From e4255b5bbfa722d287938ae9e83a74b534ada5c3 Mon Sep 17 00:00:00 2001 From: Daniel Ntege Date: Wed, 1 Apr 2026 14:28:08 +0300 Subject: [PATCH 01/10] feat: add available quantity management to InMemoryCartsRepository Signed-off-by: Daniel Ntege --- .github/workflows/publish.yml | 64 ++++++++++++++++++++++++++++++----- CHANGELOG.md | 1 + RELEASE.md | 9 +++++ 3 files changed, 66 insertions(+), 8 deletions(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index bc1448209..013488d7b 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -9,13 +9,10 @@ permissions: contents: read jobs: - build-and-publish: + build: + name: Build distributions runs-on: hl-sdk-py-lin-md - environment: - name: pypi - url: https://pypi.org/p/hiero-sdk-python - permissions: - id-token: write + steps: - name: Harden the runner (Audit all outbound calls) uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0 @@ -28,12 +25,12 @@ jobs: - name: Set up Python uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 with: - python-version: '3.14' + python-version: "3.14" - name: Upgrade pip run: pip install --upgrade pip - - name: Install build, pdm-backend, and grpcio-tools + - name: Install build dependencies run: pip install build pdm-backend "grpcio-tools>=1.76.0" - name: Generate Protobuf @@ -42,5 +39,56 @@ jobs: - name: Build wheel and sdist run: python -m build + - name: Upload distributions + uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3 + with: + name: dist + path: dist/* + if-no-files-found: error + + publish-and-sign: + name: Publish and sign release artifacts + needs: build + runs-on: ubuntu-latest + environment: + name: pypi + url: https://pypi.org/p/hiero-sdk-python + permissions: + contents: write + id-token: write + + steps: + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0 + with: + egress-policy: audit + + - name: Download distributions + uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8 + with: + name: dist + path: dist + + - name: Sign release distributions with Sigstore + uses: sigstore/gh-action-sigstore-python@04cffa1d795717b140764e8b640de88853c92acc # v3.3.0 + with: + inputs: | + dist/*.whl + dist/*.tar.gz + verify: true + verify-cert-identity: https://github.com/${{ github.repository }}/.github/workflows/publish.yml@refs/tags/${{ github.ref_name }} + verify-oidc-issuer: https://token.actions.githubusercontent.com + - name: Publish to PyPI uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # release/v1 + + - name: Upload signed assets to GitHub Release + uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe # v2.3.3 + with: + files: | + dist/*.whl + dist/*.tar.gz + dist/*.sigstore.json + fail_on_unmatched_files: true + generate_release_notes: true + prerelease: ${{ contains(github.ref_name, '-') }} \ No newline at end of file diff --git a/CHANGELOG.md b/CHANGELOG.md index fbf5d022a..3975884da 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -21,6 +21,7 @@ This changelog is based on [Keep a Changelog](https://keepachangelog.com/en/1.1. ### .github - Refactored the Advanced Issue Template to V2 with stricter prerequisites and a focus on architectural design (#2016). - Refactored the Advanced Issue Template to ensure PR-level quality checklists do not block maintainers during issue creation (#2036) +- Added Sigstore-signed GitHub release assets to the publish workflow to improve release provenance and Scorecard coverage (#2044) ## [0.2.3] - 2026-03-26 ### Added diff --git a/RELEASE.md b/RELEASE.md index a31463374..a691933e6 100644 --- a/RELEASE.md +++ b/RELEASE.md @@ -38,3 +38,12 @@ MAJOR.MINOR.PATCH ```bash git tag -a v0.2.0 -m "Release 0.2.0" git push origin v0.2.0 + ``` + +7. **Monitor the Publish Workflow** + - Wait for the `Publish to PyPI` workflow triggered by the tag to complete successfully. + - Confirm the GitHub release for the tag contains the wheel, source distribution, and matching `.sigstore.json` bundles. + +8. **Verify Published Artifacts** + - Confirm the new version is available on PyPI. + - If release provenance needs to be audited, use the attached Sigstore bundles from the GitHub release. From 0729c3071f0f4311f11b72c9a765eb8acf2f0efe Mon Sep 17 00:00:00 2001 From: Daniel Ntege Date: Wed, 1 Apr 2026 15:34:50 +0300 Subject: [PATCH 02/10] docs: update release process steps for clarity and consistency Signed-off-by: Daniel Ntege --- RELEASE.md | 28 ++++++++++++++-------------- 1 file changed, 14 insertions(+), 14 deletions(-) diff --git a/RELEASE.md b/RELEASE.md index a691933e6..5805a291d 100644 --- a/RELEASE.md +++ b/RELEASE.md @@ -22,28 +22,28 @@ MAJOR.MINOR.PATCH 2. **Update the Changelog** Move your entries from the **[Unreleased]** section in `CHANGELOG.md` to a new version heading with today’s date (e.g., `## [0.2.0] - 2025-02-20`). -3. **Create a Release Branch** - - `release-v0.2.0` or similar (e.g., `release-v0.2.0-beta.1` for beta versions). - -4. **Run Tests** +3. **Run Tests** - Ensure all tests pass locally (run `pytest`). - Confirm CI passes (integration tests, etc.). -5. **Merge into `main`** - - Create a Pull Request from `release-vX.X.X` into `main`. - - Wait for code review, ensure everything is green. +4. **Merge the Release Changes** + - Open a Pull Request to `main` with the version and changelog updates. + - Wait for code review and ensure the required checks pass. -6. **Tag the Release** - Once merged, create a git tag with the new version: +5. **Tag the Release** + Once the release changes are merged, create and push a git tag that matches the publish workflow trigger (`v*.*.*`): ```bash git tag -a v0.2.0 -m "Release 0.2.0" git push origin v0.2.0 ``` + - Pre-releases can use a suffix after the semantic version, for example `v0.2.0-beta.1`. -7. **Monitor the Publish Workflow** - - Wait for the `Publish to PyPI` workflow triggered by the tag to complete successfully. - - Confirm the GitHub release for the tag contains the wheel, source distribution, and matching `.sigstore.json` bundles. +6. **Monitor the Publish Workflow** + - The `.github/workflows/publish.yml` workflow runs automatically when the tag is pushed. + - The workflow builds the source distribution and wheel, generates protobufs before packaging, signs the release artifacts with Sigstore, publishes the package to PyPI, and creates or updates the GitHub release. + - If the tag contains `-`, the GitHub release is marked as a pre-release. -8. **Verify Published Artifacts** +7. **Verify Published Artifacts** - Confirm the new version is available on PyPI. - - If release provenance needs to be audited, use the attached Sigstore bundles from the GitHub release. + - Confirm the GitHub release contains the wheel, source distribution, and matching `.sigstore.json` bundles. + - If release provenance needs to be audited, use the Sigstore verification materials attached to the GitHub release. From 20bfb0dd7d72e55f07b31dae01f0ec7e4804e138 Mon Sep 17 00:00:00 2001 From: Daniel Ntege Date: Wed, 1 Apr 2026 16:34:30 +0300 Subject: [PATCH 03/10] docs: update release process steps for clarity and consistency Signed-off-by: Daniel Ntege --- .github/workflows/publish.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 013488d7b..e63e8bf0c 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -25,7 +25,7 @@ jobs: - name: Set up Python uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 with: - python-version: "3.14" + python-version: '3.14' - name: Upgrade pip run: pip install --upgrade pip From 726dacdd7f007289b19d7c765546c4a2dcd451c5 Mon Sep 17 00:00:00 2001 From: Daniel Ntege Date: Wed, 1 Apr 2026 16:35:43 +0300 Subject: [PATCH 04/10] docs: update release process steps for clarity and consistency Signed-off-by: Daniel Ntege --- .github/workflows/publish.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index e63e8bf0c..962de1f5f 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -30,7 +30,7 @@ jobs: - name: Upgrade pip run: pip install --upgrade pip - - name: Install build dependencies + - name: Install build, pdm-backend, and grpcio-tools run: pip install build pdm-backend "grpcio-tools>=1.76.0" - name: Generate Protobuf From 00cf4d2ccd60077a0e1ba47b6c055166787435c5 Mon Sep 17 00:00:00 2001 From: Daniel Ntege Date: Mon, 6 Apr 2026 19:29:41 +0300 Subject: [PATCH 05/10] fix: ensure newline at end of file in publish.yml Signed-off-by: Daniel Ntege --- .github/workflows/publish.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 884ad6c94..d3e7d9249 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -91,4 +91,4 @@ jobs: dist/*.sigstore.json fail_on_unmatched_files: true generate_release_notes: true - prerelease: ${{ contains(github.ref_name, '-') }} \ No newline at end of file + prerelease: ${{ contains(github.ref_name, '-') }} From 31b3be20c191dccde3ab7f0f923af5ea8818a754 Mon Sep 17 00:00:00 2001 From: Daniel Ntege Date: Mon, 6 Apr 2026 20:04:08 +0300 Subject: [PATCH 06/10] fix: update harden-runner action to version v2.16.1 Signed-off-by: Daniel Ntege --- .github/workflows/publish.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index d3e7d9249..a3a5f2e29 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -59,7 +59,7 @@ jobs: steps: - name: Harden the runner (Audit all outbound calls) - uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0 + uses: step-security/harden-runner@fe104658747b27e96e4f7e80cd0a94068e53901d # v2.16.1 with: egress-policy: audit From 3d603987f953121e7e21f861d5615b3db004e963 Mon Sep 17 00:00:00 2001 From: Daniel Ntege Date: Sat, 11 Apr 2026 21:53:37 +0300 Subject: [PATCH 07/10] chore: update actions and improve publish workflow Signed-off-by: Daniel Ntege --- .github/workflows/publish.yml | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 618ef25a7..eeb02263c 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -40,7 +40,7 @@ jobs: run: python -m build - name: Upload distributions - uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: dist path: dist/* @@ -49,7 +49,10 @@ jobs: publish-and-sign: name: Publish and sign release artifacts needs: build - runs-on: ubuntu-latest + concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: false + runs-on: hl-sdk-py-lin-md environment: name: pypi url: https://pypi.org/p/hiero-sdk-python @@ -59,16 +62,19 @@ jobs: steps: - name: Harden the runner (Audit all outbound calls) - uses: step-security/harden-runner@fe104658747b27e96e4f7e80cd0a94068e53901d # v2.16.1 + uses: step-security/harden-runner@f808768d1510423e83855289c910610ca9b43176 # v2.17.0 with: egress-policy: audit - name: Download distributions - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: dist path: dist + - name: Publish to PyPI + uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # release/v1 + - name: Sign release distributions with Sigstore uses: sigstore/gh-action-sigstore-python@04cffa1d795717b140764e8b640de88853c92acc # v3.3.0 with: @@ -79,11 +85,8 @@ jobs: verify-cert-identity: https://github.com/${{ github.repository }}/.github/workflows/publish.yml@refs/tags/${{ github.ref_name }} verify-oidc-issuer: https://token.actions.githubusercontent.com - - name: Publish to PyPI - uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # release/v1 - - name: Upload signed assets to GitHub Release - uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe # v2.3.3 + uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe # v2.6.1 with: files: | dist/*.whl From c145d400c56e6acb0c8c67f1a0e6f8f5b25875da Mon Sep 17 00:00:00 2001 From: Ntege Daniel Date: Wed, 15 Apr 2026 17:21:32 +0300 Subject: [PATCH 08/10] chore: update publish workflow to skip existing files and enhance release notes Signed-off-by: Ntege Daniel --- .github/workflows/publish.yml | 7 ++++++- CHANGELOG.md | 1 - RELEASE.md | 18 +++++------------- 3 files changed, 11 insertions(+), 15 deletions(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index eeb02263c..dca92da66 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -74,6 +74,8 @@ jobs: - name: Publish to PyPI uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # release/v1 + with: + skip-existing: true - name: Sign release distributions with Sigstore uses: sigstore/gh-action-sigstore-python@04cffa1d795717b140764e8b640de88853c92acc # v3.3.0 @@ -88,10 +90,13 @@ jobs: - name: Upload signed assets to GitHub Release uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe # v2.6.1 with: + body: | + ## Important notes + - See https://github.com/hiero-ledger/hiero-sdk-python/milestones for the pull requests included in this milestone. + - This release includes auto-generated release notes. files: | dist/*.whl dist/*.tar.gz dist/*.sigstore.json fail_on_unmatched_files: true generate_release_notes: true - prerelease: ${{ contains(github.ref_name, '-') }} diff --git a/CHANGELOG.md b/CHANGELOG.md index 0c0385044..33bb18f9b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -31,7 +31,6 @@ This changelog is based on [Keep a Changelog](https://keepachangelog.com/en/1.1. - chore: update GitHub Actions runners from ubuntu-latest to hl-sdk-py-lin-md (#2021) - Refactored the Advanced Issue Template to V2 with stricter prerequisites and a focus on architectural design (#2016). - Refactored the Advanced Issue Template to ensure PR-level quality checklists do not block maintainers during issue creation (#2036) -- Added Sigstore-signed GitHub release assets to the publish workflow to improve release provenance and Scorecard coverage (#2044) - Added CodeQL workflow (#2084) - chore: add concurrency to unit and integration tests (#2071) - Add automated label sync workflow to propagate labels from linked issues to pull requests (#1716) diff --git a/RELEASE.md b/RELEASE.md index 5805a291d..7eccd19f4 100644 --- a/RELEASE.md +++ b/RELEASE.md @@ -19,31 +19,23 @@ MAJOR.MINOR.PATCH 1. **Update the Version** Decide whether the changes are major, minor, or patch increments. -2. **Update the Changelog** - Move your entries from the **[Unreleased]** section in `CHANGELOG.md` to a new version heading with today’s date (e.g., `## [0.2.0] - 2025-02-20`). - -3. **Run Tests** +2. **Run Tests** - Ensure all tests pass locally (run `pytest`). - Confirm CI passes (integration tests, etc.). -4. **Merge the Release Changes** - - Open a Pull Request to `main` with the version and changelog updates. - - Wait for code review and ensure the required checks pass. - -5. **Tag the Release** +3. **Tag the Release** Once the release changes are merged, create and push a git tag that matches the publish workflow trigger (`v*.*.*`): + ```bash git tag -a v0.2.0 -m "Release 0.2.0" git push origin v0.2.0 ``` - - Pre-releases can use a suffix after the semantic version, for example `v0.2.0-beta.1`. -6. **Monitor the Publish Workflow** +4. **Monitor the Publish Workflow** - The `.github/workflows/publish.yml` workflow runs automatically when the tag is pushed. - The workflow builds the source distribution and wheel, generates protobufs before packaging, signs the release artifacts with Sigstore, publishes the package to PyPI, and creates or updates the GitHub release. - - If the tag contains `-`, the GitHub release is marked as a pre-release. -7. **Verify Published Artifacts** +5. **Verify Published Artifacts** - Confirm the new version is available on PyPI. - Confirm the GitHub release contains the wheel, source distribution, and matching `.sigstore.json` bundles. - If release provenance needs to be audited, use the Sigstore verification materials attached to the GitHub release. From cd2c23f410e1c86407187cded44165ca3204a1aa Mon Sep 17 00:00:00 2001 From: Ntege Daniel Date: Wed, 15 Apr 2026 17:47:21 +0300 Subject: [PATCH 09/10] chore: update publish workflow to skip existing files and enhance release notes Signed-off-by: Ntege Daniel --- RELEASE.md | 15 +++------------ 1 file changed, 3 insertions(+), 12 deletions(-) diff --git a/RELEASE.md b/RELEASE.md index 30b7524f5..b647a091e 100644 --- a/RELEASE.md +++ b/RELEASE.md @@ -19,22 +19,13 @@ MAJOR.MINOR.PATCH 1. **Update the Version** Decide whether the changes are major, minor, or patch increments. -2. **Update the Changelog** - Move your entries from the **[Unreleased]** section in `CHANGELOG.md` to a new version heading with today’s date (e.g., `## [0.2.0] - 2025-02-20`). - -3. **Create a Release Branch** - - `release-v0.2.0` or similar (e.g., `release-v0.2.0-beta.1` for beta versions). - -4. **Run Tests** +2. **Run Tests** - Ensure all tests pass locally (run `pytest`). - Confirm CI passes (integration tests, etc.). -5. **Merge into `main`** - - Create a Pull Request from `release-vX.X.X` into `main`. - - Wait for code review, ensure everything is green. +3. **Tag the Release** + Once the release changes are merged, create and push a git tag that matches the publish workflow trigger (`v*.*.*`): -6. **Tag the Release** - Once merged, create a git tag with the new version: ```bash git tag -a v0.2.0 -m "Release 0.2.0" git push origin v0.2.0 From a2932d905dcbcfa645613b736ae6b0822f04312b Mon Sep 17 00:00:00 2001 From: Ntege Daniel Date: Thu, 16 Apr 2026 15:40:31 +0300 Subject: [PATCH 10/10] chore: reorder Publish to PyPI step and ensure skip-existing option is set Signed-off-by: Ntege Daniel --- .github/workflows/publish.yml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 3e5b8646f..481135f4c 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -72,11 +72,6 @@ jobs: name: dist path: dist - - name: Publish to PyPI - uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # release/v1 - with: - skip-existing: true - - name: Sign release distributions with Sigstore uses: sigstore/gh-action-sigstore-python@04cffa1d795717b140764e8b640de88853c92acc # v3.3.0 with: @@ -87,6 +82,11 @@ jobs: verify-cert-identity: https://github.com/${{ github.repository }}/.github/workflows/publish.yml@refs/tags/${{ github.ref_name }} verify-oidc-issuer: https://token.actions.githubusercontent.com + - name: Publish to PyPI + uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # release/v1 + with: + skip-existing: true + - name: Upload signed assets to GitHub Release uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe # v2.6.1 with: