Bump sigstore from 4.4.0 to 4.5.0 #1087
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI pipeline | |
| on: | |
| push: | |
| branches: [ master, "ci/*" ] | |
| pull_request: | |
| branches: [ master ] | |
| workflow_call: | |
| secrets: | |
| CODECOV_TOKEN: | |
| required: true | |
| workflow_dispatch: {} | |
| permissions: | |
| actions: read | |
| contents: read | |
| env: | |
| UV_NO_MANAGED_PYTHON: 1 | |
| PDFTOPPM_PATH: /usr/bin/pdftoppm | |
| IM_COMPARE_PATH: /usr/bin/compare | |
| SOFTHSM2_CONF: /tmp/softhsm2.conf | |
| SOFTHSM2_MODULE_PATH: /usr/lib/softhsm/libsofthsm2.so | |
| CERTOMANCER_CONFIG_PATH: internal/common-test-utils/src/pyhanko_testing_commons/test_data/data/crypto/certomancer.yml | |
| COVERAGE_SCOPE: "--cov=pyhanko --cov=pyhanko_certvalidator --cov-branch" | |
| jobs: | |
| pytest-coverage: | |
| runs-on: ubuntu-latest | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"] | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Set up Python ${{ matrix.python-version }} | |
| uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 | |
| with: | |
| python-version: ${{ matrix.python-version }} | |
| allow-prereleases: true | |
| - name: Install uv | |
| uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2 | |
| with: | |
| enable-cache: true | |
| python-version: ${{ matrix.python-version }} | |
| - name: Disable Python problem matchers | |
| shell: bash | |
| # we remove setup-python's problem matchers because | |
| # they aren't really an asset given the way pyHanko is tested | |
| run: echo "::remove-matcher owner=python::" | |
| - name: Test pyhanko-certvalidator with pytest | |
| run: | | |
| uv run --directory pkgs/pyhanko-certvalidator --no-dev --exact --group testing-base \ | |
| pytest $COVERAGE_SCOPE \ | |
| --cov-report=xml:python-${{ matrix.python-version }}-coverage.xml \ | |
| -m "not algo(algo='mldsa')" tests | |
| - name: Install external tools for pyHanko test suite | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install poppler-utils imagemagick softhsm2 | |
| - name: Initialise SoftHSM tokens | |
| run: | | |
| mkdir softhsm_tokens | |
| echo "directories.tokendir = $(pwd)/softhsm_tokens" > $SOFTHSM2_CONF | |
| ./internal/common-test-utils/src/pyhanko_testing_commons/test_data/data/crypto/testing-ca-setup/pkcs11-setup-certomancer.sh | |
| env: | |
| UV_PROJECT: pkgs/pyhanko | |
| P11_PQC: "no" | |
| - name: Test pyHanko with pytest | |
| run: | | |
| uv run --directory pkgs/pyhanko --no-dev --exact --group testing --all-extras \ | |
| pytest $COVERAGE_SCOPE \ | |
| --cov-report=xml:python-${{ matrix.python-version }}-coverage.xml \ | |
| tests | |
| env: | |
| PKCS11_TEST_MODULE: ${{ env.SOFTHSM2_MODULE_PATH }} | |
| - name: Test pyHanko CLI with pytest | |
| run: | | |
| uv run --directory pkgs/pyhanko-cli --no-dev --exact --group testing --all-extras \ | |
| pytest $COVERAGE_SCOPE \ | |
| --cov-report=xml:python-cli-${{ matrix.python-version }}-coverage.xml \ | |
| tests | |
| env: | |
| PKCS11_TEST_MODULE: ${{ env.SOFTHSM2_MODULE_PATH }} | |
| - name: Stash coverage report | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: coverage-${{ strategy.job-index }} | |
| path: "pkgs/*/*-coverage.xml" | |
| pytest-coverage-p11-pqc: | |
| runs-on: ubuntu-26.04 # needed to get a sufficiently recent openssl | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| python-version: ["3.14"] | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Set up Python ${{ matrix.python-version }} | |
| uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 | |
| with: | |
| python-version: ${{ matrix.python-version }} | |
| allow-prereleases: true | |
| - name: Install uv | |
| uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2 | |
| with: | |
| enable-cache: true | |
| python-version: ${{ matrix.python-version }} | |
| - name: Disable Python problem matchers | |
| shell: bash | |
| # we remove setup-python's problem matchers because | |
| # they aren't really an asset given the way pyHanko is tested | |
| run: echo "::remove-matcher owner=python::" | |
| - name: Install SoftHSMv2 development build from source | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y libssl-dev | |
| git clone --depth 1 https://github.com/softhsm/SoftHSMv2 | |
| cd SoftHSMv2 | |
| ./autogen.sh | |
| ./configure --prefix=/usr --disable-gost --enable-mldsa | |
| make -j"$(nproc)" | |
| sudo make install | |
| sudo ldconfig | |
| cd .. | |
| - name: Initialise SoftHSM tokens | |
| run: | | |
| mkdir softhsm_tokens | |
| echo "directories.tokendir = $(pwd)/softhsm_tokens" > $SOFTHSM2_CONF | |
| ./internal/common-test-utils/src/pyhanko_testing_commons/test_data/data/crypto/testing-ca-setup/pkcs11-setup-certomancer.sh | |
| env: | |
| UV_PROJECT: pkgs/pyhanko | |
| P11_PQC: "yes" | |
| - name: Test pyHanko with pytest | |
| run: | | |
| uv run --directory pkgs/pyhanko --no-dev --exact --group testing --all-extras \ | |
| pytest $COVERAGE_SCOPE \ | |
| --cov-report=xml:python-p11-pqc-${{ matrix.python-version }}-coverage.xml \ | |
| -m "algo(algo='mldsa')" tests/test_pkcs11.py | |
| env: | |
| PKCS11_TEST_MODULE: ${{ env.SOFTHSM2_MODULE_PATH }} | |
| - name: Test pyHanko CLI with pytest | |
| run: | | |
| uv run --directory pkgs/pyhanko-cli --no-dev --exact --group testing --all-extras \ | |
| pytest $COVERAGE_SCOPE \ | |
| --cov-report=xml:python-cli-p11-pqc-${{ matrix.python-version }}-coverage.xml \ | |
| -m "algo(algo='mldsa')" tests/test_cli_signing_pkcs11.py | |
| env: | |
| PKCS11_TEST_MODULE: ${{ env.SOFTHSM2_MODULE_PATH }} | |
| - name: Stash coverage report | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: coverage-p11-pqc-${{ strategy.job-index }} | |
| path: "pkgs/*/*-coverage.xml" | |
| live-integration-tests: | |
| runs-on: ubuntu-latest | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"] | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Set up Python ${{ matrix.python-version }} | |
| uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 | |
| with: | |
| python-version: ${{ matrix.python-version }} | |
| allow-prereleases: true | |
| - name: Install uv | |
| uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2 | |
| with: | |
| enable-cache: true | |
| # TODO on the current version of setup-uv, | |
| # the post-run prune step hangs for this job. | |
| # Keep an eye on that. | |
| save-cache: false | |
| python-version: ${{ matrix.python-version }} | |
| - name: Disable Python problem matchers | |
| shell: bash | |
| # we remove setup-python's problem matchers because | |
| # they aren't really an asset given the way pyHanko is tested | |
| run: echo "::remove-matcher owner=python::" | |
| - name: Start Certomancer Animator daemon | |
| run: | | |
| uv run --project internal/integration-tests \ | |
| certomancer --service-url-prefix http://localhost:9000 \ | |
| --config "$CERTOMANCER_CONFIG_PATH" animate & | |
| - name: Start CSC dummy server | |
| run: | | |
| uv run --project internal/integration-tests \ | |
| certomancer-csc "$CERTOMANCER_CONFIG_PATH" 8999 2 & | |
| - name: Test with pytest | |
| run: | | |
| uv run --directory internal/integration-tests \ | |
| pytest $COVERAGE_SCOPE \ | |
| --cov-report=xml:python-${{ matrix.python-version }}-live-coverage.xml \ | |
| tests | |
| env: | |
| LIVE_CERTOMANCER_HOST_URL: http://localhost:9000 | |
| LIVE_CSC_SCAL2_HOST_URL: http://localhost:8999 | |
| - name: Stash coverage report | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: coverage-live-${{ strategy.job-index }} | |
| path: "internal/integration-tests/*-coverage.xml" | |
| hsm-pkcs11-tests: | |
| runs-on: pyhanko-testbench | |
| # Dependabot PRs don't get access to secrets | |
| if: ${{ github.actor != 'dependabot[bot]' }} | |
| environment: testbench | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Install uv | |
| uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2 | |
| - name: Test library against HSM testbench | |
| run: | | |
| uv run --directory pkgs/pyhanko --no-dev --exact --group testing-base --extra pkcs11 \ | |
| pytest $COVERAGE_SCOPE \ | |
| --cov-report=xml:python-hsm-coverage.xml \ | |
| -m hsm tests/test_pkcs11.py | |
| env: | |
| PKCS11_PLATFORMS: yubihsm,yubikey-nano,safenet,nitrokey | |
| - name: Test CLI against HSM testbench | |
| run: | | |
| uv run --directory pkgs/pyhanko-cli --no-dev --exact --group testing \ | |
| pytest $COVERAGE_SCOPE \ | |
| --cov-report=xml:python-cli-hsm-coverage.xml \ | |
| -m hsm tests/test_cli_signing_pkcs11.py | |
| env: | |
| PKCS11_PLATFORMS: yubihsm,yubikey-nano,safenet,nitrokey | |
| - name: Stash coverage reports | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: coverage-hsm | |
| path: "pkgs/*/*-coverage.xml" | |
| smoke-tests: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Set up Python | |
| uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 | |
| - name: Install uv | |
| uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2 | |
| with: | |
| enable-cache: true | |
| - name: Disable Python problem matchers | |
| shell: bash | |
| # we remove setup-python's problem matchers because | |
| # they aren't really an asset given the way pyHanko is tested | |
| run: echo "::remove-matcher owner=python::" | |
| - name: Run library smoke tests with minimal deps | |
| # We run a couple of the "bread and butter" test modules, and the full CLI test suite except for | |
| # the PKCS#11 parts | |
| run: | | |
| uv run --directory pkgs/pyhanko --no-dev --exact --group testing-base \ | |
| pytest $COVERAGE_SCOPE \ | |
| -m "not nosmoke" --cov-report=xml:python-smoke-test-lib-coverage.xml \ | |
| tests/test_signing.py tests/test_diff_analysis.py tests/test_crypt.py \ | |
| tests/test_cms.py tests/test_ades_validation.py | |
| - name: Run CLI test suite with minimal deps | |
| # We run a couple of the "bread and butter" test modules, and the full CLI test suite except for | |
| # the PKCS#11 & qualified validation parts | |
| run: | | |
| uv run --directory pkgs/pyhanko-cli --no-dev --exact --group testing-base \ | |
| pytest $COVERAGE_SCOPE \ | |
| -m "not nosmoke" --cov-report=xml:python-smoke-test-cli-coverage.xml \ | |
| --ignore tests/test_cli_signing_pkcs11.py \ | |
| tests | |
| - name: Stash coverage report | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: coverage-smoke-tests | |
| path: "pkgs/pyhanko/*-coverage.xml" | |
| codecov-upload: | |
| permissions: | |
| actions: write | |
| contents: read | |
| runs-on: ubuntu-latest | |
| needs: [pytest-coverage,pytest-coverage-p11-pqc,live-integration-tests,smoke-tests,hsm-pkcs11-tests] | |
| steps: | |
| # checkout necessary to ensure the uploaded report contains the correct paths | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Retrieve coverage reports | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| pattern: coverage-* | |
| path: ./reports/ | |
| - name: Upload all coverage reports to Codecov | |
| uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0 | |
| with: | |
| token: ${{ secrets.CODECOV_TOKEN }} | |
| directory: ./reports/ | |
| flags: unittests | |
| env_vars: OS,PYTHON | |
| name: codecov-umbrella | |
| - name: Clean up coverage reports | |
| continue-on-error: true | |
| uses: GeekyEggo/delete-artifact@176a747ab7e287e3ff4787bf8a148716375ca118 # v6.0.0 | |
| with: | |
| name: coverage-* |