publish-too.yaml

name: Publish-Too
on:
  push:
    tags:
      - '*'
jobs:
  build:
    runs-on: ubuntu-latest
    outputs:
      hash: ${{ steps.hash.outputs.hash }}
    steps:
      - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
      - uses: actions/setup-python@82c7e631bb3cdc910f68e0081d67478d79c6982d # v5.1.0
        with:
          python-version: '3.x'
          cache: pip
          cache-dependency-path: requirements*/*.txt
      # Use the commit date instead of the current date during the build.
      - run: echo "SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct)" >> $GITHUB_ENV
      - name: Create dist
        run: |
          python -m pip install -U pip
          pip install tox
          tox -e makedist-too
      # Generate hashes used for provenance.
      - name: generate hash
        id: hash
        run: cd dist && echo "hash=$(sha256sum * | base64 -w0)" >> $GITHUB_OUTPUT
      - uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
        with:
          path: ./dist
  provenance:
    needs: [build]
    permissions:
      actions: read
      id-token: write
      contents: write
    # Can't pin with hash due to how this workflow works.
    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.0.0
    with:
      base64-subjects: ${{ needs.build.outputs.hash }}
  create-release:
    # Upload the sdist, wheels, and provenance to a GitHub release. They remain
    # available as build artifacts for a while as well.
    needs: [provenance]
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
      - name: create release
        run: >
          gh release create --draft --repo ${{ github.repository }}
          ${{ github.ref_name }}-Too
          *.intoto.jsonl/* artifact/*
        env:
          GH_TOKEN: ${{ github.token }}

  publish-pypi-too:
    needs: [ provenance ]
    # Wait for approval before attempting to upload to PyPI. This allows reviewing the
    # files in the draft release.
    environment:
      name: publish
      url: https://pypi.org/project/Flask-Security-Too/${{ github.ref_name }}
    runs-on: ubuntu-latest
    permissions:
      id-token: write
    steps:
      - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
      - uses: pypa/gh-action-pypi-publish@fb13cb306901256ace3dab689990e13a5550ffaa # v1.11.0
        with:
          packages-dir: artifact/