chore: prepare 0.5.7 release #13
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| # Tag conventions: | |
| # v0.4.1 → release pyobfus (top-level package) | |
| # mcp-v0.1.3 → release pyobfus-mcp (pyobfus_mcp/ package) | |
| # Both jobs use PyPI Trusted Publishing (OIDC) and emit PEP 740 sigstore | |
| # attestations automatically via pypa/gh-action-pypi-publish. | |
| # | |
| # Prerequisite (one-time, PyPI side): | |
| # Register two Trusted Publishers under https://pypi.org/manage/account/publishing/ | |
| # 1. project=pyobfus · owner=zhurong2020 · repo=pyobfus · workflow=release.yml | |
| # 2. project=pyobfus-mcp · owner=zhurong2020 · repo=pyobfus · workflow=release.yml | |
| # No long-lived API token is required after that — OIDC handles auth per release. | |
| on: | |
| push: | |
| tags: | |
| - 'v*.*.*' | |
| - 'mcp-v*.*.*' | |
| workflow_dispatch: | |
| inputs: | |
| target: | |
| description: 'Which package to release (manual fallback)' | |
| required: true | |
| type: choice | |
| options: | |
| - pyobfus | |
| - pyobfus-mcp | |
| permissions: | |
| contents: read | |
| jobs: | |
| release-pyobfus: | |
| name: Build + publish pyobfus | |
| if: | | |
| (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')) || | |
| (github.event_name == 'workflow_dispatch' && inputs.target == 'pyobfus') | |
| runs-on: ubuntu-latest | |
| permissions: | |
| id-token: write # OIDC for Trusted Publishing | |
| attestations: write | |
| steps: | |
| - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5 (pinned 2026-05-09 for Socket supply-chain score) | |
| - name: Set up Python | |
| uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 (pinned 2026-05-09) | |
| with: | |
| python-version: '3.13' | |
| - name: Build sdist + wheel | |
| run: | | |
| python -m pip install --upgrade pip build | |
| python -m build | |
| ls -lh dist/ | |
| - name: Publish to PyPI (with PEP 740 attestations) | |
| uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # release/v1 (pinned 2026-05-09 — refresh quarterly to pick up bug fixes) | |
| with: | |
| attestations: true | |
| print-hash: true | |
| release-pyobfus-mcp: | |
| name: Build + publish pyobfus-mcp | |
| if: | | |
| (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/mcp-v')) || | |
| (github.event_name == 'workflow_dispatch' && inputs.target == 'pyobfus-mcp') | |
| runs-on: ubuntu-latest | |
| permissions: | |
| id-token: write | |
| attestations: write | |
| steps: | |
| - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5 (pinned 2026-05-09 for Socket supply-chain score) | |
| - name: Set up Python | |
| uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 (pinned 2026-05-09) | |
| with: | |
| python-version: '3.13' | |
| - name: Build sdist + wheel (pyobfus-mcp) | |
| working-directory: pyobfus_mcp | |
| run: | | |
| python -m pip install --upgrade pip build | |
| python -m build | |
| ls -lh dist/ | |
| - name: Publish to PyPI (with PEP 740 attestations) | |
| uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # release/v1 (pinned 2026-05-09 — refresh quarterly to pick up bug fixes) | |
| with: | |
| attestations: true | |
| print-hash: true | |
| packages-dir: pyobfus_mcp/dist/ |