c940f75d5b
Restrict the GitHub token permissions only to the required ones; this way, even if the attackers will succeed in compromising your workflow, they won’t be able to do much. - Included permissions for the action. https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions https://docs.github.com/en/actions/using-jobs/assigning-permissions-to-jobs [Keeping your GitHub Actions and workflows secure Part 1: Preventing pwn requests](https://securitylab.github.com/research/github-actions-preventing-pwn-requests/) Signed-off-by: naveen <172697+naveensrinivasan@users.noreply.github.com>
60 lines
1.7 KiB
YAML
60 lines
1.7 KiB
YAML
name: Upload self-contained binaries
|
|
|
|
on:
|
|
release:
|
|
types: [published]
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
build:
|
|
permissions:
|
|
contents: write # for actions/upload-release-asset to upload release asset
|
|
runs-on: ${{ matrix.os }}
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
os: [windows-2019, ubuntu-20.04, macos-latest]
|
|
include:
|
|
- os: windows-2019
|
|
pathsep: ";"
|
|
asset_name: black_windows.exe
|
|
executable_mime: "application/vnd.microsoft.portable-executable"
|
|
- os: ubuntu-20.04
|
|
pathsep: ":"
|
|
asset_name: black_linux
|
|
executable_mime: "application/x-executable"
|
|
- os: macos-latest
|
|
pathsep: ":"
|
|
asset_name: black_macos
|
|
executable_mime: "application/x-mach-binary"
|
|
|
|
steps:
|
|
- uses: actions/checkout@v3
|
|
|
|
- name: Set up latest Python
|
|
uses: actions/setup-python@v3
|
|
with:
|
|
python-version: "*"
|
|
|
|
- name: Install dependencies
|
|
run: |
|
|
python -m pip install --upgrade pip wheel setuptools
|
|
python -m pip install .
|
|
python -m pip install pyinstaller
|
|
|
|
- name: Build binary
|
|
run: |
|
|
python -m PyInstaller -F --name ${{ matrix.asset_name }} --add-data 'src/blib2to3${{ matrix.pathsep }}blib2to3' src/black/__main__.py
|
|
|
|
- name: Upload binary as release asset
|
|
uses: actions/upload-release-asset@v1
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
with:
|
|
upload_url: ${{ github.event.release.upload_url }}
|
|
asset_path: dist/${{ matrix.asset_name }}
|
|
asset_name: ${{ matrix.asset_name }}
|
|
asset_content_type: ${{ matrix.executable_mime }}
|