Skip to content

Commit 1993c3d

Browse files
jmgatejmgate
committed
ci: Ensure SSH client is installed
It's needed by the Semantic Release workflow to sign the releases. I'm not sure why this step wasn't needed in the past, but within the past week the Semantic Release job has failed intermittently, meaning certain runners using ubuntu-latest have it installed, while others do not.
1 parent fab662e commit 1993c3d

File tree

1 file changed

+68
-65
lines changed

1 file changed

+68
-65
lines changed

‎.github/workflows/semantic-release.yml‎

Lines changed: 68 additions & 65 deletions
Original file line numberDiff line numberDiff line change
@@ -19,39 +19,42 @@ jobs:
1919
id-token: write
2020

2121
steps:
22-
- name: Harden Runner
23-
uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
24-
with:
25-
egress-policy: audit
26-
27-
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
28-
with:
29-
fetch-depth: 0
30-
token: ${{ secrets.GH_TOKEN }}
31-
32-
- name: Python Semantic Release
33-
id: release
34-
uses: python-semantic-release/python-semantic-release@eb841f9a95650921ff7e7fc94208b6560366a854 # v10.5.0
35-
with:
36-
git_committer_email: "reverse-argparse-semantic-release@sandia.gov"
37-
git_committer_name: "semantic-release"
38-
github_token: ${{ secrets.GH_TOKEN }}
39-
ssh_private_signing_key: ${{ secrets.SEMANTIC_RELEASE_PRIVATE_KEY }}
40-
ssh_public_signing_key: ${{ secrets.SEMANTIC_RELEASE_PUBLIC_KEY }}
41-
42-
- name: Hash Build Artifacts
43-
if: steps.release.outputs.released == 'true'
44-
id: hash
45-
run: |
46-
cd dist
47-
echo "hashes=$(find . -type f -exec sha256sum {} + | sort | base64 | tr -d '\n')" >> "$GITHUB_OUTPUT"
48-
49-
- name: Upload Build Artifacts
50-
if: steps.release.outputs.released == 'true'
51-
uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
52-
with:
53-
name: dist
54-
path: dist/
22+
- name: Harden Runner
23+
uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
24+
with:
25+
egress-policy: audit
26+
27+
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
28+
with:
29+
fetch-depth: 0
30+
token: ${{ secrets.GH_TOKEN }}
31+
32+
- name: Install openssh-client
33+
run: sudo apt-get update && sudo apt-get install -y openssh-client
34+
35+
- name: Python Semantic Release
36+
id: release
37+
uses: python-semantic-release/python-semantic-release@eb841f9a95650921ff7e7fc94208b6560366a854 # v10.5.0
38+
with:
39+
git_committer_email: "reverse-argparse-semantic-release@sandia.gov"
40+
git_committer_name: "semantic-release"
41+
github_token: ${{ secrets.GH_TOKEN }}
42+
ssh_private_signing_key: ${{ secrets.SEMANTIC_RELEASE_PRIVATE_KEY }}
43+
ssh_public_signing_key: ${{ secrets.SEMANTIC_RELEASE_PUBLIC_KEY }}
44+
45+
- name: Hash Build Artifacts
46+
if: steps.release.outputs.released == 'true'
47+
id: hash
48+
run: |
49+
cd dist
50+
echo "hashes=$(find . -type f -exec sha256sum {} + | sort | base64 | tr -d '\n')" >> "$GITHUB_OUTPUT"
51+
52+
- name: Upload Build Artifacts
53+
if: steps.release.outputs.released == 'true'
54+
uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
55+
with:
56+
name: dist
57+
path: dist/
5558

5659
outputs:
5760
hashes: ${{ steps.hash.outputs.hashes }}
@@ -77,35 +80,35 @@ jobs:
7780
id-token: write
7881

7982
steps:
80-
- name: Harden Runner
81-
uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
82-
with:
83-
egress-policy: audit
84-
85-
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
86-
with:
87-
fetch-depth: 0
88-
token: ${{ secrets.GH_TOKEN }}
89-
90-
- name: Download Build Artifacts
91-
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
92-
with:
93-
name: dist
94-
path: dist
95-
96-
- name: Download Provenance
97-
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
98-
with:
99-
name: ${{ needs.provenance.outputs.provenance-name }}
100-
path: dist
101-
102-
- name: Publish to GitHub Releases
103-
uses: python-semantic-release/publish-action@ae6462adc12bd3d1738070d784b65b5189b955a9 # v10.4.1
104-
with:
105-
github_token: ${{ secrets.GH_TOKEN }}
106-
107-
- name: Remove Provenance for PyPI Upload
108-
run: rm -f dist/${{ needs.provenance.outputs.provenance-name }}
109-
110-
- name: Publish to PyPI
111-
uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # release/v1
83+
- name: Harden Runner
84+
uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
85+
with:
86+
egress-policy: audit
87+
88+
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
89+
with:
90+
fetch-depth: 0
91+
token: ${{ secrets.GH_TOKEN }}
92+
93+
- name: Download Build Artifacts
94+
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
95+
with:
96+
name: dist
97+
path: dist
98+
99+
- name: Download Provenance
100+
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
101+
with:
102+
name: ${{ needs.provenance.outputs.provenance-name }}
103+
path: dist
104+
105+
- name: Publish to GitHub Releases
106+
uses: python-semantic-release/publish-action@ae6462adc12bd3d1738070d784b65b5189b955a9 # v10.4.1
107+
with:
108+
github_token: ${{ secrets.GH_TOKEN }}
109+
110+
- name: Remove Provenance for PyPI Upload
111+
run: rm -f dist/${{ needs.provenance.outputs.provenance-name }}
112+
113+
- name: Publish to PyPI
114+
uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # release/v1

0 commit comments

Comments
 (0)