Skip to content

Commit 07bb027

Browse files
kohtalakohtala
committed
Use trusted publishing
PyPi releases were not those built in this repository. For better supply chain traceability, use trusted publishing that creates the attestations required. Fixes #1191.
1 parent 2ba8bf6 commit 07bb027

7 files changed

Lines changed: 359 additions & 425 deletions

File tree

‎.github/dependabot.yml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
# Please see the documentation for more information:
2+
# https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-options-reference
3+
4+
version: 2
5+
updates:
6+
# Maintain dependencies for GitHub Actions
7+
- package-ecosystem: github-actions
8+
directory: /
9+
schedule:
10+
interval: weekly
11+
assignees:
12+
- kohtala

‎.github/workflows/build_sdist.yml‎

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
name: Build sdist
2+
3+
on:
4+
pull_request:
5+
branches:
6+
- 4.x
7+
- 5.x
8+
paths-ignore:
9+
- '.github/workflows/build_wheels_*'
10+
- '.github/workflows/release.yml'
11+
workflow_call:
12+
inputs:
13+
rolling:
14+
type: boolean
15+
default: false
16+
workflow_dispatch:
17+
18+
permissions:
19+
contents: read
20+
21+
jobs:
22+
Build_sdist:
23+
runs-on: ubuntu-24.04
24+
strategy:
25+
fail-fast: false
26+
matrix:
27+
python-version: [3.8]
28+
platform: [x64]
29+
with_contrib: [0, 1]
30+
without_gui: [0, 1]
31+
build_sdist: [1]
32+
env:
33+
ACTIONS_ALLOW_UNSECURE_COMMANDS: true
34+
REPO_DIR: .
35+
PROJECT_SPEC: opencv-python
36+
PLAT: x86_64
37+
MB_PYTHON_VERSION: ${{ matrix.python-version }}
38+
TRAVIS_PYTHON_VERSION: ${{ matrix.python-version }}
39+
MB_ML_VER: 2014
40+
NP_TEST_DEP: numpy==1.19.4
41+
TRAVIS_BUILD_DIR: ${{ github.workspace }}
42+
CONFIG_PATH: travis_config.sh
43+
DOCKER_IMAGE: quay.io/opencv-ci/opencv-python-manylinux2014-x86-64:20260102
44+
USE_CCACHE: 1
45+
UNICODE_WIDTH: 32
46+
SDIST: ${{ matrix.build_sdist || 0 }}
47+
ENABLE_HEADLESS: ${{ matrix.without_gui || 0 }}
48+
ENABLE_CONTRIB: ${{ matrix.with_contrib || 0 }}
49+
steps:
50+
- name: Cleanup
51+
run: find . -mindepth 1 -delete
52+
working-directory: ${{ github.workspace }}
53+
- name: Setup environment
54+
if: inputs.rolling == 'true' || github.event_name == 'workflow_dispatch'
55+
run: |
56+
echo "ENABLE_ROLLING=1" >> $GITHUB_ENV
57+
- name: Checkout
58+
uses: actions/checkout@v7
59+
with:
60+
submodules: false
61+
fetch-depth: 0
62+
- name: Set up Python ${{ matrix.python-version }}
63+
uses: actions/setup-python@v7
64+
with:
65+
python-version: ${{ matrix.python-version }}
66+
architecture: ${{ matrix.platform }}
67+
- name: Build a package
68+
run: |
69+
set -e
70+
# Build and package
71+
set -x
72+
python -m pip install --upgrade pip
73+
python -m pip install scikit-build
74+
python setup.py sdist --formats=gztar
75+
set +x
76+
# Install and run tests
77+
set -x
78+
echo "skipping tests because of sdist"
79+
- name: saving artifacts
80+
uses: actions/upload-artifact@v7
81+
with:
82+
name: build-${{ matrix.platform }}-sdist-${{ matrix.with_contrib }}-${{ matrix.without_gui }}-${{ matrix.build_sdist }}
83+
path: dist/opencv*.tar.gz

‎.github/workflows/build_wheels_macos.yml‎

Lines changed: 15 additions & 88 deletions
Original file line numberDiff line numberDiff line change
@@ -9,16 +9,21 @@ on:
99
- '.github/workflows/build_wheels_manylinux*'
1010
- '.github/workflows/build_wheels_windows*'
1111
- '.github/workflows/build_wheels_macos_m1.yml'
12-
release:
13-
types: [published, edited]
14-
schedule:
15-
- cron: '0 3 * * 6'
12+
- '.github/workflows/build_sdist.yml'
13+
- '.github/workflows/release.yml'
14+
workflow_call:
15+
inputs:
16+
rolling:
17+
type: boolean
18+
default: false
1619
workflow_dispatch:
1720

21+
permissions:
22+
contents: read
1823

1924
jobs:
2025
Build:
21-
runs-on: python-macos-intel
26+
runs-on: macos-15-intel
2227
strategy:
2328
fail-fast: false
2429
matrix:
@@ -50,10 +55,9 @@ jobs:
5055
run: find . -mindepth 1 -delete
5156
working-directory: ${{ github.workspace }}
5257
- name: Setup environment
58+
if: inputs.rolling == 'true' || github.event_name == 'workflow_dispatch'
5359
run: |
54-
if [[ "${{ github.event_name }}" == "schedule" || "${{ github.event_name }}" == "workflow_dispatch" ]]; then
55-
echo "ENABLE_ROLLING=1" >> $GITHUB_ENV
56-
fi
60+
echo "ENABLE_ROLLING=1" >> $GITHUB_ENV
5761
- name: Checkout
5862
uses: actions/checkout@v7
5963
with:
@@ -71,12 +75,12 @@ jobs:
7175
- name: Saving a wheel accordingly to matrix
7276
uses: actions/upload-artifact@v7
7377
with:
74-
name: wheel-${{ matrix.with_contrib }}-${{ matrix.without_gui }}-${{ matrix.build_sdist }}
78+
name: build-${{ matrix.platform }}-macos-${{ matrix.with_contrib }}-${{ matrix.without_gui }}-${{ matrix.build_sdist }}
7579
path: wheelhouse/opencv*.whl
7680

7781
Test:
7882
needs: [Build]
79-
runs-on: python-macos-intel
83+
runs-on: macos-26-intel
8084
strategy:
8185
fail-fast: false
8286
matrix:
@@ -107,7 +111,7 @@ jobs:
107111
- name: Download a wheel accordingly to matrix
108112
uses: actions/download-artifact@v8
109113
with:
110-
name: wheel-${{ matrix.with_contrib }}-${{ matrix.without_gui }}-${{ matrix.build_sdist }}
114+
name: build-${{ matrix.platform }}-macos-${{ matrix.with_contrib }}-${{ matrix.without_gui }}-${{ matrix.build_sdist }}
111115
path: wheelhouse/
112116
- name: Create Venv for test
113117
run: |
@@ -131,80 +135,3 @@ jobs:
131135
python${{ matrix.python-version }} -m pip install pylint==2.15.9
132136
cd ${{ github.workspace }}/tests
133137
python${{ matrix.python-version }} -m pylint $PYLINT_TEST_FILE
134-
135-
Release_rolling:
136-
if: ${{ github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' }}
137-
needs: [Build, Test]
138-
runs-on: ubuntu-22.04
139-
environment: opencv-python-rolling-release
140-
defaults:
141-
run:
142-
shell: bash
143-
steps:
144-
- uses: actions/download-artifact@v8
145-
with:
146-
name: wheels
147-
path: wheelhouse/
148-
- name: Upload wheels for opencv_python_rolling
149-
run: |
150-
python -m pip install twine
151-
python -m twine upload -u ${{ secrets.OPENCV_PYTHON_ROLLING_USERNAME }} -p ${{ secrets.OPENCV_PYTHON_ROLLING_PASSWORD }} --skip-existing wheelhouse/wheel-*/opencv_python_rolling-*
152-
- name: Upload wheels for opencv_contrib_python_rolling
153-
run: |
154-
python -m pip install twine
155-
python -m twine upload -u ${{ secrets.OPENCV_CONTRIB_PYTHON_ROLLING_USERNAME }} -p ${{ secrets.OPENCV_CONTRIB_PYTHON_ROLLING_PASSWORD }} --skip-existing wheelhouse/wheel-*/opencv_contrib_python_rolling-*
156-
- name: Upload wheels for opencv_python_headless_rolling
157-
run: |
158-
python -m pip install twine
159-
python -m twine upload -u ${{ secrets.OPENCV_PYTHON_HEADLESS_ROLLING_USERNAME }} -p ${{ secrets.OPENCV_PYTHON_HEADLESS_ROLLING_PASSWORD }} --skip-existing wheelhouse/wheel-*/opencv_python_headless_rolling-*
160-
- name: Upload wheels for opencv_contrib_python_headless_rolling
161-
run: |
162-
python -m pip install twine
163-
python -m twine upload -u ${{ secrets.OPENCV_CONTRIB_PYTHON_HEADLESS_ROLLING_USERNAME }} -p ${{ secrets.OPENCV_CONTRIB_PYTHON_HEADLESS_ROLLING_PASSWORD }} --skip-existing wheelhouse/wheel-*/opencv_contrib_python_headless_rolling-*
164-
165-
Pre-release:
166-
if: github.event_name == 'release' && github.event.release.prerelease
167-
needs: [Build, Test]
168-
runs-on: ubuntu-22.04
169-
environment: test-opencv-python-release
170-
defaults:
171-
run:
172-
shell: bash
173-
steps:
174-
- uses: actions/download-artifact@v8
175-
with:
176-
path: wheelhouse/
177-
- name: Upload all wheels
178-
run: |
179-
tree
180-
python -m pip install twine
181-
python -m twine upload --repository testpypi -u ${{ secrets.PYPI_USERNAME }} -p ${{ secrets.PYPI_PASSWORD }} --skip-existing wheelhouse/wheel-*/opencv_*
182-
183-
Release:
184-
if: github.event_name == 'release' && !github.event.release.prerelease
185-
needs: [Build, Test]
186-
runs-on: ubuntu-22.04
187-
environment: opencv-python-release
188-
defaults:
189-
run:
190-
shell: bash
191-
steps:
192-
- uses: actions/download-artifact@v8
193-
with:
194-
path: wheelhouse/
195-
- name: Upload wheels for opencv_python
196-
run: |
197-
python -m pip install twine
198-
python -m twine upload -u ${{ secrets.OPENCV_PYTHON_USERNAME }} -p ${{ secrets.OPENCV_PYTHON_PASSWORD }} --skip-existing wheelhouse/wheel-*/opencv_python-*
199-
- name: Upload wheels for opencv_contrib_python
200-
run: |
201-
python -m pip install twine
202-
python -m twine upload -u ${{ secrets.OPENCV_CONTRIB_PYTHON_USERNAME }} -p ${{ secrets.OPENCV_CONTRIB_PYTHON_PASSWORD }} --skip-existing wheelhouse/wheel-*/opencv_contrib_python-*
203-
- name: Upload wheels for opencv_python_headless
204-
run: |
205-
python -m pip install twine
206-
python -m twine upload -u ${{ secrets.OPENCV_PYTHON_HEADLESS_USERNAME }} -p ${{ secrets.OPENCV_PYTHON_HEADLESS_PASSWORD }} --skip-existing wheelhouse/wheel-*/opencv_python_headless-*
207-
- name: Upload wheels for opencv_contrib_python_headless
208-
run: |
209-
python -m pip install twine
210-
python -m twine upload -u ${{ secrets.OPENCV_CONTRIB_PYTHON_HEADLESS_USERNAME }} -p ${{ secrets.OPENCV_CONTRIB_PYTHON_HEADLESS_PASSWORD }} --skip-existing wheelhouse/wheel-*/opencv_contrib_python_headless-*

‎.github/workflows/build_wheels_macos_m1.yml‎

Lines changed: 15 additions & 88 deletions
Original file line numberDiff line numberDiff line change
@@ -9,16 +9,21 @@ on:
99
- '.github/workflows/build_wheels_manylinux*'
1010
- '.github/workflows/build_wheels_windows*'
1111
- '.github/workflows/build_wheels_macos.yml'
12-
release:
13-
types: [published, edited]
14-
schedule:
15-
- cron: '0 3 * * 6'
12+
- '.github/workflows/build_sdist.yml'
13+
- '.github/workflows/release.yml'
14+
workflow_call:
15+
inputs:
16+
rolling:
17+
type: boolean
18+
default: false
1619
workflow_dispatch:
1720

21+
permissions:
22+
contents: read
1823

1924
jobs:
2025
Build:
21-
runs-on: python-macos12-m1
26+
runs-on: macos-14
2227
strategy:
2328
fail-fast: false
2429
matrix:
@@ -38,10 +43,9 @@ jobs:
3843
run: find . -mindepth 1 -delete
3944
working-directory: ${{ github.workspace }}
4045
- name: Setup environment
46+
if: inputs.rolling == 'true' || github.event_name == 'workflow_dispatch'
4147
run: |
42-
if [[ "${{ github.event_name }}" == "schedule" || "${{ github.event_name }}" == "workflow_dispatch" ]]; then
43-
echo "ENABLE_ROLLING=1" >> $GITHUB_ENV
44-
fi
48+
echo "ENABLE_ROLLING=1" >> $GITHUB_ENV
4549
- name: Checkout
4650
uses: actions/checkout@v7
4751
with:
@@ -59,12 +63,12 @@ jobs:
5963
- name: Saving a wheel accordingly to matrix
6064
uses: actions/upload-artifact@v7
6165
with:
62-
name: wheel-${{ matrix.with_contrib }}-${{ matrix.without_gui }}-${{ matrix.build_sdist }}
66+
name: build-${{ matrix.platform }}-macos-${{ matrix.with_contrib }}-${{ matrix.without_gui }}-${{ matrix.build_sdist }}
6367
path: wheelhouse/opencv*.whl
6468

6569
Test:
6670
needs: [Build]
67-
runs-on: python-macos12-m1
71+
runs-on: macos-26
6872
strategy:
6973
fail-fast: false
7074
matrix:
@@ -89,7 +93,7 @@ jobs:
8993
- name: Download a wheel accordingly to matrix
9094
uses: actions/download-artifact@v8
9195
with:
92-
name: wheel-${{ matrix.with_contrib }}-${{ matrix.without_gui }}-${{ matrix.build_sdist }}
96+
name: build-${{ matrix.platform }}-macos-${{ matrix.with_contrib }}-${{ matrix.without_gui }}-${{ matrix.build_sdist }}
9397
path: wheelhouse/
9498
- name: Create Venv for test
9599
run: |
@@ -113,80 +117,3 @@ jobs:
113117
python${{ matrix.python-version }} -m pip install pylint==2.15.9
114118
cd ${{ github.workspace }}/tests
115119
python${{ matrix.python-version }} -m pylint $PYLINT_TEST_FILE
116-
117-
Release_rolling:
118-
if: ${{ github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' }}
119-
needs: [Build, Test]
120-
runs-on: ubuntu-22.04
121-
environment: opencv-python-rolling-release
122-
defaults:
123-
run:
124-
shell: bash
125-
steps:
126-
- uses: actions/download-artifact@v8
127-
with:
128-
name: wheels
129-
path: wheelhouse/
130-
- name: Upload wheels for opencv_python_rolling
131-
run: |
132-
python -m pip install twine
133-
python -m twine upload -u ${{ secrets.OPENCV_PYTHON_ROLLING_USERNAME }} -p ${{ secrets.OPENCV_PYTHON_ROLLING_PASSWORD }} --skip-existing wheelhouse/wheel-*/opencv_python_rolling-*
134-
- name: Upload wheels for opencv_contrib_python_rolling
135-
run: |
136-
python -m pip install twine
137-
python -m twine upload -u ${{ secrets.OPENCV_CONTRIB_PYTHON_ROLLING_USERNAME }} -p ${{ secrets.OPENCV_CONTRIB_PYTHON_ROLLING_PASSWORD }} --skip-existing wheelhouse/wheel-*/opencv_contrib_python_rolling-*
138-
- name: Upload wheels for opencv_python_headless_rolling
139-
run: |
140-
python -m pip install twine
141-
python -m twine upload -u ${{ secrets.OPENCV_PYTHON_HEADLESS_ROLLING_USERNAME }} -p ${{ secrets.OPENCV_PYTHON_HEADLESS_ROLLING_PASSWORD }} --skip-existing wheelhouse/wheel-*/opencv_python_headless_rolling-*
142-
- name: Upload wheels for opencv_contrib_python_headless_rolling
143-
run: |
144-
python -m pip install twine
145-
python -m twine upload -u ${{ secrets.OPENCV_CONTRIB_PYTHON_HEADLESS_ROLLING_USERNAME }} -p ${{ secrets.OPENCV_CONTRIB_PYTHON_HEADLESS_ROLLING_PASSWORD }} --skip-existing wheelhouse/wheel-*/opencv_contrib_python_headless_rolling-*
146-
147-
Pre-release:
148-
if: github.event_name == 'release' && github.event.release.prerelease
149-
needs: [Build, Test]
150-
runs-on: ubuntu-22.04
151-
environment: test-opencv-python-release
152-
defaults:
153-
run:
154-
shell: bash
155-
steps:
156-
- uses: actions/download-artifact@v8
157-
with:
158-
path: wheelhouse/
159-
- name: Upload all wheels
160-
run: |
161-
tree
162-
python -m pip install twine
163-
python -m twine upload --repository testpypi -u ${{ secrets.PYPI_USERNAME }} -p ${{ secrets.PYPI_PASSWORD }} --skip-existing wheelhouse/wheel-*/opencv_*
164-
165-
Release:
166-
if: github.event_name == 'release' && !github.event.release.prerelease
167-
needs: [Build, Test]
168-
runs-on: ubuntu-22.04
169-
environment: opencv-python-release
170-
defaults:
171-
run:
172-
shell: bash
173-
steps:
174-
- uses: actions/download-artifact@v8
175-
with:
176-
path: wheelhouse/
177-
- name: Upload wheels for opencv_python
178-
run: |
179-
python -m pip install twine
180-
python -m twine upload -u ${{ secrets.OPENCV_PYTHON_USERNAME }} -p ${{ secrets.OPENCV_PYTHON_PASSWORD }} --skip-existing wheelhouse/wheel-*/opencv_python-*
181-
- name: Upload wheels for opencv_contrib_python
182-
run: |
183-
python -m pip install twine
184-
python -m twine upload -u ${{ secrets.OPENCV_CONTRIB_PYTHON_USERNAME }} -p ${{ secrets.OPENCV_CONTRIB_PYTHON_PASSWORD }} --skip-existing wheelhouse/wheel-*/opencv_contrib_python-*
185-
- name: Upload wheels for opencv_python_headless
186-
run: |
187-
python -m pip install twine
188-
python -m twine upload -u ${{ secrets.OPENCV_PYTHON_HEADLESS_USERNAME }} -p ${{ secrets.OPENCV_PYTHON_HEADLESS_PASSWORD }} --skip-existing wheelhouse/wheel-*/opencv_python_headless-*
189-
- name: Upload wheels for opencv_contrib_python_headless
190-
run: |
191-
python -m pip install twine
192-
python -m twine upload -u ${{ secrets.OPENCV_CONTRIB_PYTHON_HEADLESS_USERNAME }} -p ${{ secrets.OPENCV_CONTRIB_PYTHON_HEADLESS_PASSWORD }} --skip-existing wheelhouse/wheel-*/opencv_contrib_python_headless-*

0 commit comments

Comments
 (0)