Merge pull request #1843 from rmartin16/attest-package

Use new create package action with attestation

.github/workflows/ci.yml

@@ -5,6 +5,11 @@ on:
     branches:
       - main
   workflow_call:
+    inputs:
+      attest-package:
+        description: "Create GitHub provenance attestation for the package."
+        default: "false"
+        type: string
     outputs:
       artifact-name:
         description: "Name of the uploaded artifact; use for artifact retrieval."
@@ -32,10 +37,24 @@ jobs:
     uses: beeware/.github/.github/workflows/towncrier-run.yml@main
 
   package:
-    name: Python package
+    name: Package Briefcase
+    permissions:
+      id-token: write
+      contents: read
+      attestations: write
     uses: beeware/.github/.github/workflows/python-package-create.yml@main
     with:
-      tox-factors: -with-automation
+      attest: ${{ inputs.attest-package }}
+
+  package-automation:
+    name: Package Automation
+    permissions:
+      id-token: write
+      contents: read
+      attestations: write
+    uses: beeware/.github/.github/workflows/python-package-create.yml@main
+    with:
+      build-subdirectory: "automation"
 
   unit-tests:
     name: Unit tests
@@ -160,7 +179,7 @@ jobs:
 
   verify-projects:
     name: Verify project
-    needs: unit-tests
+    needs: [ package, package-automation, unit-tests ]
     uses: beeware/.github/.github/workflows/app-create-verify.yml@main
     with:
       runner-os: ${{ matrix.runner-os }}
@@ -173,7 +192,7 @@ jobs:
 
   verify-apps:
     name: Build app
-    needs: unit-tests
+    needs: [ package, package-automation, unit-tests ]
     uses: beeware/.github/.github/workflows/app-build-verify.yml@main
     with:
       # This *must* be the version of Python that is the system Python on the

.github/workflows/release.yml

@@ -9,6 +9,8 @@ jobs:
   ci:
     name: CI
     uses: ./.github/workflows/ci.yml
+    with:
+      attest-package: "true"
 
   docs:
     name: Verify Docs Build
@@ -29,7 +31,7 @@ jobs:
     steps:
       - name: Set build variables
         run: |
-          echo "VERSION=${GITHUB_REF_NAME#v}" >> $GITHUB_ENV
+          echo "VERSION=${GITHUB_REF_NAME#v}" | tee -a $GITHUB_ENV
 
       - name: Set up Python
         uses: actions/setup-python@v5.1.0

changes/1843.misc.rst

@@ -0,0 +1 @@
+``hynek/build-and-inspect-python-package`` is now used to create the Python package.

tox.ini

@@ -122,14 +122,3 @@ commands =
     lint : python -m sphinx {[docs]sphinx_args} {posargs} -b linkcheck {[docs]docs_dir} {[docs]build_dir}{/}links
     all  : python -m sphinx {[docs]sphinx_args} {posargs} -v -a -E -b html {[docs]docs_dir} {[docs]build_dir}{/}html
     live : sphinx-autobuild {[docs]sphinx_args} {posargs} -b html {[docs]docs_dir} {[docs]build_dir}{/}live
-
-[testenv:package{,-with-automation}]
-skip_install = True
-passenv = FORCE_COLOR
-deps =
-    build==1.2.1
-    twine==5.1.0
-commands =
-    python -m build . --outdir dist{/}
-    with-automation: python -m build automation --outdir dist{/}
-    python -m twine check dist{/}*