👷 ci: Add new feature for trusted publisher

.github/scripts/release-pr.sh

@@ -19,7 +19,7 @@ major=$(echo $new_sdk_version | cut -d '.' -f 1)
 branch_name="autobuild-$new_sdk_version"
 
 # https://docs.github.com/en/free-pro-team@latest/rest/reference/pulls#create-a-pull-request
-result=$(curl -s -X POST -H "Authorization: token $GH_TOKEN" -d "{\"head\":\"$branch_name\",\"base\":\"master\",\"title\":\"SDK v$new_sdk_version\",\"body\":\"Automatic build of SDK v$new_sdk_version version based on Outscale API $osc_api_version\"}" "https://api.github.com/repos/outscale/osc-sdk-python/pulls")
+result=$(curl -s -X POST -H "Authorization: token $GH_TOKEN" -d "{\"head\":\"$branch_name\",\"base\":\"main\",\"title\":\"SDK v$new_sdk_version\",\"body\":\"Automatic build of SDK v$new_sdk_version version based on Outscale API $osc_api_version\"}" "https://api.github.com/repos/outscale/osc-sdk-python/pulls")
 
 errors=$(echo $result | jq .errors)
 

.github/workflows/build.yml

@@ -9,9 +9,9 @@ on:
 jobs:
   auto-build:
     environment: auto-build
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
     - name: ⬇️ Install Python
       uses: actions/setup-python@v5
       with:

.github/workflows/code-check-identified.yml

@@ -3,7 +3,7 @@ name: Code check On outscale
 on:
   pull_request:
     branches:
-      - master
+      - main
 
 permissions:
   pull-requests: write
@@ -20,7 +20,7 @@ jobs:
         secret_key: ${{ secrets.OSC_SECRET_KEY }}
         region: ${{ secrets.OSC_REGION }}
     - name: ⬇️ Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@v5
     - name: ⬇️ Import Outscale API description
       run: make init
     - name: ⬇️ Install Python

.github/workflows/code-check.yml

@@ -3,26 +3,26 @@
 on:
   pull_request:
     branches:
-      - master
+      - main
 
 jobs:
   code-check:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
     - name: Import Outscale API description
       run: make init
     - name: Install Python
       uses: actions/setup-python@v5
       with:
         python-version: '3.x'
     - name: Install Python dependencies
       run: make .venv/ok
     - name: Analysing the code with pylint
       run: make test-pylint
     - name: Security check - Bandit
       run: make test-bandit
     - name: Build python package
       run: make package
     - name: Run integration tests
       run: ./local-tests.sh

.github/workflows/codeql.yml

@@ -2,11 +2,11 @@ name: "CodeQL"
 
 on:
   push:
-    branches: [ "master" ]
+    branches: [ "main" ]
   pull_request:
-    branches: [ "master" ]
+    branches: [ "main" ]
   schedule:
-    - cron: "33 13 * * 5"
+    - cron: "37 13 * * 5"
 
 jobs:
   analyze:
@@ -20,11 +20,13 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        language: [ python ]
+        include:
+          - language: python
+          - language: actions
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@v2

.github/workflows/cred-scan.yml

@@ -2,14 +2,17 @@
 
 on:
   pull_request:
-    branches: [ master ]
+    branches: [ main ]
+
+permissions:
+  contents: read
 
 jobs:
   cred-scan:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
     - name: Scan credentials
-      uses: outscale-dev/cred-scan@main
+      uses: outscale/cred-scan@main
       with:
         scan_path: "./"

.github/workflows/github-sanity-scan.yml

@@ -2,13 +2,16 @@ name: Github sanity scanner
 
 on:
   pull_request:
-    branches: [ master ]
+    branches: [ main ]
+
+permissions:
+  contents: read
 
 jobs:
   github-sanity-scan:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
     - name: Github sanity scanner
       uses: outscale/github-sanity-scan@main
       with:

.github/workflows/publish.yml

@@ -1,21 +1,25 @@
 name: osc-sdk-python pip publishing
+
 on:
   release:
     types: [released]
 
+permissions:
+  contents: read
+  id-token: write
+
 jobs:
-  publish:
+  build:
+    runs-on: ubuntu-24.04
     environment: publish
-    runs-on: ubuntu-22.04
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
     - name: Set up Python
       uses: actions/setup-python@v5
       with:
         python-version: '3.x'
     - name: Initialize submodules
       run: make init
-    - name: Build & Push packages
-      run: make upload-package
-      env:
-        PIP_TOKEN: ${{ secrets.PIP_TOKEN }}
+    - name: Build packages
+      run: make package
+    - uses: pypa/gh-action-pypi-publish@release/v1

Makefile

@@ -31,10 +31,6 @@ test-int: .venv/ok init
 package: .venv/ok init
 	@./scripts/package.sh
 
-.PHONY: upload-package
-upload-package: package
-	@./scripts/upload_package.sh
-
 .PHONY: osc-api-update
 osc-api-update:
 	cd osc_sdk_python/osc-api/; git fetch; git checkout origin/master; cd ..; git add osc-api