Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Replace third party action in release process #176

Open
cmsirbu opened this issue Sep 24, 2024 · 1 comment
Open

Replace third party action in release process #176

cmsirbu opened this issue Sep 24, 2024 · 1 comment

Comments

@cmsirbu
Copy link
Contributor

cmsirbu commented Sep 24, 2024

The action svenstaro/upload-release-action is used to upload the wheels into the GH release. Using actions from third-parties is a security concern when tokens with write permissions are involved.

Release files can be uploaded using github tooling as follows:

      - run: "gh release upload ${{ github.event.release.tag_name }} dist/*.{tar.gz,whl}"
        env:
          GH_TOKEN: "${{ github.token }}"

The code above should be adapted and tested in nautobot-app-dev-example with the updated release checklist steps.

@bryanculver
Copy link
Member

DoD

  • Update the GHA workflow in Dev Example
  • Test by cutting a release in Dev Example (preferably a pre-release if possible)
  • Ensure the attached file are the same with the previous pattern (as in the same available wheels, zips, etc)
  • Backport the change to Cookiecutter once the implementation is validated

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants