.github/workflows/release.yml - master - githubmirror/hackingtool

.github/workflows/release.yml
162 строки6 KB
Hardik Zinzuvadiya
feat: AI operator console — 215 curated tools, AI layer, /find discovery (v2.0.0 rework)
26 июл 2026, 21:48
26 июл 2026, 21:482482cc9
name: release

# Fires when a version tag is pushed (e.g. `git tag v2.0.1 && git push --tags`).
# Jobs are independent: PyPI, GHCR, and the .deb each publish on their own, so a
# hiccup in the secondary .deb channel never blocks the PyPI/container release.
#
# Supply-chain posture (M8):
#   - Third-party actions are pinned to a commit SHA (Dependabot bumps them) so a
#     re-tagged action can't silently change what runs. See .github/dependabot.yml.
#   - Artifacts get SLSA build-provenance + a CycloneDX SBOM attestation, verifiable
#     with `gh attestation verify`.
#   - PyPI upload carries PEP 740 digital attestations automatically (Trusted
#     Publishing + gh-action-pypi-publish).
on:
  push:
    tags: ["v*"]
  workflow_dispatch:

permissions:
  contents: read

jobs:
  build:
    name: Build + SBOM + attest
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write        # sign provenance/SBOM attestations via Sigstore (OIDC)
      attestations: write     # write attestations to the repo's attestation store
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
        with:
          python-version: "3.12"
      - run: python -m pip install --upgrade build twine cyclonedx-bom
      - name: Build sdist + wheel
        run: python -m build
      - name: Validate distributions
        run: twine check dist/*
      - name: Generate CycloneDX SBOM
        # Install the built wheel into a throwaway env and snapshot its real
        # dependency closure (hackingtool + rich + pyyaml + platformdirs + transitives).
        run: |
          python -m venv /tmp/sbomenv
          /tmp/sbomenv/bin/pip install --upgrade pip
          /tmp/sbomenv/bin/pip install dist/*.whl
          mkdir -p sbom
          cyclonedx-py environment /tmp/sbomenv --of JSON -o sbom/hackingtool.cdx.json
      - name: Attest build provenance
        uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2
        with:
          subject-path: "dist/*"
      - name: Attest SBOM
        uses: actions/attest-sbom@bd218ad0dbcb3e146bd073d1d9c6d78e08aa8a0b # v2
        with:
          subject-path: "dist/*.whl"
          sbom-path: "sbom/hackingtool.cdx.json"
      - name: Upload dist
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: dist
          path: dist/
      - name: Upload SBOM
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: sbom
          path: sbom/

  pypi-publish:
    name: Publish to PyPI (trusted publishing)
    needs: build
    runs-on: ubuntu-latest
    # One-time owner setup: on PyPI, add this repo as a Trusted Publisher for the
    # `hackingtool` project (Publishing → Add a pending publisher). No API token
    # or secret is stored — OIDC below authenticates the upload, and PEP 740
    # attestations are generated and published automatically.
    environment:
      name: pypi
      url: https://pypi.org/p/hackingtool
    permissions:
      id-token: write
    steps:
      - name: Download dist
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
        with:
          name: dist
          path: dist/
      - uses: pypa/gh-action-pypi-publish@release/v1   # pinned to a tag: required for Trusted Publishing

  docker:
    name: Build + push image (GHCR)
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write        # push to ghcr.io — authenticates via GITHUB_TOKEN
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
      - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
      - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - id: meta
        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5
        with:
          images: ghcr.io/${{ github.repository }}
          tags: |
            type=semver,pattern={{version}}
            type=raw,value=latest
      - uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
        with:
          context: .
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

  deb:
    name: Build .deb + attach SBOM to release
    needs: build
    runs-on: ubuntu-latest
    permissions:
      contents: write        # attach the .deb + SBOM assets to the GitHub Release
    steps:
      - name: Download dist
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
        with:
          name: dist
          path: dist/
      - name: Download SBOM
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
        with:
          name: sbom
          path: sbom/
      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
        with:
          python-version: "3.12"
      - name: Install fpm
        run: |
          sudo apt-get update
          sudo apt-get install -y ruby ruby-dev build-essential
          sudo gem install --no-document fpm
      - name: Build .deb from the sdist
        run: |
          sdist=$(ls dist/hackingtool-*.tar.gz)
          fpm -s python -t deb \
            --python-bin python3 \
            --python-pip "$(command -v pip3)" \
            --python-package-name-prefix python3 \
            --depends python3 \
            --maintainer "Z4nzu" \
            --license MIT \
            --description "All-in-one hacking tool launcher for security researchers" \
            --url "https://github.com/Z4nzu/hackingtool" \
            "$sdist"
      - uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2
        with:
          files: |
            *.deb
            sbom/hackingtool.cdx.json