."
exit 1
fi

🤖 Generated by Astra

@adityamehra adityamehra Jun 29, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good catch — added grep -q assertions after each sed call to verify the substitution actually landed. If the version line format in pyproject.toml or the version file ever drifts, the step now fails loudly with a ::error:: annotation rather than silently continuing with the stale version. Applied to all three PyPI release workflows in PR #59.


- name: Build package
run: |
pip install build
python -m build

- name: Upload distributables
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
with:
name: splunk-ao-adk-${{ steps.get-version.outputs.version }}
path: splunk-ao-adk/dist/

publish:
name: Publish to PyPI
needs: build
runs-on: ubuntu-latest
permissions:
id-token: write # Required for OIDC trusted publishing
environment:
name: pypi
url: https://pypi.org/project/splunk-ao-adk/

steps:
- name: Download distributables
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
with:
name: splunk-ao-adk-${{ needs.build.outputs.version }}
path: dist/

- name: Publish to PyPI
uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # release/v1
with:
verbose: true
print-hash: true
Loading