From 54f61feb0314e5b6850e22e590b0a6d1d6c39c9b Mon Sep 17 00:00:00 2001 From: Copilot Date: Mon, 27 Jul 2026 14:22:39 -0400 Subject: [PATCH 1/3] DEVOPS-1154 update workflow refs and PyPI publish flow --- .github/workflows/issue_to_jira.yml | 2 +- .github/workflows/pr_jira_actions.yml | 2 +- .github/workflows/python_deploy_dev.yml | 26 +++++++++++++++++--- .github/workflows/python_deploy_prod.yml | 31 +++++++++++++++++++++--- .github/workflows/security_scan.yml | 4 +-- 5 files changed, 54 insertions(+), 11 deletions(-) diff --git a/.github/workflows/issue_to_jira.yml b/.github/workflows/issue_to_jira.yml index ae3a4247dd..c3cca31cc8 100644 --- a/.github/workflows/issue_to_jira.yml +++ b/.github/workflows/issue_to_jira.yml @@ -9,7 +9,7 @@ permissions: {} jobs: call-workflow-create-jira-issue: if: startsWith(github.repository, 'MiraGeoscience/') # run on the Mira repo only - uses: MiraGeoscience/CI-tools/.github/workflows/reusable-jira-issue_to_jira.yml@v3 + uses: MiraGeoscience/CI-tools/.github/workflows/reusable-jira-issue_to_jira.yml@DEVOPS-1154 permissions: contents: read issues: write diff --git a/.github/workflows/pr_jira_actions.yml b/.github/workflows/pr_jira_actions.yml index ed9916b8ec..af2b508f60 100644 --- a/.github/workflows/pr_jira_actions.yml +++ b/.github/workflows/pr_jira_actions.yml @@ -7,7 +7,7 @@ on: jobs: call-workflow-pr_jira_actions: if: github.event.action != 'edited' || github.event.changes.title != null - uses: MiraGeoscience/CI-tools/.github/workflows/reusable-jira-pr_actions.yml@v3 + uses: MiraGeoscience/CI-tools/.github/workflows/reusable-jira-pr_actions.yml@DEVOPS-1154 permissions: contents: read pull-requests: write diff --git a/.github/workflows/python_deploy_dev.yml b/.github/workflows/python_deploy_dev.yml index c8998ceeb3..598a0585e9 100644 --- a/.github/workflows/python_deploy_dev.yml +++ b/.github/workflows/python_deploy_dev.yml @@ -14,7 +14,7 @@ concurrency: jobs: call-workflow-conda-publish: name: Publish development conda package on JFrog Artifactory - uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_rattler_package.yml@v3 + uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_rattler_package.yml@DEVOPS-1154 permissions: contents: write with: @@ -29,7 +29,7 @@ jobs: JFROG_ARTIFACTORY_TOKEN: ${{ secrets.JFROG_ARTIFACTORY_TOKEN }} call-workflow-pypi-publish: name: Publish development pypi package (JFrog Artifactory, TestPyPI) - uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_pypi_package.yml@v3 + uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_pypi_package.yml@DEVOPS-1154 permissions: contents: write with: @@ -41,4 +41,24 @@ jobs: secrets: JFROG_ARTIFACTORY_URL: ${{ secrets.JFROG_ARTIFACTORY_URL }} JFROG_ARTIFACTORY_TOKEN: ${{ secrets.JFROG_ARTIFACTORY_TOKEN }} - PYPI_TOKEN: ${{ secrets.TEST_PYPI_TOKEN }} + publish-pypi-package: + name: Publish development Python package to TestPyPI + needs: call-workflow-pypi-publish + if: ${{ needs.call-workflow-pypi-publish.result == 'success' }} + runs-on: ubuntu-latest + permissions: + contents: read + id-token: write + steps: + - name: Download build artifact + uses: actions/download-artifact@v8 + with: + name: mira-simpeg-pip-package-build + path: download-artifact + - name: Publish package to TestPyPI + uses: pypa/gh-action-pypi-publish@v1.14.1 + with: + verbose: true + packages-dir: download-artifact/ + repository-url: https://test.pypi.org/legacy/ + attestations: true diff --git a/.github/workflows/python_deploy_prod.yml b/.github/workflows/python_deploy_prod.yml index 199b32bef9..7ba4f2aae9 100644 --- a/.github/workflows/python_deploy_prod.yml +++ b/.github/workflows/python_deploy_prod.yml @@ -29,7 +29,7 @@ jobs: call-workflow-conda-release: name: Publish production Conda package on JFrog Artifactory if: ${{ github.event_name == 'release' || github.event.inputs.publish-conda == 'true' }} - uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-release_conda_assets.yml@v3 + uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-release_conda_assets.yml@DEVOPS-1154 permissions: contents: write with: @@ -39,9 +39,9 @@ jobs: JFROG_ARTIFACTORY_URL: ${{ secrets.JFROG_ARTIFACTORY_URL }} JFROG_ARTIFACTORY_TOKEN: ${{ secrets.JFROG_ARTIFACTORY_TOKEN }} call-workflow-pypi-release: - name: Publish production PyPI package (JFrog Artifactory, PyPI) + name: Publish production PyPI package (JFrog Artifactory) if: ${{ github.event_name == 'release' || github.event.inputs.publish-pypi == 'true' }} - uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-release_pypi_assets.yml@v3 + uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-release_pypi_assets.yml@DEVOPS-1154 permissions: contents: write with: @@ -51,4 +51,27 @@ jobs: secrets: JFROG_ARTIFACTORY_URL: ${{ secrets.JFROG_ARTIFACTORY_URL }} JFROG_ARTIFACTORY_TOKEN: ${{ secrets.JFROG_ARTIFACTORY_TOKEN }} - PYPI_TOKEN: ${{ secrets.PYPI_TOKEN }} + publish-pypi-release: + name: Publish production Python package to PyPI + needs: call-workflow-pypi-release + if: ${{ (github.event_name == 'release' || github.event.inputs.publish-pypi == 'true') && needs.call-workflow-pypi-release.result == 'success' }} + runs-on: ubuntu-latest + permissions: + contents: read + id-token: write + steps: + - name: Download release assets + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + GH_REPO: ${{ github.repository }} + INPUTS_RELEASE_TAG: ${{ github.event.release.tag_name || github.event.inputs.release-tag }} + run: | + mkdir -p download-assets + cd download-assets + gh release download "${INPUTS_RELEASE_TAG}" -p '*.tar.gz' -p '*.whl' + - name: Publish package to PyPI + uses: pypa/gh-action-pypi-publish@v1.14.1 + with: + verbose: true + packages-dir: download-assets/ + attestations: true diff --git a/.github/workflows/security_scan.yml b/.github/workflows/security_scan.yml index f66335baeb..17d4d30acf 100644 --- a/.github/workflows/security_scan.yml +++ b/.github/workflows/security_scan.yml @@ -32,7 +32,7 @@ jobs: security-events: write contents: read actions: read - uses: MiraGeoscience/CI-tools/.github/workflows/reusable-zizmor-advanced-security.yml@v3 + uses: MiraGeoscience/CI-tools/.github/workflows/reusable-zizmor-advanced-security.yml@DEVOPS-1154 call-workflow-zizmor-advanced-security: name: Zizmor analysis (annotate) @@ -42,4 +42,4 @@ jobs: checks: write contents: read actions: read - uses: MiraGeoscience/CI-tools/.github/workflows/reusable-zizmor-annotate.yml@v3 + uses: MiraGeoscience/CI-tools/.github/workflows/reusable-zizmor-annotate.yml@DEVOPS-1154 From 6ac694419f47ff4ab8c980261e48d46b77d48fdd Mon Sep 17 00:00:00 2001 From: Copilot Date: Mon, 27 Jul 2026 14:39:34 -0400 Subject: [PATCH 2/3] Updating the signing --- .github/workflows/python_deploy_prod.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/python_deploy_prod.yml b/.github/workflows/python_deploy_prod.yml index 7ba4f2aae9..c1d10d3f1c 100644 --- a/.github/workflows/python_deploy_prod.yml +++ b/.github/workflows/python_deploy_prod.yml @@ -74,4 +74,5 @@ jobs: with: verbose: true packages-dir: download-assets/ + repository-url: https://upload.pypi.org/legacy/ attestations: true From b9a1485561d04800d93576f3e6938806d1bcaec8 Mon Sep 17 00:00:00 2001 From: Copilot Date: Wed, 29 Jul 2026 09:53:22 -0400 Subject: [PATCH 3/3] Cleaning up the code to use an action for future --- .github/workflows/python_deploy_dev.yml | 17 ++++++++--------- .github/workflows/python_deploy_prod.yml | 22 +++++++++------------- 2 files changed, 17 insertions(+), 22 deletions(-) diff --git a/.github/workflows/python_deploy_dev.yml b/.github/workflows/python_deploy_dev.yml index 598a0585e9..a7b33b8de3 100644 --- a/.github/workflows/python_deploy_dev.yml +++ b/.github/workflows/python_deploy_dev.yml @@ -50,15 +50,14 @@ jobs: contents: read id-token: write steps: - - name: Download build artifact - uses: actions/download-artifact@v8 - with: - name: mira-simpeg-pip-package-build - path: download-artifact + # Intentionally a composite action, not a reusable workflow: PyPI trusted + # publishing checks the OIDC token's workflow_ref, which only matches this + # repo's own workflow file when the publish step runs as a step here rather + # than as a job in a called `uses:` workflow (job_workflow_ref is unsupported + # by PyPI - see MiraGeoscience/CI-tools DEVOPS-1154 and pypi/warehouse#11096). - name: Publish package to TestPyPI - uses: pypa/gh-action-pypi-publish@v1.14.1 + uses: MiraGeoscience/CI-tools/.github/actions/reusable-python-publish_to_pypi@DEVOPS-1154 with: - verbose: true - packages-dir: download-artifact/ + source: artifact + artifact-name: mira-simpeg-pip-package-build repository-url: https://test.pypi.org/legacy/ - attestations: true diff --git a/.github/workflows/python_deploy_prod.yml b/.github/workflows/python_deploy_prod.yml index c1d10d3f1c..6fa72c9c70 100644 --- a/.github/workflows/python_deploy_prod.yml +++ b/.github/workflows/python_deploy_prod.yml @@ -60,19 +60,15 @@ jobs: contents: read id-token: write steps: - - name: Download release assets - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - GH_REPO: ${{ github.repository }} - INPUTS_RELEASE_TAG: ${{ github.event.release.tag_name || github.event.inputs.release-tag }} - run: | - mkdir -p download-assets - cd download-assets - gh release download "${INPUTS_RELEASE_TAG}" -p '*.tar.gz' -p '*.whl' + # Intentionally a composite action, not a reusable workflow: PyPI trusted + # publishing checks the OIDC token's workflow_ref, which only matches this + # repo's own workflow file when the publish step runs as a step here rather + # than as a job in a called `uses:` workflow (job_workflow_ref is unsupported + # by PyPI - see MiraGeoscience/CI-tools DEVOPS-1154 and pypi/warehouse#11096). - name: Publish package to PyPI - uses: pypa/gh-action-pypi-publish@v1.14.1 + uses: MiraGeoscience/CI-tools/.github/actions/reusable-python-publish_to_pypi@DEVOPS-1154 with: - verbose: true - packages-dir: download-assets/ + source: release + release-tag: ${{ github.event.release.tag_name || github.event.inputs.release-tag }} + github-token: ${{ secrets.GITHUB_TOKEN }} repository-url: https://upload.pypi.org/legacy/ - attestations: true