Skip to content

Commit 65b9ec8

Browse files
kohtalakohtala
committed
Use trusted publishing
PyPi releases were not those built in this repository. For better supply chain traceability, use trusted publishing that creates the attestations required. Fixes #1191.
1 parent 2ba8bf6 commit 65b9ec8

7 files changed

Lines changed: 401 additions & 453 deletions

File tree

‎.github/dependabot.yml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
# Please see the documentation for more information:
2+
# https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-options-reference
3+
4+
version: 2
5+
updates:
6+
# Maintain dependencies for GitHub Actions
7+
- package-ecosystem: github-actions
8+
directory: /
9+
schedule:
10+
interval: weekly
11+
assignees:
12+
- kohtala

‎.github/workflows/build_sdist.yml‎

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
name: Build sdist
2+
3+
on:
4+
pull_request:
5+
branches:
6+
- 4.x
7+
- 5.x
8+
paths-ignore:
9+
- '.github/workflows/build_wheels_*'
10+
- '.github/workflows/release.yml'
11+
workflow_call:
12+
inputs:
13+
rolling:
14+
type: boolean
15+
default: false
16+
workflow_dispatch:
17+
18+
permissions:
19+
contents: read
20+
21+
jobs:
22+
Build_sdist:
23+
runs-on: ubuntu-24.04
24+
strategy:
25+
fail-fast: false
26+
matrix:
27+
python-version: [3.8]
28+
platform: [x64]
29+
with_contrib: [0, 1]
30+
without_gui: [0, 1]
31+
build_sdist: [1]
32+
env:
33+
ACTIONS_ALLOW_UNSECURE_COMMANDS: true
34+
REPO_DIR: .
35+
PROJECT_SPEC: opencv-python
36+
PLAT: x86_64
37+
MB_PYTHON_VERSION: ${{ matrix.python-version }}
38+
TRAVIS_PYTHON_VERSION: ${{ matrix.python-version }}
39+
MB_ML_VER: 2014
40+
NP_TEST_DEP: numpy==1.19.4
41+
TRAVIS_BUILD_DIR: ${{ github.workspace }}
42+
CONFIG_PATH: travis_config.sh
43+
DOCKER_IMAGE: quay.io/opencv-ci/opencv-python-manylinux2014-x86-64:20260725@sha256:b31dbd9260993812b011eeea543fe3bad30cd1803dd54963ffd74bb4b7e31f38
44+
USE_CCACHE: 1
45+
UNICODE_WIDTH: 32
46+
SDIST: ${{ matrix.build_sdist || 0 }}
47+
ENABLE_HEADLESS: ${{ matrix.without_gui || 0 }}
48+
ENABLE_CONTRIB: ${{ matrix.with_contrib || 0 }}
49+
steps:
50+
- name: Cleanup
51+
run: find . -mindepth 1 -delete
52+
working-directory: ${{ github.workspace }}
53+
- name: Setup environment
54+
if: inputs.rolling == 'true' || github.event_name == 'workflow_dispatch'
55+
run: |
56+
echo "ENABLE_ROLLING=1" >> $GITHUB_ENV
57+
- name: Checkout
58+
uses: actions/checkout@v7
59+
with:
60+
submodules: false
61+
fetch-depth: 0
62+
- name: Set up Python ${{ matrix.python-version }}
63+
uses: actions/setup-python@v7
64+
with:
65+
python-version: ${{ matrix.python-version }}
66+
architecture: ${{ matrix.platform }}
67+
- name: Build a package
68+
run: |
69+
set -e
70+
# Build and package
71+
set -x
72+
python -m pip install --upgrade pip
73+
python -m pip install scikit-build
74+
python setup.py sdist --formats=gztar
75+
set +x
76+
# Install and run tests
77+
set -x
78+
echo "skipping tests because of sdist"
79+
- name: saving artifacts
80+
uses: actions/upload-artifact@v7
81+
with:
82+
name: build-${{ matrix.platform }}-sdist-${{ matrix.with_contrib }}-${{ matrix.without_gui }}-${{ matrix.build_sdist }}
83+
path: dist/opencv*.tar.gz

‎.github/workflows/build_wheels_macos.yml‎

Lines changed: 34 additions & 100 deletions
Original file line numberDiff line numberDiff line change
@@ -9,16 +9,21 @@ on:
99
- '.github/workflows/build_wheels_manylinux*'
1010
- '.github/workflows/build_wheels_windows*'
1111
- '.github/workflows/build_wheels_macos_m1.yml'
12-
release:
13-
types: [published, edited]
14-
schedule:
15-
- cron: '0 3 * * 6'
12+
- '.github/workflows/build_sdist.yml'
13+
- '.github/workflows/release.yml'
14+
workflow_call:
15+
inputs:
16+
rolling:
17+
type: boolean
18+
default: false
1619
workflow_dispatch:
1720

21+
permissions:
22+
contents: read
1823

1924
jobs:
2025
Build:
21-
runs-on: python-macos-intel
26+
runs-on: macos-15-intel
2227
strategy:
2328
fail-fast: false
2429
matrix:
@@ -46,37 +51,38 @@ jobs:
4651
ENABLE_CONTRIB: ${{ matrix.with_contrib }}
4752
PIP_INDEX_URL: https://pypi.tuna.tsinghua.edu.cn/simple
4853
steps:
49-
- name: Cleanup
50-
run: find . -mindepth 1 -delete
51-
working-directory: ${{ github.workspace }}
5254
- name: Setup environment
55+
if: inputs.rolling == 'true' || github.event_name == 'workflow_dispatch'
5356
run: |
54-
if [[ "${{ github.event_name }}" == "schedule" || "${{ github.event_name }}" == "workflow_dispatch" ]]; then
55-
echo "ENABLE_ROLLING=1" >> $GITHUB_ENV
56-
fi
57+
echo "ENABLE_ROLLING=1" >> $GITHUB_ENV
5758
- name: Checkout
5859
uses: actions/checkout@v7
5960
with:
6061
submodules: false
6162
fetch-depth: 0
63+
- name: Set up Python ${{ matrix.python-version }}
64+
uses: actions/setup-python@v7
65+
with:
66+
python-version: ${{ matrix.python-version }}
67+
architecture: ${{ matrix.platform }}
6268
- name: Build a package
6369
run: |
6470
git submodule update --init multibuild
6571
echo $ENABLE_CONTRIB > contrib.enabled
6672
echo $ENABLE_HEADLESS > headless.enabled
6773
export MACOSX_DEPLOYMENT_TARGET=14.0
68-
python${{ matrix.python-version }} -m pip install toml && python${{ matrix.python-version }} -c 'import toml; c = toml.load("pyproject.toml"); print("\n".join(c["build-system"]["requires"]))' | python${{ matrix.python-version }} -m pip install -r /dev/stdin
69-
python${{ matrix.python-version }} setup.py bdist_wheel --py-limited-api=cp37 --dist-dir=wheelhouse -v
74+
python -m pip install toml && python -c 'import toml; c = toml.load("pyproject.toml"); print("\n".join(c["build-system"]["requires"]))' | python -m pip install -r /dev/stdin
75+
python setup.py bdist_wheel --py-limited-api=cp37 --dist-dir=wheelhouse -v
7076
delocate-wheel ${{ github.workspace }}/wheelhouse/opencv*
7177
- name: Saving a wheel accordingly to matrix
7278
uses: actions/upload-artifact@v7
7379
with:
74-
name: wheel-${{ matrix.with_contrib }}-${{ matrix.without_gui }}-${{ matrix.build_sdist }}
80+
name: build-${{ matrix.platform }}-macos-${{ matrix.with_contrib }}-${{ matrix.without_gui }}-${{ matrix.build_sdist }}
7581
path: wheelhouse/opencv*.whl
7682

7783
Test:
7884
needs: [Build]
79-
runs-on: python-macos-intel
85+
runs-on: macos-26-intel
8086
strategy:
8187
fail-fast: false
8288
matrix:
@@ -107,104 +113,32 @@ jobs:
107113
- name: Download a wheel accordingly to matrix
108114
uses: actions/download-artifact@v8
109115
with:
110-
name: wheel-${{ matrix.with_contrib }}-${{ matrix.without_gui }}-${{ matrix.build_sdist }}
116+
name: build-${{ matrix.platform }}-macos-${{ matrix.with_contrib }}-${{ matrix.without_gui }}-${{ matrix.build_sdist }}
111117
path: wheelhouse/
118+
- name: Set up Python ${{ matrix.python-version }}
119+
uses: actions/setup-python@v7
120+
with:
121+
python-version: ${{ matrix.python-version }}
122+
architecture: ${{ matrix.platform }}
112123
- name: Create Venv for test
113124
run: |
114125
test -d "${{ github.workspace }}/opencv_test" && rm -rf "${{ github.workspace }}/opencv_test"
115-
python${{ matrix.python-version }} -m venv ${{ github.workspace }}/opencv_test
126+
python -m venv ${{ github.workspace }}/opencv_test
116127
- name: Package installation
117128
run: |
118129
source ${{ github.workspace }}/opencv_test/bin/activate
119-
python${{ matrix.python-version }} -m pip install --upgrade pip
120-
python${{ matrix.python-version }} -m pip install --no-cache --force-reinstall wheelhouse/opencv*.whl
130+
python -m pip install --upgrade pip
131+
python -m pip install --no-cache --force-reinstall wheelhouse/opencv*.whl
121132
cd ${{ github.workspace }}/tests
122-
python${{ matrix.python-version }} get_build_info.py
133+
python get_build_info.py
123134
- name: Run tests
124135
run: |
125136
source ${{ github.workspace }}/opencv_test/bin/activate
126137
cd ${{ github.workspace }}/opencv
127-
python${{ matrix.python-version }} modules/python/test/test.py -v --repo .
138+
python modules/python/test/test.py -v --repo .
128139
- name: Pylint test
129140
run: |
130141
source ${{ github.workspace }}/opencv_test/bin/activate
131-
python${{ matrix.python-version }} -m pip install pylint==2.15.9
142+
python -m pip install pylint==2.15.9
132143
cd ${{ github.workspace }}/tests
133-
python${{ matrix.python-version }} -m pylint $PYLINT_TEST_FILE
134-
135-
Release_rolling:
136-
if: ${{ github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' }}
137-
needs: [Build, Test]
138-
runs-on: ubuntu-22.04
139-
environment: opencv-python-rolling-release
140-
defaults:
141-
run:
142-
shell: bash
143-
steps:
144-
- uses: actions/download-artifact@v8
145-
with:
146-
name: wheels
147-
path: wheelhouse/
148-
- name: Upload wheels for opencv_python_rolling
149-
run: |
150-
python -m pip install twine
151-
python -m twine upload -u ${{ secrets.OPENCV_PYTHON_ROLLING_USERNAME }} -p ${{ secrets.OPENCV_PYTHON_ROLLING_PASSWORD }} --skip-existing wheelhouse/wheel-*/opencv_python_rolling-*
152-
- name: Upload wheels for opencv_contrib_python_rolling
153-
run: |
154-
python -m pip install twine
155-
python -m twine upload -u ${{ secrets.OPENCV_CONTRIB_PYTHON_ROLLING_USERNAME }} -p ${{ secrets.OPENCV_CONTRIB_PYTHON_ROLLING_PASSWORD }} --skip-existing wheelhouse/wheel-*/opencv_contrib_python_rolling-*
156-
- name: Upload wheels for opencv_python_headless_rolling
157-
run: |
158-
python -m pip install twine
159-
python -m twine upload -u ${{ secrets.OPENCV_PYTHON_HEADLESS_ROLLING_USERNAME }} -p ${{ secrets.OPENCV_PYTHON_HEADLESS_ROLLING_PASSWORD }} --skip-existing wheelhouse/wheel-*/opencv_python_headless_rolling-*
160-
- name: Upload wheels for opencv_contrib_python_headless_rolling
161-
run: |
162-
python -m pip install twine
163-
python -m twine upload -u ${{ secrets.OPENCV_CONTRIB_PYTHON_HEADLESS_ROLLING_USERNAME }} -p ${{ secrets.OPENCV_CONTRIB_PYTHON_HEADLESS_ROLLING_PASSWORD }} --skip-existing wheelhouse/wheel-*/opencv_contrib_python_headless_rolling-*
164-
165-
Pre-release:
166-
if: github.event_name == 'release' && github.event.release.prerelease
167-
needs: [Build, Test]
168-
runs-on: ubuntu-22.04
169-
environment: test-opencv-python-release
170-
defaults:
171-
run:
172-
shell: bash
173-
steps:
174-
- uses: actions/download-artifact@v8
175-
with:
176-
path: wheelhouse/
177-
- name: Upload all wheels
178-
run: |
179-
tree
180-
python -m pip install twine
181-
python -m twine upload --repository testpypi -u ${{ secrets.PYPI_USERNAME }} -p ${{ secrets.PYPI_PASSWORD }} --skip-existing wheelhouse/wheel-*/opencv_*
182-
183-
Release:
184-
if: github.event_name == 'release' && !github.event.release.prerelease
185-
needs: [Build, Test]
186-
runs-on: ubuntu-22.04
187-
environment: opencv-python-release
188-
defaults:
189-
run:
190-
shell: bash
191-
steps:
192-
- uses: actions/download-artifact@v8
193-
with:
194-
path: wheelhouse/
195-
- name: Upload wheels for opencv_python
196-
run: |
197-
python -m pip install twine
198-
python -m twine upload -u ${{ secrets.OPENCV_PYTHON_USERNAME }} -p ${{ secrets.OPENCV_PYTHON_PASSWORD }} --skip-existing wheelhouse/wheel-*/opencv_python-*
199-
- name: Upload wheels for opencv_contrib_python
200-
run: |
201-
python -m pip install twine
202-
python -m twine upload -u ${{ secrets.OPENCV_CONTRIB_PYTHON_USERNAME }} -p ${{ secrets.OPENCV_CONTRIB_PYTHON_PASSWORD }} --skip-existing wheelhouse/wheel-*/opencv_contrib_python-*
203-
- name: Upload wheels for opencv_python_headless
204-
run: |
205-
python -m pip install twine
206-
python -m twine upload -u ${{ secrets.OPENCV_PYTHON_HEADLESS_USERNAME }} -p ${{ secrets.OPENCV_PYTHON_HEADLESS_PASSWORD }} --skip-existing wheelhouse/wheel-*/opencv_python_headless-*
207-
- name: Upload wheels for opencv_contrib_python_headless
208-
run: |
209-
python -m pip install twine
210-
python -m twine upload -u ${{ secrets.OPENCV_CONTRIB_PYTHON_HEADLESS_USERNAME }} -p ${{ secrets.OPENCV_CONTRIB_PYTHON_HEADLESS_PASSWORD }} --skip-existing wheelhouse/wheel-*/opencv_contrib_python_headless-*
144+
python -m pylint $PYLINT_TEST_FILE

0 commit comments

Comments
 (0)