build: adding provenance generation to release-please workflow #256
Conversation
PROVENANCE.md
Outdated
| --source-uri github.com/launchdarkly/launchdarkly-server-sdk \ | ||
| launchdarkly_server_sdk-VERSION-py3-none-any.whl | ||
|
|
||
| TBD OUTPUT |
There was a problem hiding this comment.
TBD pending test output - @keelerm84 what's the best way to test out the updates to the release workflow?
There was a problem hiding this comment.
So there isn't a good way to test this without actually publishing something.
You can run the manual-publish with the dry run option (as I've mentioned in another comment), but actually going through the whole process isn't something that is easily done.
You can use the internal release please testing repo and just modify this code to not actually publish anything as well. I've done that a lot during initial dev.
There was a problem hiding this comment.
Leaving the example output empty for now until we're able to publish something (so it'll come in a separate commit after).
Let's coordinate on doing a manual-publish dry run next week to at least test most of the functionality here, and we can figure out a path for a full test after, though it sounds like the only way to make sure this works all the way through is to do this on an actual release. At the very least, the provenance generation happens last and won't fail the rest of the release steps
|
@keelerm84 does the |
PROVENANCE.md
Outdated
| --source-uri github.com/launchdarkly/launchdarkly-server-sdk \ | ||
| launchdarkly_server_sdk-VERSION-py3-none-any.whl | ||
|
|
||
| TBD OUTPUT |
There was a problem hiding this comment.
So there isn't a good way to test this without actually publishing something.
You can run the manual-publish with the dry run option (as I've mentioned in another comment), but actually going through the whole process isn't something that is easily done.
You can use the internal release please testing repo and just modify this code to not actually publish anything as well. I've done that a lot during initial dev.
It probably uploads a compressed copy of the source code, but the actual publication of the package is handled through pypi. |
Requirements
Related issues
Provide links to any issues in this repository or elsewhere relating to this pull request.
Describe the solution you've provided
Using Github SLSA generator to generate build provenance for
python-server-sdkImplementation based off of previous SDK SLSA integrations with release-please and Python-specific guidance here: https://sethmlarson.dev/python-and-slsa#generating-a-provenance-attestation
Describe alternatives you've considered
Provide a clear and concise description of any alternative solutions or features you've considered.
Additional context
Add any other context about the pull request here.