From 5281813ea2656f3174f6023e835cdd02fe1a7a57 Mon Sep 17 00:00:00 2001 From: Kuberhealthy Release Manager Date: Fri, 28 Aug 2026 09:57:24 +0000 Subject: [PATCH 1/3] fix: grant publish workflow release permissions --- .github/workflows/publish.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 6252b4f..c7ed200 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -4,6 +4,10 @@ on: release: types: [published] +permissions: + contents: write + id-token: write + jobs: publish: runs-on: ubuntu-latest From 1ae6e0d5b157a5720994e99aa9d9a7ded1722c1a Mon Sep 17 00:00:00 2001 From: Kuberhealthy Coder Date: Wed, 9 Sep 2026 16:16:40 +0000 Subject: [PATCH 2/3] fix: isolate publish workflow permissions Signed-off-by: Kuberhealthy Coder --- .github/workflows/publish.yml | 26 +++++++++++++++++++++----- 1 file changed, 21 insertions(+), 5 deletions(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index c7ed200..ead406f 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -4,13 +4,10 @@ on: release: types: [published] -permissions: - contents: write - id-token: write - jobs: - publish: + build: runs-on: ubuntu-latest + permissions: {} steps: - uses: actions/checkout@v3 - uses: actions/setup-python@v4 @@ -21,6 +18,25 @@ jobs: python -m pip install --upgrade pip pip install build python -m build + - name: Upload package artifacts + uses: actions/upload-artifact@v4 + with: + name: python-dist + path: dist/* + if-no-files-found: error + + publish: + needs: build + runs-on: ubuntu-latest + permissions: + contents: write + id-token: write + steps: + - name: Download package artifacts + uses: actions/download-artifact@v4 + with: + name: python-dist + path: dist - name: Publish to PyPI uses: pypa/gh-action-pypi-publish@release/v1 with: From e331761374c2de401452e492a3c5f12b94c30305 Mon Sep 17 00:00:00 2001 From: Kuberhealthy Coder Date: Wed, 9 Sep 2026 16:36:49 +0000 Subject: [PATCH 3/3] fix: harden token-based publish workflow Signed-off-by: Kuberhealthy Coder --- .github/workflows/publish.yml | 30 ++++++++++++++++++++---------- 1 file changed, 20 insertions(+), 10 deletions(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index ead406f..8640b3b 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -9,8 +9,8 @@ jobs: runs-on: ubuntu-latest permissions: {} steps: - - uses: actions/checkout@v3 - - uses: actions/setup-python@v4 + - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 + - uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c with: python-version: "3.x" - name: Build package @@ -19,30 +19,40 @@ jobs: pip install build python -m build - name: Upload package artifacts - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 with: name: python-dist path: dist/* if-no-files-found: error - publish: + publish-pypi: needs: build runs-on: ubuntu-latest - permissions: - contents: write - id-token: write + permissions: {} steps: - name: Download package artifacts - uses: actions/download-artifact@v4 + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 with: name: python-dist path: dist - name: Publish to PyPI - uses: pypa/gh-action-pypi-publish@release/v1 + uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 with: user: __token__ password: ${{ secrets.PYPI_API_TOKEN }} + + attach-release-assets: + needs: [build, publish-pypi] + runs-on: ubuntu-latest + permissions: + contents: write + steps: + - name: Download package artifacts + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 + with: + name: python-dist + path: dist - name: Attach artifacts to release - uses: softprops/action-gh-release@v1 + uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844 with: files: dist/*