From 0ed7bc0aa07b6b80d76b94347b1f5f8761983cb0 Mon Sep 17 00:00:00 2001 From: adityamehra Date: Mon, 29 Jun 2026 13:06:30 -0700 Subject: [PATCH 1/3] feat(ci): add PyPI release workflow for splunk-ao-a2a Co-authored-by: Cursor --- .github/workflows/release-splunk-ao-a2a.yaml | 73 ++++++++++++++++++++ 1 file changed, 73 insertions(+) create mode 100644 .github/workflows/release-splunk-ao-a2a.yaml diff --git a/.github/workflows/release-splunk-ao-a2a.yaml b/.github/workflows/release-splunk-ao-a2a.yaml new file mode 100644 index 0000000..925d4e0 --- /dev/null +++ b/.github/workflows/release-splunk-ao-a2a.yaml @@ -0,0 +1,73 @@ +name: Release splunk-ao-a2a to PyPI + +on: + workflow_dispatch: + inputs: + version: + description: 'Version to release (e.g., 0.1.0, 1.2.3).' + required: true + type: string + +jobs: + build: + name: Build package + runs-on: ubuntu-latest + defaults: + run: + working-directory: splunk-ao-a2a + outputs: + version: ${{ steps.get-version.outputs.version }} + steps: + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + + - name: Set up Python + uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6 + with: + python-version: '3.11' + + - name: Set version + env: + INPUT_VERSION: ${{ inputs.version }} + run: | + sed -i "s/^version = \".*\"/version = \"${INPUT_VERSION}\"/" pyproject.toml + sed -i "s/__version__ = \".*\"/__version__ = \"${INPUT_VERSION}\"/" src/splunk_ao_a2a/_version.py + + - name: Get current version + id: get-version + run: | + VERSION=$(grep '^version = ' pyproject.toml | sed 's/version = "\(.*\)"/\1/') + echo "version=${VERSION}" >> "$GITHUB_OUTPUT" + + - name: Build package + run: | + pip install build + python -m build + + - name: Upload distributables + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + with: + name: splunk-ao-a2a-${{ steps.get-version.outputs.version }} + path: splunk-ao-a2a/dist/ + + publish: + name: Publish to PyPI + needs: build + runs-on: ubuntu-latest + permissions: + id-token: write # Required for OIDC trusted publishing + environment: + name: pypi + url: https://pypi.org/project/splunk-ao-a2a/ + + steps: + - name: Download distributables + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 + with: + name: splunk-ao-a2a-${{ needs.build.outputs.version }} + path: dist/ + + - name: Publish to PyPI + uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # release/v1 + with: + verbose: true + print-hash: true From 92494d007a2ce6ab614d3d385f0267fc70caf023 Mon Sep 17 00:00:00 2001 From: adityamehra Date: Mon, 29 Jun 2026 13:42:56 -0700 Subject: [PATCH 2/3] chore: add PEP 440 version format validation Reject bump keywords (patch, major, etc.) and malformed inputs with a clear error before any file is modified, matching the pattern added to the splunk-ao and splunk-ao-adk release workflows Co-authored-by: Cursor --- .github/workflows/release-splunk-ao-a2a.yaml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release-splunk-ao-a2a.yaml b/.github/workflows/release-splunk-ao-a2a.yaml index 925d4e0..6643825 100644 --- a/.github/workflows/release-splunk-ao-a2a.yaml +++ b/.github/workflows/release-splunk-ao-a2a.yaml @@ -4,7 +4,7 @@ on: workflow_dispatch: inputs: version: - description: 'Version to release (e.g., 0.1.0, 1.2.3).' + description: 'Version to release (e.g., 0.1.0, 1.2.3). Must be an explicit PEP 440 version — bump keywords like "patch" or "minor" are not accepted.' required: true type: string @@ -29,6 +29,10 @@ jobs: env: INPUT_VERSION: ${{ inputs.version }} run: | + if ! printf '%s' "$INPUT_VERSION" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+([abprc.][0-9]+)*$'; then + echo "::error::Invalid version '${INPUT_VERSION}'. Expected an explicit PEP 440 version (e.g. 0.1.0, 1.2.3b1). Bump keywords like 'patch' or 'major' are not accepted." + exit 1 + fi sed -i "s/^version = \".*\"/version = \"${INPUT_VERSION}\"/" pyproject.toml sed -i "s/__version__ = \".*\"/__version__ = \"${INPUT_VERSION}\"/" src/splunk_ao_a2a/_version.py From da68c3ff58d5d5c94718d3359f7d195356da70a7 Mon Sep 17 00:00:00 2001 From: adityamehra Date: Mon, 29 Jun 2026 14:07:53 -0700 Subject: [PATCH 3/3] fix: broaden version regex and add build job least-privilege permissions - Fix regex to correctly accept rc, .dev, and .post PEP 440 forms - Add permissions: contents: read to the build job Co-authored-by: Cursor --- .github/workflows/release-splunk-ao-a2a.yaml | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/.github/workflows/release-splunk-ao-a2a.yaml b/.github/workflows/release-splunk-ao-a2a.yaml index 6643825..53ea70c 100644 --- a/.github/workflows/release-splunk-ao-a2a.yaml +++ b/.github/workflows/release-splunk-ao-a2a.yaml @@ -4,7 +4,7 @@ on: workflow_dispatch: inputs: version: - description: 'Version to release (e.g., 0.1.0, 1.2.3). Must be an explicit PEP 440 version — bump keywords like "patch" or "minor" are not accepted.' + description: 'Version to release (e.g., 0.1.0, 1.2.3, 1.2.3rc1, 1.2.3.post1). Must be an explicit version — bump keywords like "patch" or "minor" are not accepted.' required: true type: string @@ -12,6 +12,8 @@ jobs: build: name: Build package runs-on: ubuntu-latest + permissions: + contents: read defaults: run: working-directory: splunk-ao-a2a @@ -29,8 +31,8 @@ jobs: env: INPUT_VERSION: ${{ inputs.version }} run: | - if ! printf '%s' "$INPUT_VERSION" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+([abprc.][0-9]+)*$'; then - echo "::error::Invalid version '${INPUT_VERSION}'. Expected an explicit PEP 440 version (e.g. 0.1.0, 1.2.3b1). Bump keywords like 'patch' or 'major' are not accepted." + if ! printf '%s' "$INPUT_VERSION" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+((a|b|rc)[0-9]+)?(\.post[0-9]+)?(\.dev[0-9]+)?$'; then + echo "::error::Invalid version '${INPUT_VERSION}'. Expected an explicit version like 0.1.0, 1.2.3rc1, or 1.2.3.post1. Bump keywords like 'patch' or 'major' are not accepted." exit 1 fi sed -i "s/^version = \".*\"/version = \"${INPUT_VERSION}\"/" pyproject.toml