Sourced fromactions/attest-build-provenance's releases.

v2.1.0

What's Changed

• Update README w/ note about GH plans supporting attestations by@​bdehamer inactions/attest-build-provenance#414
• Addattestation-id andattestation-url outputs by@​bdehamer inactions/attest-build-provenance#415

Full Changelog:actions/attest-build-provenance@v2.0.1...v2.1.0

v2.0.1

What's Changed

• Bump actions/attest from 2.0.0 to 2.0.1 by@​bdehamer inactions/attest-build-provenance#406
  • Deduplicate subjects before adding to in-toto statement

Full Changelog:actions/attest-build-provenance@v2.0.0...v2.0.1

v2.0.0

Theattest-build-provenance action now supports attesting multiple subjects simultaneously. When identifying multiple subjects with thesubject-path input a single attestation is created with references to each of the supplied subjects, rather than generating separate attestations for each artifact. This reduces the number of attestations that you need to create and manage.

What's Changed

• Bump cross-spawn from 7.0.3 to 7.0.6 by@​dependabot inactions/attest-build-provenance#319
• Prepare v2.0.0 release by@​bdehamer inactions/attest-build-provenance#321
  • Bumpactions/attest from 1.4.1 to 2.0.0 (w/ multi-subject attestation support)

Full Changelog:actions/attest-build-provenance@v1.4.4...v2.0.0

• 7668571 add attestation-id and attestation-url outputs (#415)
• 9ad33ff add note about gh plans supporting attestations (#414)
• f2f0851 Bump the npm-development group with 2 updates (#412)
• c4fbc64 bump actions/attest from 2.0.0 to 2.0.1 (#406)
• 619dbb2 bump actions/attest to v2.0.0 (#321)
• 90d4930 Bump the npm-development group with 3 updates (#329)
• fb315c1 Bump the npm-development group with 5 updates (#323)
• a379071 Bump cross-spawn from 7.0.3 to 7.0.6 (#319)
• dada0c3 Bump the npm-development group across 1 directory with 5 updates (#317)
• See full diff incompare view

Sourced frompypa/gh-action-pypi-publish's releases.

v1.12.3

✨ What's Improved

With the updates by@​woodruffw💰 and@​webknjaz💰 via#309 and#313, it is now possible to publishdistribution packages that includecore metadata v2.4, like those built usingmaturin. This is done by bumpingTwine to v6.0.1 andpkginfo to v1.12.0.

📝 Docs

We've made an attempt to clarify the runtime and workflow shape that are expected to be supported for calling this action in:https://github.com/marketplace/actions/pypi-publish#Non-goals.

[!TIP]Please, let us know in therelease discussion if anything still remains unclear.TL;DR always callpypi-publish once per job; don't invoke it in reusable workflows; physically move building the dists into separate jobs having restricted permissions and storing the dists as GitHub Actions artifacts; when using self-hosted runners, make sure to still usepypi-publish on a GitHub-provided infra withruns-on: ubuntu-latest, while building and testing may remain self-hosted; don't perform any other actions in the publishing job; don't callpypi-publish from composite actions.

🛠️ Internal Updates

@​br3ndonland💰 improved the container image generation automation to include Git SHA in#301. And@​woodruffw💰 added theworkflow_ref context to Trusted Publishing debug logging in#305, helping us diagnose misconfigurations faster.#313 also extends the smoke test in the CI to check against thematurin-made dists. Additionally,jeepney andsecretstorage transitive deps have been added to the pip constraint-based lock file, as Dependabot seems to have missed those earlier.

🪞 Full Diff:pypa/gh-action-pypi-publish@v1.12.2...v1.12.3

🧔‍♂️ Release Manager:@​webknjaz🇺🇦

🙏 Special Thanks to@​samuelcolvin💰 for nudging me to cut this release sooner and forsponsoring me via@​pydantic💰!

🔌 Shameless Plug: The other day I've made this🦋 Bluesky 🇺🇦 FOSS Maintainers Starter Pack subscribe to read news from people like me :)

💬 Discusson Bluesky 🦋,on Mastodon 🐘 andon GitHub.

• 67339c7 📦 Only keep lower bounds @ input requirements
• cbd6d01 📝Fix a typo in "privileges" @ README
• 7252a9a 📝 Outline unsupported scenarios in README
• a536fa9 📌📦 Include jeepney & secretstorage pins
• 43caae4 💅📦 Split transitive dep constraints
• f371c3d Merge pull request#313 from webknjaz/maintenance/metadata-2.4
• 138a121 📌📦 Pinpkginfo to v1.12 @ runtime deps
• ff2b051 🧪 Add a Maturin-based package to CI
• 0a0a6ae 🧪 Allow CI to register multiple distributions
• e7723a4 Merge pull request#309 from trail-of-forks/ww/bumptwine
• Additional commits viewable incompare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions