gh-action-pypi-publish icon indicating copy to clipboard operation
gh-action-pypi-publish copied to clipboard

Published 20 hours ago • verified publisher icon pypa

Require hashes and wheels for dependencies

Open sethmlarson opened this issue 1 year ago • 4 comments

Including hashes means new files won't be used as candidates during the installation phase. Requiring wheels ensures that source distributions won't be used as candidates, mitigating the potential to "downgrade" to the sdist by deleting the wheel file for a release.

Both of these options together stops an intrusion in a dependency from being able to impact this GitHub Action.

sethmlarson avatar Jul 10 '24 14:07 sethmlarson

@webknjaz could you for now build and upload the docker image, narrowing the window for a compromise and speeding up usage of the action?

graingert avatar Oct 29 '24 19:10 graingert

I've been meaning to merge #230 which will allow this. It seems ready, I just haven't had time to double-check for the last time. I'd like to get to it ASAP.

webknjaz avatar Oct 29 '24 20:10 webknjaz

@graingert publishing to GHCR is now implemented.

webknjaz avatar Nov 05 '24 20:11 webknjaz

@graingert publishing to GHCR is now implemented.

Hooray!

graingert avatar Nov 05 '24 21:11 graingert