From 0648f79ecec271980304ec90a6aab6ccc1303cb4 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 16 Jul 2024 12:27:16 +0000 Subject: [PATCH 1/2] Bump sigstore/gh-action-sigstore-python from 2.1.1 to 3.0.0 Bumps [sigstore/gh-action-sigstore-python](https://github.com/sigstore/gh-action-sigstore-python) from 2.1.1 to 3.0.0. - [Release notes](https://github.com/sigstore/gh-action-sigstore-python/releases) - [Changelog](https://github.com/sigstore/gh-action-sigstore-python/blob/main/CHANGELOG.md) - [Commits](https://github.com/sigstore/gh-action-sigstore-python/compare/61f6a500bbfdd9a2a339cf033e5421951fbc1cd2...f514d46b907ebcd5bedc05145c03b69c1edd8b46) --- updated-dependencies: - dependency-name: sigstore/gh-action-sigstore-python dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] --- .github/workflows/pypi.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/pypi.yaml b/.github/workflows/pypi.yaml index daee08d5..01119de1 100644 --- a/.github/workflows/pypi.yaml +++ b/.github/workflows/pypi.yaml @@ -109,7 +109,7 @@ jobs: path: dist - name: "Sigstore sign package" - uses: sigstore/gh-action-sigstore-python@61f6a500bbfdd9a2a339cf033e5421951fbc1cd2 # v2.1.1 + uses: sigstore/gh-action-sigstore-python@f514d46b907ebcd5bedc05145c03b69c1edd8b46 # v3.0.0 with: inputs: | ./dist/*.tar.gz From 5ed34a458087158d30cbf26b044bbd87d8cc155b Mon Sep 17 00:00:00 2001 From: Nathan Weinberg Date: Mon, 7 Oct 2024 14:29:59 -0400 Subject: [PATCH 2/2] modify workflow to be compatible with new version Signed-off-by: Nathan Weinberg --- .github/workflows/pypi.yaml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/pypi.yaml b/.github/workflows/pypi.yaml index 01119de1..60528995 100644 --- a/.github/workflows/pypi.yaml +++ b/.github/workflows/pypi.yaml @@ -111,6 +111,7 @@ jobs: - name: "Sigstore sign package" uses: sigstore/gh-action-sigstore-python@f514d46b907ebcd5bedc05145c03b69c1edd8b46 # v3.0.0 with: + release-signing-artifacts: false inputs: | ./dist/*.tar.gz ./dist/*.whl @@ -125,7 +126,7 @@ jobs: # gh-action-pypi-publish has no option to ignore them. - name: "Remove sigstore signatures before uploading to PyPI" run: | - rm ./dist/*.sigstore + rm ./dist/*.sigstore.json - name: "Upload to PyPI" uses: pypa/gh-action-pypi-publish@ec4db0b4ddc65acdf4bff5fa45ac92d78b56bdf0 # v1.9.0