@@ -58,13 +58,10 @@ jobs:
5858 needs : ['release-please']
5959 permissions :
6060 id-token : write # Needed for OIDC to get release secrets from AWS.
61+ attestations : write # Needed for actions/attest.
6162 if : ${{ needs.release-please.outputs.package-server-ai-released == 'true' }}
62- outputs :
63- package-hashes : ${{ steps.build.outputs.package-hashes }}
6463 steps :
6564 - uses : actions/checkout@v4
66- with :
67- fetch-depth : 0
6865
6966 - uses : ./.github/actions/ci
7067 with :
7572 with :
7673 workspace_path : packages/sdk/server-ai
7774
75+ - name : Attest build provenance
76+ uses : actions/attest@v4
77+ with :
78+ subject-path : ' packages/sdk/server-ai/dist/*'
79+
7880 - uses : launchdarkly/gh-actions/actions/release-secrets@release-secrets-v1.2.0
7981 name : ' Get PyPI token'
8082 with :
@@ -92,13 +94,10 @@ jobs:
9294 needs : ['release-please']
9395 permissions :
9496 id-token : write # Needed for OIDC to get release secrets from AWS.
97+ attestations : write # Needed for actions/attest.
9598 if : ${{ needs.release-please.outputs.package-server-ai-langchain-released == 'true' }}
96- outputs :
97- package-hashes : ${{ steps.build.outputs.package-hashes }}
9899 steps :
99100 - uses : actions/checkout@v4
100- with :
101- fetch-depth : 0
102101
103102 - uses : ./.github/actions/ci
104103 with :
@@ -109,6 +108,11 @@ jobs:
109108 with :
110109 workspace_path : packages/ai-providers/server-ai-langchain
111110
111+ - name : Attest build provenance
112+ uses : actions/attest@v4
113+ with :
114+ subject-path : ' packages/ai-providers/server-ai-langchain/dist/*'
115+
112116 - uses : launchdarkly/gh-actions/actions/release-secrets@release-secrets-v1.2.0
113117 name : ' Get PyPI token'
114118 with :
@@ -140,57 +144,28 @@ jobs:
140144 workspace_path : ${{ inputs.workspace_path }}
141145
142146 - uses : launchdarkly/gh-actions/actions/release-secrets@release-secrets-v1.2.0
143- if : ${{ inputs.dry_run != true }}
147+ if : ${{ format('{0}', inputs.dry_run) != ' true' }}
144148 name : ' Get PyPI token'
145149 with :
146150 aws_assume_role : ${{ vars.AWS_ROLE_ARN }}
147151 ssm_parameter_pairs : ' /production/common/releasing/pypi/token = PYPI_AUTH_TOKEN'
148152
149153 - name : Publish to PyPI
150- if : ${{ inputs.dry_run != true }}
154+ if : ${{ format('{0}', inputs.dry_run) != ' true' }}
151155 uses : pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0
152156 with :
153157 password : ${{ env.PYPI_AUTH_TOKEN }}
154158 packages-dir : ${{ inputs.workspace_path }}/dist/
155159
156- release-server-ai-provenance :
157- needs : ['release-please', 'release-server-ai']
158- if : ${{ needs.release-please.outputs.package-server-ai-released == 'true' }}
159- permissions :
160- actions : read # Needed for detecting the GitHub Actions environment.
161- id-token : write # Needed for provenance signing.
162- contents : write # Needed for uploading assets to the release.
163- uses : slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.0.0
164- with :
165- base64-subjects : " ${{ needs.release-server-ai.outputs.package-hashes }}"
166- upload-assets : true
167- upload-tag-name : ${{ needs.release-please.outputs.package-server-ai-tag-name }}
168-
169- release-server-ai-langchain-provenance :
170- needs : ['release-please', 'release-server-ai-langchain']
171- if : ${{ needs.release-please.outputs.package-server-ai-langchain-released == 'true' }}
172- permissions :
173- actions : read # Needed for detecting the GitHub Actions environment.
174- id-token : write # Needed for provenance signing.
175- contents : write # Needed for uploading assets to the release.
176- uses : slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@5a775b367a56d5bd118a224a811bba288150a563 # v2.0.0
177- with :
178- base64-subjects : " ${{ needs.release-server-ai-langchain.outputs.package-hashes }}"
179- upload-assets : true
180- upload-tag-name : ${{ needs.release-please.outputs.package-server-ai-langchain-tag-name }}
181-
182160 release-server-ai-openai :
183161 runs-on : ubuntu-latest
184162 needs : ['release-please']
185163 permissions :
186164 id-token : write # Needed for OIDC to get release secrets from AWS.
165+ attestations : write # Needed for actions/attest.
187166 if : ${{ needs.release-please.outputs.package-server-ai-openai-released == 'true' }}
188- outputs :
189- package-hashes : ${{ steps.build.outputs.package-hashes }}
190167 steps :
191168 - uses : actions/checkout@v4
192- with :
193- fetch-depth : 0
194169
195170 - uses : ./.github/actions/ci
196171 with :
@@ -201,6 +176,11 @@ jobs:
201176 with :
202177 workspace_path : packages/ai-providers/server-ai-openai
203178
179+ - name : Attest build provenance
180+ uses : actions/attest@v4
181+ with :
182+ subject-path : ' packages/ai-providers/server-ai-openai/dist/*'
183+
204184 - uses : launchdarkly/gh-actions/actions/release-secrets@release-secrets-v1.2.0
205185 name : ' Get PyPI token'
206186 with :
@@ -213,31 +193,15 @@ jobs:
213193 password : ${{ env.PYPI_AUTH_TOKEN }}
214194 packages-dir : packages/ai-providers/server-ai-openai/dist/
215195
216- release-server-ai-openai-provenance :
217- needs : ['release-please', 'release-server-ai-openai']
218- if : ${{ needs.release-please.outputs.package-server-ai-openai-released == 'true' }}
219- permissions :
220- actions : read # Needed for detecting the GitHub Actions environment.
221- id-token : write # Needed for provenance signing.
222- contents : write # Needed for uploading assets to the release.
223- uses : slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.0.0
224- with :
225- base64-subjects : " ${{ needs.release-server-ai-openai.outputs.package-hashes }}"
226- upload-assets : true
227- upload-tag-name : ${{ needs.release-please.outputs.package-server-ai-openai-tag-name }}
228-
229196 release-server-ai-optimization :
230197 runs-on : ubuntu-latest
231198 needs : ['release-please']
232199 permissions :
233200 id-token : write # Needed for OIDC to get release secrets from AWS.
201+ attestations : write # Needed for actions/attest.
234202 if : ${{ needs.release-please.outputs.package-server-ai-optimization-released == 'true' }}
235- outputs :
236- package-hashes : ${{ steps.build.outputs.package-hashes }}
237203 steps :
238204 - uses : actions/checkout@v4
239- with :
240- fetch-depth : 0
241205
242206 - uses : ./.github/actions/ci
243207 with :
@@ -248,6 +212,11 @@ jobs:
248212 with :
249213 workspace_path : packages/optimization
250214
215+ - name : Attest build provenance
216+ uses : actions/attest@v4
217+ with :
218+ subject-path : ' packages/optimization/dist/*'
219+
251220 - uses : launchdarkly/gh-actions/actions/release-secrets@release-secrets-v1.2.0
252221 name : ' Get PyPI token'
253222 with :
@@ -259,16 +228,3 @@ jobs:
259228 with :
260229 password : ${{ env.PYPI_AUTH_TOKEN }}
261230 packages-dir : packages/optimization/dist/
262-
263- release-server-ai-optimization-provenance :
264- needs : ['release-please', 'release-server-ai-optimization']
265- if : ${{ needs.release-please.outputs.package-server-ai-optimization-released == 'true' }}
266- permissions :
267- actions : read # Needed for detecting the GitHub Actions environment.
268- id-token : write # Needed for provenance signing.
269- contents : write # Needed for uploading assets to the release.
270- uses : slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.0.0
271- with :
272- base64-subjects : " ${{ needs.release-server-ai-optimization.outputs.package-hashes }}"
273- upload-assets : true
274- upload-tag-name : ${{ needs.release-please.outputs.package-server-ai-optimization-tag-name }}
0 commit comments