9
9
outputs :
10
10
hash : ${{ steps.hash.outputs.hash }}
11
11
steps :
12
- - uses : actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744
13
- - uses : actions/setup-python@61a6322f88396a6271a6ee3565807d608ecaddd1
12
+ - uses : actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
13
+ - uses : actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c
14
14
with :
15
15
python-version : ' 3.x'
16
16
cache : pip
@@ -23,17 +23,17 @@ jobs:
23
23
- name : generate hash
24
24
id : hash
25
25
run : cd dist && echo "hash=$(sha256sum * | base64 -w0)" >> $GITHUB_OUTPUT
26
- - uses : actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce
26
+ - uses : actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32
27
27
with :
28
+ name : dist
28
29
path : ./dist
29
30
provenance :
30
31
needs : [build]
31
32
permissions :
32
33
actions : read
33
34
id-token : write
34
35
contents : write
35
- # Can't pin with hash due to how this workflow works.
36
- uses : slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.9.0
36
+ uses : slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@07e64b653f10a80b6510f4568f685f8b7b9ea830
37
37
with :
38
38
base64-subjects : ${{ needs.build.outputs.hash }}
39
39
create-release :
47
47
- uses : actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a
48
48
- name : create release
49
49
run : >
50
- gh release create --draft --repo ${{ github.repository }}
51
- ${{ github.ref_name }}
52
- *.intoto.jsonl/* artifact/*
50
+ gh release create --draft --repo ${{ github.repository }} ${{ github.ref_name }} *.intoto.jsonl/* artifact/*
51
+
53
52
env :
54
53
GH_TOKEN : ${{ github.token }}
55
54
publish-pypi :
62
61
id-token : write
63
62
steps :
64
63
- uses : actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a
65
- - uses : pypa/gh-action-pypi-publish@b7f401de30cb6434a1e19f805ff006643653240e
64
+ - uses : pypa/gh-action-pypi-publish@f946db0f765b9ae754e44bfd5ae5b8b91cfb37ef
66
65
with :
67
66
repository-url : https://test.pypi.org/legacy/
68
- packages-dir : artifact/
69
- - uses : pypa/gh-action-pypi-publish@b7f401de30cb6434a1e19f805ff006643653240e
70
- with :
71
- packages-dir : artifact/
67
+ - uses : pypa/gh-action-pypi-publish@f946db0f765b9ae754e44bfd5ae5b8b91cfb37ef
0 commit comments