From c3c39905ab7ebfbd63ea024b8076c19f53192166 Mon Sep 17 00:00:00 2001 From: "jjliu@ubuntu.home" Date: Sun, 25 Oct 2026 12:42:58 +0800 Subject: [PATCH] fix(release): restrict checksums to published artifacts (#548) Closes #548 --- .github/workflows/publish.yml | 9 ++++++--- tests/scripts/test_script_health_contract.py | 3 +++ 2 files changed, 9 insertions(+), 3 deletions(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 2c0eb361..1eff9bd7 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -141,9 +141,12 @@ jobs: dist_dir = Path("dist") assets = sorted( - path - for path in dist_dir.iterdir() - if path.is_file() and path.name != "SHA256SUMS" + ( + *dist_dir.glob("*.whl"), + *dist_dir.glob("*.tar.gz"), + *dist_dir.glob("*.cdx.json"), + ), + key=lambda path: path.name, ) lines = [ f"{hashlib.sha256(asset.read_bytes()).hexdigest()} {asset.name}" diff --git a/tests/scripts/test_script_health_contract.py b/tests/scripts/test_script_health_contract.py index 59fd8570..c474dbe6 100644 --- a/tests/scripts/test_script_health_contract.py +++ b/tests/scripts/test_script_health_contract.py @@ -287,6 +287,9 @@ def test_release_workflow_separates_privileged_publish_from_audited_build() -> N assert "Verify release checksums" in publish_text assert "packages-dir: pypi-dist" in publish_text assert "cyclonedx-json" in publish_text + assert 'dist_dir.glob("*.whl")' in publish_text + assert 'dist_dir.glob("*.tar.gz")' in publish_text + assert 'dist_dir.glob("*.cdx.json")' in publish_text def test_dependency_review_runs_for_dependency_manifest_changes() -> None: