From e0f8eda366c7cf08a1c311a17eaaaf87914f8012 Mon Sep 17 00:00:00 2001 From: Glenn Jocher Date: Sun, 8 Dec 2024 18:49:15 +0100 Subject: [PATCH] `ultralytics 8.3.48` split PyPI publish jobs for security (#18111) Signed-off-by: Glenn Jocher --- .github/workflows/publish.yml | 116 ++++++++++++++++++++-------------- ultralytics/__init__.py | 2 +- 2 files changed, 70 insertions(+), 48 deletions(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index c2711aa4..ba736048 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -13,32 +13,23 @@ on: description: Publish to PyPI jobs: - publish: + check: if: github.repository == 'ultralytics/ultralytics' && github.actor == 'glenn-jocher' - name: Publish runs-on: ubuntu-latest - environment: # for GitHub Deployments tab - name: Release - PyPI - url: https://pypi.org/p/ultralytics permissions: - id-token: write # for PyPI trusted publishing + contents: write + outputs: + increment: ${{ steps.check_pypi.outputs.increment }} + current_tag: ${{ steps.check_pypi.outputs.current_tag }} + previous_tag: ${{ steps.check_pypi.outputs.previous_tag }} steps: - - name: Checkout code - uses: actions/checkout@v4 - with: - token: ${{ secrets._GITHUB_TOKEN }} - - name: Git config - run: | - git config --global user.name "UltralyticsAssistant" - git config --global user.email "web@ultralytics.com" - - name: Set up Python environment - uses: actions/setup-python@v5 + - uses: actions/checkout@v4 + - uses: actions/setup-python@v5 with: python-version: "3.x" - uses: astral-sh/setup-uv@v4 - - name: Install dependencies - run: uv pip install --system --no-cache ultralytics-actions build twine toml - - name: Check PyPI version + - run: uv pip install --system --no-cache ultralytics-actions + - id: check_pypi shell: python run: | import os @@ -49,30 +40,63 @@ jobs: os.system(f'echo "previous_tag=v{online_version}" >> $GITHUB_OUTPUT') if publish: print('Ready to publish new version to PyPI ✅.') - id: check_pypi - - name: Build package - if: (github.event_name == 'push' || github.event.inputs.pypi == 'true') && steps.check_pypi.outputs.increment == 'True' - run: python -m build - - name: Publish to PyPI - continue-on-error: true - if: (github.event_name == 'push' || github.event.inputs.pypi == 'true') && steps.check_pypi.outputs.increment == 'True' - uses: pypa/gh-action-pypi-publish@release/v1 - - name: Publish new tag - continue-on-error: true - if: (github.event_name == 'push' || github.event.inputs.pypi == 'true') && steps.check_pypi.outputs.increment == 'True' - run: | - git tag -a "${{ steps.check_pypi.outputs.current_tag }}" -m "$(git log -1 --pretty=%B)" # i.e. "v0.1.2 commit message" - git push origin "${{ steps.check_pypi.outputs.current_tag }}" - - name: Publish new release - continue-on-error: true - if: (github.event_name == 'push' || github.event.inputs.pypi == 'true') && steps.check_pypi.outputs.increment == 'True' + - name: Tag and Release + if: steps.check_pypi.outputs.increment == 'True' env: - OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }} - GITHUB_TOKEN: ${{ secrets._GITHUB_TOKEN }} + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} CURRENT_TAG: ${{ steps.check_pypi.outputs.current_tag }} PREVIOUS_TAG: ${{ steps.check_pypi.outputs.previous_tag }} - run: ultralytics-actions-summarize-release - shell: bash + OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }} + run: | + git config --global user.name "UltralyticsAssistant" + git config --global user.email "web@ultralytics.com" + git tag -a "$CURRENT_TAG" -m "$(git log -1 --pretty=%B)" + git push origin "$CURRENT_TAG" + ultralytics-actions-summarize-release + uv cache prune --ci + + build: + needs: check + if: needs.check.outputs.increment == 'True' + runs-on: ubuntu-latest + permissions: + contents: read + steps: + - uses: actions/checkout@v4 + - uses: actions/setup-python@v5 + with: + python-version: "3.x" + - uses: astral-sh/setup-uv@v4 + - run: uv pip install --system --no-cache build + - run: python -m build + - uses: actions/upload-artifact@v4 + with: + name: dist + path: dist/ + - run: uv cache prune --ci + + publish: + needs: [check, build] + if: needs.check.outputs.increment == 'True' + runs-on: ubuntu-latest + environment: # for GitHub Deployments tab + name: Release - PyPI + url: https://pypi.org/p/ultralytics + permissions: + id-token: write # for PyPI trusted publishing + steps: + - uses: actions/download-artifact@v4 + with: + name: dist + path: dist/ + - uses: pypa/gh-action-pypi-publish@release/v1 + + notify: + needs: [check, publish] + if: always() && needs.check.outputs.increment == 'True' + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 - name: Extract PR Details env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} @@ -82,18 +106,16 @@ jobs: PR_TITLE=$(echo "${PR_JSON}" | jq -r '.title') echo "PR_NUMBER=${PR_NUMBER}" >> "${GITHUB_ENV}" echo "PR_TITLE=${PR_TITLE}" >> "${GITHUB_ENV}" - - name: Prune uv Cache - run: uv cache prune --ci - - name: Notify on Slack (Success) - if: success() && github.event_name == 'push' && steps.check_pypi.outputs.increment == 'True' + - name: Notify Success + if: needs.publish.result == 'success' && github.event_name == 'push' uses: slackapi/slack-github-action@v2.0.0 with: webhook-type: incoming-webhook webhook: ${{ secrets.SLACK_WEBHOOK_URL_YOLO }} payload: | - text: " GitHub Actions success for ${{ github.workflow }} ✅\n\n\n*Repository:* https://github.com/${{ github.repository }}\n*Action:* https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}\n*Author:* ${{ github.actor }}\n*Event:* NEW `${{ github.repository }} ${{ steps.check_pypi.outputs.current_tag }}` pip package published 😃\n*Job Status:* ${{ job.status }}\n*Pull Request:* ${{ env.PR_TITLE }}\n" - - name: Notify on Slack (Failure) - if: failure() + text: " GitHub Actions success for ${{ github.workflow }} ✅\n\n\n*Repository:* https://github.com/${{ github.repository }}\n*Action:* https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}\n*Author:* ${{ github.actor }}\n*Event:* NEW `${{ github.repository }} ${{ needs.check.outputs.current_tag }}` pip package published 😃\n*Job Status:* ${{ job.status }}\n*Pull Request:* ${{ env.PR_TITLE }}\n" + - name: Notify Failure + if: needs.publish.result != 'success' uses: slackapi/slack-github-action@v2.0.0 with: webhook-type: incoming-webhook diff --git a/ultralytics/__init__.py b/ultralytics/__init__.py index bd608b1d..d178a35d 100644 --- a/ultralytics/__init__.py +++ b/ultralytics/__init__.py @@ -1,6 +1,6 @@ # Ultralytics YOLO 🚀, AGPL-3.0 license -__version__ = "8.3.47" +__version__ = "8.3.48" import os