Skip to content

feat(ci): add PyPI release workflow for splunk-ao-a2a #56

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
adityamehra merged 3 commits into from
Jun 29, 2026
Merged

feat(ci): add PyPI release workflow for splunk-ao-a2a #56

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
0ed7bc0
feat(ci): add PyPI release workflow for splunk-ao-a2a
adityamehra Jun 29, 2026
92494d0
chore: add PEP 440 version format validation
adityamehra Jun 29, 2026
da68c3f
fix: broaden version regex and add build job least-privilege permissions
adityamehra Jun 29, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
79 changes: 79 additions & 0 deletions .github/workflows/release-splunk-ao-a2a.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,79 @@
name: Release splunk-ao-a2a to PyPI

on:
workflow_dispatch:
inputs:
version:
description: 'Version to release (e.g., 0.1.0, 1.2.3, 1.2.3rc1, 1.2.3.post1). Must be an explicit version — bump keywords like "patch" or "minor" are not accepted.'
required: true
type: string

jobs:
build:
name: Build package
runs-on: ubuntu-latest
permissions:
contents: read
defaults:
run:
working-directory: splunk-ao-a2a
outputs:
version: ${{ steps.get-version.outputs.version }}
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

- name: Set up Python
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
with:
python-version: '3.11'

- name: Set version
env:
INPUT_VERSION: ${{ inputs.version }}
run: |
if ! printf '%s' "$INPUT_VERSION" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+((a|b|rc)[0-9]+)?(\.post[0-9]+)?(\.dev[0-9]+)?$'; then
echo "::error::Invalid version '${INPUT_VERSION}'. Expected an explicit version like 0.1.0, 1.2.3rc1, or 1.2.3.post1. Bump keywords like 'patch' or 'major' are not accepted."
exit 1
fi
sed -i "s/^version = \".*\"/version = \"${INPUT_VERSION}\"/" pyproject.toml
sed -i "s/__version__ = \".*\"/__version__ = \"${INPUT_VERSION}\"/" src/splunk_ao_a2a/_version.py

- name: Get current version
id: get-version
run: |
VERSION=$(grep '^version = ' pyproject.toml | sed 's/version = "\(.*\)"/\1/')
echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
Comment on lines +34 to +45

@fercor-cisco fercor-cisco Jun 29, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟠 major (security): The version validation can be bypassed by a multi-line input, which then flows unsanitized into the sed replacement string. grep -Eq '^...$' matches on a per-line basis, so an input such as 0.1.0\n<arbitrary> passes the check (line 1 matches) even though the whole value is not a valid version. The raw $INPUT_VERSION is then interpolated into sed -i "s/^version = \".*\"/version = \"${INPUT_VERSION}\"/"; an embedded newline terminates the s command and the remainder is parsed as additional sed commands (e.g. e/w), giving command/file-write execution in CI. workflow_dispatch string inputs are single-line in the UI but can contain newlines when dispatched via the REST API / gh workflow run. Although dispatching requires write access, code execution inside a release pipeline is worth closing off. Prefer bash's [[ =~ ]], whose ^/$ anchor the entire string and where . does not cross newlines, so multi-line input is rejected. The same hardening should be mirrored in any sibling release workflow.

Suggested change
if ! printf '%s' "$INPUT_VERSION" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+((a|b|rc)[0-9]+)?(\.post[0-9]+)?(\.dev[0-9]+)?$'; then
echo "::error::Invalid version '${INPUT_VERSION}'. Expected an explicit version like 0.1.0, 1.2.3rc1, or 1.2.3.post1. Bump keywords like 'patch' or 'major' are not accepted."
exit 1
fi
sed -i "s/^version = \".*\"/version = \"${INPUT_VERSION}\"/" pyproject.toml
sed -i "s/__version__ = \".*\"/__version__ = \"${INPUT_VERSION}\"/" src/splunk_ao_a2a/_version.py
- name: Get current version
id: get-version
run: |
VERSION=$(grep '^version = ' pyproject.toml | sed 's/version = "\(.*\)"/\1/')
echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
- name: Set version
env:
INPUT_VERSION: ${{ inputs.version }}
run: |
if [[ ! "$INPUT_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+((a|b|rc)[0-9]+)?(\.post[0-9]+)?(\.dev[0-9]+)?$ ]]; then
echo "::error::Invalid version '${INPUT_VERSION}'. Expected an explicit version like 0.1.0, 1.2.3rc1, or 1.2.3.post1. Bump keywords like 'patch' or 'major' are not accepted."
exit 1
fi
sed -i "s/^version = \".*\"/version = \"${INPUT_VERSION}\"/" pyproject.toml
sed -i "s/__version__ = \".*\"/__version__ = \"${INPUT_VERSION}\"/" src/splunk_ao_a2a/_version.py

🤖 Generated by Astra

@adityamehra adityamehra Jun 29, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good catch — switched from grep -Eq to bash [[ =~ ]] across all three PyPI release workflows. The [[ =~ ]] operator anchors ^/$ to the entire string rather than matching per-line, so a multi-line input like 0.1.0\n<payload> is now rejected outright. Fixed in PR #59.


- name: Build package
run: |
pip install build
python -m build

- name: Upload distributables
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
with:
name: splunk-ao-a2a-${{ steps.get-version.outputs.version }}
path: splunk-ao-a2a/dist/

publish:
name: Publish to PyPI
needs: build
runs-on: ubuntu-latest
permissions:
id-token: write # Required for OIDC trusted publishing
environment:
name: pypi
url: https://pypi.org/project/splunk-ao-a2a/

steps:
- name: Download distributables
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
with:
name: splunk-ao-a2a-${{ needs.build.outputs.version }}
path: dist/

- name: Publish to PyPI
uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # release/v1
with:
verbose: true
print-hash: true
Loading