From 371f61b6b9a197e10c5010a42bf3c26363b64722 Mon Sep 17 00:00:00 2001 From: adityamehra Date: Thu, 25 Jun 2026 14:37:07 -0700 Subject: [PATCH 1/4] feat(ci): add Test PyPI release workflow for splunk-ao-adk Co-authored-by: Cursor --- .../workflows/release-splunk-ao-adk-test.yaml | 87 +++++++++++++++++++ 1 file changed, 87 insertions(+) create mode 100644 .github/workflows/release-splunk-ao-adk-test.yaml diff --git a/.github/workflows/release-splunk-ao-adk-test.yaml b/.github/workflows/release-splunk-ao-adk-test.yaml new file mode 100644 index 0000000..9d937f4 --- /dev/null +++ b/.github/workflows/release-splunk-ao-adk-test.yaml @@ -0,0 +1,87 @@ +name: Release splunk-ao-adk to Test PyPI + +on: + pull_request: # Publishes a .dev pre-release on every PR push + workflow_dispatch: + inputs: + version: + description: 'Version to publish (e.g., 0.1.0, 1.2.3b1). Leave empty to use the version in pyproject.toml as-is.' + required: false + type: string + +jobs: + build: + name: Build package + runs-on: ubuntu-latest + defaults: + run: + working-directory: splunk-ao-adk + outputs: + version: ${{ steps.get-version.outputs.version }} + steps: + - uses: actions/checkout@v4 + + - name: Set up Python + uses: actions/setup-python@v5 + with: + python-version: '3.11' + + # PR builds: append .dev so the clean version is never + # consumed on Test PyPI and can still be used for the real release. + - name: Set pre-release version + if: github.event_name == 'pull_request' + run: | + VERSION_BASE=$(grep '^version = ' pyproject.toml | sed 's/version = "\(.*\)"/\1/') + PRE_VERSION="${VERSION_BASE}.dev${{ github.run_number }}" + sed -i "s/^version = \".*\"/version = \"${PRE_VERSION}\"/" pyproject.toml + sed -i "s/__version__ = \".*\"/__version__ = \"${PRE_VERSION}\"/" src/splunk_ao_adk/__init__.py + + # Manual dispatch: use the supplied version if provided. + - name: Override version + if: github.event_name == 'workflow_dispatch' && inputs.version != '' + env: + INPUT_VERSION: ${{ inputs.version }} + run: | + sed -i "s/^version = \".*\"/version = \"${INPUT_VERSION}\"/" pyproject.toml + sed -i "s/__version__ = \".*\"/__version__ = \"${INPUT_VERSION}\"/" src/splunk_ao_adk/__init__.py + + - name: Get current version + id: get-version + run: | + VERSION=$(grep '^version = ' pyproject.toml | sed 's/version = "\(.*\)"/\1/') + echo "version=${VERSION}" >> "$GITHUB_OUTPUT" + + - name: Build package + run: | + pip install build + python -m build + + - name: Upload distributables + uses: actions/upload-artifact@v4 + with: + name: splunk-ao-adk-${{ steps.get-version.outputs.version }} + path: splunk-ao-adk/dist/ + + publish: + name: Publish to Test PyPI + needs: build + runs-on: ubuntu-latest + permissions: + id-token: write # Required for OIDC trusted publishing + environment: + name: testpypi + url: https://test.pypi.org/project/splunk-ao-adk/ + + steps: + - name: Download distributables + uses: actions/download-artifact@v4 + with: + name: splunk-ao-adk-${{ needs.build.outputs.version }} + path: dist/ + + - name: Publish to Test PyPI + uses: pypa/gh-action-pypi-publish@release/v1 + with: + repository-url: https://test.pypi.org/legacy/ + verbose: true + print-hash: true From 1e46a13919006254aa955bce79938df0e1c777c7 Mon Sep 17 00:00:00 2001 From: adityamehra Date: Thu, 25 Jun 2026 14:42:32 -0700 Subject: [PATCH 2/4] feat(ci): gate Test PyPI publish on tests passing Co-authored-by: Cursor --- .../workflows/release-splunk-ao-adk-test.yaml | 33 ++++++++++++++++++- 1 file changed, 32 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release-splunk-ao-adk-test.yaml b/.github/workflows/release-splunk-ao-adk-test.yaml index 9d937f4..490582a 100644 --- a/.github/workflows/release-splunk-ao-adk-test.yaml +++ b/.github/workflows/release-splunk-ao-adk-test.yaml @@ -10,8 +10,39 @@ on: type: string jobs: + test: + name: Run tests + runs-on: ubuntu-latest + timeout-minutes: 30 + defaults: + run: + working-directory: splunk-ao-adk + steps: + - uses: actions/checkout@v4 + + - name: Set up Python + uses: actions/setup-python@v5 + with: + python-version: '3.11' + + - name: Install uv + uses: astral-sh/setup-uv@v7 + with: + enable-cache: true + cache-dependency-glob: "**/splunk-ao-adk/pyproject.toml" + + - name: Install dependencies + run: uv sync --dev + + - name: Run type check + run: uv run mypy src/ + + - name: Run tests + run: uv run pytest --cov=splunk_ao_adk --cov-report=xml + build: name: Build package + needs: test # Only build if tests pass runs-on: ubuntu-latest defaults: run: @@ -64,7 +95,7 @@ jobs: publish: name: Publish to Test PyPI - needs: build + needs: build # Only publish if build succeeds (which requires tests passing) runs-on: ubuntu-latest permissions: id-token: write # Required for OIDC trusted publishing From fdb6d4c973962e8a7bce403e1540cc35f1156304 Mon Sep 17 00:00:00 2001 From: adityamehra Date: Mon, 29 Jun 2026 13:42:32 -0700 Subject: [PATCH 3/4] chore: pin actions to commit SHAs and add version validation - Replace mutable action refs (v4, v5, v7, release/v1) with full commit SHAs to match the supply-chain convention established in ci-tests.yaml - Add PEP 440 version format validation in the Override version step so manual workflow_dispatch inputs are checked before any file is modified Co-authored-by: Cursor --- .../workflows/release-splunk-ao-adk-test.yaml | 24 +++++++++++-------- 1 file changed, 14 insertions(+), 10 deletions(-) diff --git a/.github/workflows/release-splunk-ao-adk-test.yaml b/.github/workflows/release-splunk-ao-adk-test.yaml index 490582a..7dbe554 100644 --- a/.github/workflows/release-splunk-ao-adk-test.yaml +++ b/.github/workflows/release-splunk-ao-adk-test.yaml @@ -5,7 +5,7 @@ on: workflow_dispatch: inputs: version: - description: 'Version to publish (e.g., 0.1.0, 1.2.3b1). Leave empty to use the version in pyproject.toml as-is.' + description: 'Version to publish (e.g., 0.1.0, 1.2.3b1). Must be an explicit PEP 440 version. Leave empty to use the version in pyproject.toml as-is.' required: false type: string @@ -18,15 +18,15 @@ jobs: run: working-directory: splunk-ao-adk steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Set up Python - uses: actions/setup-python@v5 + uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6 with: python-version: '3.11' - name: Install uv - uses: astral-sh/setup-uv@v7 + uses: astral-sh/setup-uv@681c641aba71e4a1c380be3ab5e12ad51f415867 # v7.1.6 with: enable-cache: true cache-dependency-glob: "**/splunk-ao-adk/pyproject.toml" @@ -50,10 +50,10 @@ jobs: outputs: version: ${{ steps.get-version.outputs.version }} steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Set up Python - uses: actions/setup-python@v5 + uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6 with: python-version: '3.11' @@ -67,12 +67,16 @@ jobs: sed -i "s/^version = \".*\"/version = \"${PRE_VERSION}\"/" pyproject.toml sed -i "s/__version__ = \".*\"/__version__ = \"${PRE_VERSION}\"/" src/splunk_ao_adk/__init__.py - # Manual dispatch: use the supplied version if provided. + # Manual dispatch: validate and use the supplied version if provided. - name: Override version if: github.event_name == 'workflow_dispatch' && inputs.version != '' env: INPUT_VERSION: ${{ inputs.version }} run: | + if ! printf '%s' "$INPUT_VERSION" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+([abprc.][0-9]+)*$'; then + echo "::error::Invalid version '${INPUT_VERSION}'. Expected an explicit PEP 440 version (e.g. 0.1.0, 1.2.3b1). Bump keywords like 'patch' or 'major' are not accepted." + exit 1 + fi sed -i "s/^version = \".*\"/version = \"${INPUT_VERSION}\"/" pyproject.toml sed -i "s/__version__ = \".*\"/__version__ = \"${INPUT_VERSION}\"/" src/splunk_ao_adk/__init__.py @@ -88,7 +92,7 @@ jobs: python -m build - name: Upload distributables - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: splunk-ao-adk-${{ steps.get-version.outputs.version }} path: splunk-ao-adk/dist/ @@ -105,13 +109,13 @@ jobs: steps: - name: Download distributables - uses: actions/download-artifact@v4 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 with: name: splunk-ao-adk-${{ needs.build.outputs.version }} path: dist/ - name: Publish to Test PyPI - uses: pypa/gh-action-pypi-publish@release/v1 + uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # release/v1 with: repository-url: https://test.pypi.org/legacy/ verbose: true From 4e04d2802a3a04942a271b0e33cc4949f3604af2 Mon Sep 17 00:00:00 2001 From: adityamehra Date: Mon, 29 Jun 2026 14:07:30 -0700 Subject: [PATCH 4/4] fix: broaden version regex and add least-privilege permissions to jobs - Fix regex to correctly accept rc, .dev, and .post PEP 440 forms - Add permissions: contents: read to the test and build jobs Co-authored-by: Cursor --- .github/workflows/release-splunk-ao-adk-test.yaml | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/.github/workflows/release-splunk-ao-adk-test.yaml b/.github/workflows/release-splunk-ao-adk-test.yaml index 7dbe554..e91f7c8 100644 --- a/.github/workflows/release-splunk-ao-adk-test.yaml +++ b/.github/workflows/release-splunk-ao-adk-test.yaml @@ -5,7 +5,7 @@ on: workflow_dispatch: inputs: version: - description: 'Version to publish (e.g., 0.1.0, 1.2.3b1). Must be an explicit PEP 440 version. Leave empty to use the version in pyproject.toml as-is.' + description: 'Version to publish (e.g., 0.1.0, 1.2.3rc1, 1.2.3.post1). Must be an explicit version. Leave empty to use the version in pyproject.toml as-is.' required: false type: string @@ -14,6 +14,8 @@ jobs: name: Run tests runs-on: ubuntu-latest timeout-minutes: 30 + permissions: + contents: read defaults: run: working-directory: splunk-ao-adk @@ -44,6 +46,8 @@ jobs: name: Build package needs: test # Only build if tests pass runs-on: ubuntu-latest + permissions: + contents: read defaults: run: working-directory: splunk-ao-adk @@ -73,8 +77,8 @@ jobs: env: INPUT_VERSION: ${{ inputs.version }} run: | - if ! printf '%s' "$INPUT_VERSION" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+([abprc.][0-9]+)*$'; then - echo "::error::Invalid version '${INPUT_VERSION}'. Expected an explicit PEP 440 version (e.g. 0.1.0, 1.2.3b1). Bump keywords like 'patch' or 'major' are not accepted." + if ! printf '%s' "$INPUT_VERSION" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+((a|b|rc)[0-9]+)?(\.post[0-9]+)?(\.dev[0-9]+)?$'; then + echo "::error::Invalid version '${INPUT_VERSION}'. Expected an explicit version like 0.1.0, 1.2.3rc1, or 1.2.3.post1. Bump keywords like 'patch' or 'major' are not accepted." exit 1 fi sed -i "s/^version = \".*\"/version = \"${INPUT_VERSION}\"/" pyproject.toml