ci: add Sigstore signing and signed GitHub release artifacts for PyPI releases by danielmarv · Pull Request #2054 · hiero-ledger/hiero-sdk-python

danielmarv · 2026-04-01T12:45:45Z

Description:

This PR enhances the release workflow to comply with OpenSSF Scorecard “Signed-Releases” requirements by adding cryptographic signing for release artifacts and attaching them to GitHub Releases.

Changes

Split the release workflow into two jobs:
- build: generates wheel and sdist artifacts
- publish-and-sign: publishes, signs, and uploads release assets
Added Sigstore keyless signing using GitHub OIDC (id-token)
Verified signatures during CI using Sigstore
Uploaded signed artifacts (.sigstore.json) to GitHub Releases
Maintained PyPI Trusted Publishing via pypa/gh-action-pypi-publish
Reduced privilege scope by isolating signing/publishing in a dedicated job

Why

OpenSSF Scorecard’s Signed-Releases check requires that repositories provide cryptographically signed release artifacts in GitHub Releases. Previously, releases were published to PyPI but not signed or attached as verified assets in the repository.

This change:

Improves supply chain security
Enables verification of release integrity
Aligns with modern best practices (Sigstore + OIDC)
Helps improve the repository’s Scorecard rating

Security

Uses keyless signing (no long-lived secrets)
Requires id-token: write only in the publish job
Uses minimal permissions (contents: read globally, contents: write only where needed)

Testing

Triggered via version tags (v*.*.*)
Can be validated using a prerelease tag (e.g. v0.0.0-rc.1)
Confirmed outputs:
- dist/*.whl
- dist/*.tar.gz
- dist/*.sigstore.json
Verified that signed artifacts are attached to GitHub Releases

Related issue(s):

Fixes: [ADVANCED]: cryptographically sign releases #2044

Notes for reviewer:

Checklist

Documented (Code comments, README, etc.)
Tested (unit, integration, etc.)

Signed-off-by: Daniel Ntege <danientege785@gmail.com>

codacy-production · 2026-04-01T12:47:29Z

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

_{TIP This summary will be updated as you push new changes. Give us feedback}

codecov · 2026-04-01T12:48:18Z

Codecov Report

✅ All modified and coverable lines are covered by tests.

@@           Coverage Diff           @@
##             main    #2054   +/-   ##
=======================================
  Coverage   93.70%   93.70%           
=======================================
  Files         145      145           
  Lines        9452     9452           
=======================================
  Hits         8857     8857           
  Misses        595      595

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Copilot

Pull request overview

Enhances the PyPI publish workflow to meet OpenSSF Scorecard “Signed-Releases” expectations by adding Sigstore keyless signing and uploading signed artifacts to GitHub Releases, and updates release documentation/changelog accordingly.

Changes:

Split the publish workflow into separate build and publish/sign jobs, adding Sigstore signing + verification and GitHub Release asset uploads.
Updated RELEASE.md to reflect the tag-triggered publish/sign/release process.
Added a changelog entry documenting the signed release assets addition.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
`RELEASE.md`	Updates release steps to reference tag-triggered publishing, signing, and GitHub Release artifact verification.
`CHANGELOG.md`	Adds an Unreleased entry noting Sigstore-signed release assets for Scorecard provenance.
`.github/workflows/publish.yml`	Splits build vs. publish/sign, adds Sigstore signing+verification, and uploads artifacts (including `.sigstore.json`) to GitHub Releases.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

coderabbitai · 2026-04-01T12:54:15Z

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

@coderabbitai resume to resume automatic reviews.
@coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

▶️ Resume reviews
🔍 Trigger review

Walkthrough

Publish workflow split into a build job that builds and uploads dist/*, and a publish-and-sign job that downloads that artifact, signs distributions via Sigstore with OIDC verification, publishes to PyPI, and uploads signed bundles to the GitHub Release; release docs and changelog updated.

Changes

Cohort / File(s)	Summary
CI/CD Workflow `/.github/workflows/publish.yml`	Replaced single `build-and-publish` job with two jobs: `build` (runner hardening, checkout, Python setup, deps, protobuf generation, `python -m build`, uploads `dist/` artifact; reduced build-phase permissions) and `publish-and-sign` (runs after `build`, `environment: pypi`, restores `contents: write` and `id-token: write`, downloads `dist/`, publishes to PyPI, signs `dist/.whl` and `dist/.tar.gz` via Sigstore with OIDC-based certificate identity tied to the workflow tag and `verify: true`, uploads signed artifacts and `*.sigstore.json` to a GitHub Release with generated notes and prerelease handling; fails if expected files missing).
Documentation `CHANGELOG.md`, `RELEASE.md`	Added changelog entry noting Sigstore-signed GitHub release assets. Updated release instructions to remove explicit "Create a Release Branch" step, require merging a PR to `main` with version/changelog, require pushing a `v..*` tag (pre-release suffixes allowed), monitor the `publish.yml` workflow on tag push, and verify published PyPI and GitHub artifacts including `.sigstore.json` signature bundles.

Sequence Diagram(s)

mermaid
sequenceDiagram
participant Dev as Developer
participant GH as GitHub Actions
participant Build as Build Job
participant Publish as Publish-and-Sign Job
participant Sigstore as Sigstore Action
participant PyPI as PyPI
participant GHRel as GitHub Release

Dev->>GH: merge PR to main or push tag (v*.*.*)
GH->>Build: start build job
Build->>GH: upload artifact `dist/*`
GH->>Publish: trigger publish-and-sign (needs: build)
Publish->>GH: download artifact `dist/*`
Publish->>Sigstore: request signatures (OIDC auth, verify workflow identity)
Sigstore-->>Publish: return `.sigstore.json` bundles
Publish->>PyPI: upload signed wheel & sdist
Publish->>GHRel: upload archives + `.sigstore.json` bundles

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately and concisely describes the main changes: adding Sigstore signing and signed GitHub release artifacts to the CI workflow for PyPI releases.
Description check	✅ Passed	The description is well-structured and comprehensively related to the changeset, covering motivation, implementation details, security considerations, and testing guidance.
Linked Issues check	✅ Passed	The PR fully addresses issue `#2044` by implementing Sigstore keyless signing with OIDC, attaching signed artifacts to GitHub Releases, using minimal permissions, and supporting prerelease testing.
Out of Scope Changes check	✅ Passed	All changes are directly scoped to implementing signed releases: workflow restructuring for signing, RELEASE.md documentation updates, and CHANGELOG.md entries—no unrelated modifications detected.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

📋 Issue Planner

Built with CodeRabbit's Coding Plans for faster development and fewer bugs.

View plan used: #2044

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

coderabbitai

Actionable comments posted: 1

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 4b737ddb-f140-40cf-ae6a-03070247463e

📥 Commits

Reviewing files that changed from the base of the PR and between 553aea0 and 40b7f49.

📒 Files selected for processing (3)

.github/workflows/publish.yml
CHANGELOG.md
RELEASE.md

Signed-off-by: Daniel Ntege <danientege785@gmail.com>

coderabbitai

Actionable comments posted: 1

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: eeb9c463-79cf-4511-86df-01ce3aaaa856

📥 Commits

Reviewing files that changed from the base of the PR and between 40b7f49 and 726dacd.

📒 Files selected for processing (1)

.github/workflows/publish.yml

Signed-off-by: Daniel Ntege <danientege785@gmail.com>

coderabbitai

Actionable comments posted: 1

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: fe4626a3-bcec-45eb-a188-0a7c47c5be19

📥 Commits

Reviewing files that changed from the base of the PR and between 726dacd and 00cf4d2.

📒 Files selected for processing (2)

.github/workflows/publish.yml
CHANGELOG.md

Signed-off-by: Daniel Ntege <danientege785@gmail.com>

coderabbitai

Actionable comments posted: 1

♻️ Duplicate comments (1)

.github/workflows/publish.yml (1)
49-59: ⚠️ Potential issue | 🟠 Major

Add a tag-scoped concurrency guard to prevent duplicate or racing runs.

The publish-and-sign job writes to PyPI and creates GitHub releases but lacks a concurrency block. Reruns or duplicate tag pushes could race and leave release state inconsistent.
   publish-and-sign:
     name: Publish and sign release artifacts
     needs: build
+    concurrency:
+      group: ${{ github.workflow }}-${{ github.ref }}
+      cancel-in-progress: false
     runs-on: ubuntu-latest

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: f56c5e72-ddd6-42c7-98ad-1194b5a2713d

📥 Commits

Reviewing files that changed from the base of the PR and between 00cf4d2 and 31b3be2.

📒 Files selected for processing (1)

.github/workflows/publish.yml

exploreriii

Nice going! Last tidy

…ease notes Signed-off-by: Ntege Daniel <danientege785@gmail.com>

Signed-off-by: Daniel Ntege <danientege785@gmail.com>

exploreriii · 2026-04-15T14:32:33Z

is this ready for review again please? if so, please also resolve some of the prior comments :)

…ease notes Signed-off-by: Ntege Daniel <danientege785@gmail.com>

danielmarv · 2026-04-15T14:56:59Z

is this ready for review again please? if so, please also resolve some of the prior comments :)

addressed

exploreriii · 2026-04-15T15:00:02Z

thanks please makr ready for review

…s set Signed-off-by: Ntege Daniel <danientege785@gmail.com>

manishdait

lgtm

exploreriii

Rebase please @danielmarv

… releases (hiero-ledger#2054) Signed-off-by: Daniel Ntege <danientege785@gmail.com> Signed-off-by: Ntege Daniel <danientege785@gmail.com>

danielmarv added 2 commits April 1, 2026 14:28

feat: add available quantity management to InMemoryCartsRepository

e4255b5

Signed-off-by: Daniel Ntege <danientege785@gmail.com>

docs: update release process steps for clarity and consistency

0729c30

Signed-off-by: Daniel Ntege <danientege785@gmail.com>

danielmarv requested review from a team as code owners April 1, 2026 12:45

danielmarv requested review from PavelSBorisov, Copilot and nadineloepfe April 1, 2026 12:45

Merge branch 'main' into cry-sdk-br

40b7f49

Signed-off-by: Daniel Ntege <danientege785@gmail.com>

Copilot started reviewing on behalf of danielmarv April 1, 2026 12:46 View session

Copilot AI reviewed Apr 1, 2026

View reviewed changes

Comment thread .github/workflows/publish.yml Outdated

coderabbitai Bot reviewed Apr 1, 2026

View reviewed changes

Comment thread RELEASE.md

danielmarv added 2 commits April 1, 2026 16:34

docs: update release process steps for clarity and consistency

20bfb0d

Signed-off-by: Daniel Ntege <danientege785@gmail.com>

docs: update release process steps for clarity and consistency

726dacd

Signed-off-by: Daniel Ntege <danientege785@gmail.com>

coderabbitai Bot reviewed Apr 1, 2026

View reviewed changes

Comment thread .github/workflows/publish.yml

danielmarv marked this pull request as draft April 1, 2026 14:18

Merge branch 'main' into cry-sdk-br

e29e8e1

exploreriii added the status: in initial development label Apr 1, 2026

danielmarv marked this pull request as ready for review April 2, 2026 08:44

danielmarv marked this pull request as draft April 2, 2026 08:44

danielmarv added 2 commits April 6, 2026 19:21

Merge branch 'main' into cry-sdk-br

172a3fe

Signed-off-by: Daniel Ntege <danientege785@gmail.com>

fix: ensure newline at end of file in publish.yml

00cf4d2

Signed-off-by: Daniel Ntege <danientege785@gmail.com>

danielmarv marked this pull request as ready for review April 6, 2026 16:51

coderabbitai Bot reviewed Apr 6, 2026

View reviewed changes

Comment thread .github/workflows/publish.yml

fix: update harden-runner action to version v2.16.1

31b3be2

Signed-off-by: Daniel Ntege <danientege785@gmail.com>

coderabbitai Bot reviewed Apr 6, 2026

View reviewed changes

Comment thread .github/workflows/publish.yml

exploreriii added the reviewer: maintainer PR needs a review from the maintainer team label Apr 6, 2026

danielmarv added 2 commits April 12, 2026 17:05

Merge branch 'main' into cry-sdk-br

41a59ba

Merge branch 'main' into cry-sdk-br

42bb164

exploreriii requested changes Apr 13, 2026

View reviewed changes

Comment thread .github/workflows/publish.yml Outdated

Comment thread .github/workflows/publish.yml

Comment thread RELEASE.md Outdated

Comment thread RELEASE.md Outdated

Comment thread RELEASE.md Outdated

Comment thread CHANGELOG.md Outdated

exploreriii added status: needs developer revision and removed reviewer: maintainer PR needs a review from the maintainer team labels Apr 13, 2026

exploreriii marked this pull request as draft April 13, 2026 13:41

exploreriii added dev: in progress and removed status: needs changes labels Apr 14, 2026

danielmarv added 2 commits April 15, 2026 17:21

chore: update publish workflow to skip existing files and enhance rel…

c145d40

…ease notes Signed-off-by: Ntege Daniel <danientege785@gmail.com>

Merge branch 'main' into cry-sdk-br

cdf9b4c

Signed-off-by: Daniel Ntege <danientege785@gmail.com>

chore: update publish workflow to skip existing files and enhance rel…

cd2c23f

…ease notes Signed-off-by: Ntege Daniel <danientege785@gmail.com>

danielmarv marked this pull request as ready for review April 15, 2026 15:07

Merge branch 'main' into cry-sdk-br

06a0b9e

manishdait reviewed Apr 16, 2026

View reviewed changes

Comment thread .github/workflows/publish.yml Outdated

danielmarv added 3 commits April 16, 2026 15:20

Merge branch 'main' into cry-sdk-br

8b4d82d

chore: reorder Publish to PyPI step and ensure skip-existing option i…

a2932d9

…s set Signed-off-by: Ntege Daniel <danientege785@gmail.com>

Merge branch 'main' into cry-sdk-br

2d1ab94

manishdait approved these changes Apr 16, 2026

View reviewed changes

manishdait added the step: 2nd second stage of the review approval process label Apr 16, 2026

exploreriii approved these changes Apr 16, 2026

View reviewed changes

exploreriii merged commit bd98fd3 into hiero-ledger:main Apr 16, 2026
12 checks passed

exploreriii removed the step: 2nd second stage of the review approval process label Apr 16, 2026

exploreriii added this to the v0.2.5 milestone Apr 16, 2026

Uh oh!

Conversation

danielmarv commented Apr 1, 2026

Changes

Why

Security

Testing

Uh oh!

codacy-production Bot commented Apr 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Up to standards ✅

Uh oh!

codecov Bot commented Apr 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

coderabbitai Bot commented Apr 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviews paused

Walkthrough

Changes

Sequence Diagram(s)

Estimated code review effort

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

exploreriii left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

exploreriii commented Apr 15, 2026

Uh oh!

danielmarv commented Apr 15, 2026

Uh oh!

exploreriii commented Apr 15, 2026

Uh oh!

Uh oh!

manishdait left a comment

Choose a reason for hiding this comment

Uh oh!

exploreriii left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

codacy-production Bot commented Apr 1, 2026 •

edited

Loading

codecov Bot commented Apr 1, 2026 •

edited

Loading

coderabbitai Bot commented Apr 1, 2026 •

edited

Loading