Skip to content

Commit 6373b6e

Browse files
garotmgarotm
authored
Merge pull request #2 from fleXRPL/feature/#1
feature/#1 - Initial project setup with CI/CD, documentation, and build scripts
2 parents deb0639 + b307af1 commit 6373b6e

File tree

11 files changed

+621
-191
lines changed

11 files changed

+621
-191
lines changed

‎.flake8

+14
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
[flake8]
2+
max-line-length = 100
3+
exclude =
4+
.git,
5+
__pycache__,
6+
build,
7+
dist,
8+
*.egg-info,
9+
.venv,
10+
.tox,
11+
.pytest_cache
12+
statistics = True
13+
count = True
14+
show-source = True

‎.github/dependabot.yml

+42
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
version: 2
2+
updates:
3+
- package-ecosystem: "pip"
4+
directory: "/"
5+
schedule:
6+
interval: "monthly"
7+
open-pull-requests-limit: 5
8+
target-branch: "main"
9+
labels:
10+
- "security"
11+
- "dependencies"
12+
commit-message:
13+
prefix: "security"
14+
include: "scope"
15+
reviewers:
16+
- "garotm"
17+
assignees:
18+
- "garotm"
19+
versioning-strategy:
20+
increase-if-necessary: true
21+
allow:
22+
- dependency-type: "direct"
23+
ignore:
24+
- dependency-name: "*"
25+
update-types: ["version-update:semver-minor", "version-update:semver-patch"]
26+
security-updates-only: true
27+
28+
- package-ecosystem: "github-actions"
29+
directory: "/"
30+
schedule:
31+
interval: "monthly"
32+
open-pull-requests-limit: 3
33+
labels:
34+
- "security"
35+
- "github-actions"
36+
commit-message:
37+
prefix: "security"
38+
include: "scope"
39+
ignore:
40+
- dependency-name: "*"
41+
update-types: ["version-update:semver-minor", "version-update:semver-patch"]
42+
security-updates-only: true

‎.github/workflows/sonarcloud.yml

+51
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
name: SonarCloud Analysis
2+
on:
3+
push:
4+
branches:
5+
- main
6+
pull_request:
7+
types: [opened, synchronize, reopened]
8+
workflow_dispatch:
9+
10+
jobs:
11+
sonarcloud:
12+
name: SonarCloud
13+
runs-on: ubuntu-latest
14+
15+
steps:
16+
- uses: actions/checkout@v4
17+
with:
18+
fetch-depth: 0
19+
20+
- name: Set up Python
21+
uses: actions/setup-python@v5
22+
with:
23+
python-version: '3.x'
24+
25+
- name: Install dependencies
26+
run: |
27+
python -m pip install --upgrade pip
28+
pip install -r requirements.txt
29+
pip install pytest pytest-cov
30+
31+
- name: Run tests with coverage
32+
run: |
33+
pytest tests/ --cov=githubauthlib --cov-report=xml --cov-report=term-missing
34+
35+
- name: SonarCloud Scan
36+
uses: SonarSource/sonarcloud-github-action@master
37+
env:
38+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
39+
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
40+
with:
41+
args: >
42+
-Dsonar.organization=flexrpl
43+
-Dsonar.projectKey=fleXRPL_githubauthlib
44+
-Dsonar.python.coverage.reportPaths=coverage.xml
45+
-Dsonar.sources=githubauthlib
46+
-Dsonar.tests=tests
47+
-Dsonar.python.version=3
48+
-Dsonar.sourceEncoding=UTF-8
49+
-Dsonar.exclusions=docs/**,scripts/**
50+
-Dsonar.coverage.exclusions=tests/**,docs/**,scripts/**
51+
-Dsonar.python.xunit.reportPath=test-results.xml

‎.github/workflows/workflow.yml

+57
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
name: workflow
2+
3+
on:
4+
push:
5+
branches: [ main ]
6+
tags: [ 'v*' ]
7+
pull_request:
8+
branches: [ main ]
9+
10+
jobs:
11+
test:
12+
runs-on: ${{ matrix.os }}
13+
strategy:
14+
matrix:
15+
os: [ubuntu-latest, macos-latest, windows-latest]
16+
python-version: ['3.8', '3.9', '3.10', '3.11', '3.12']
17+
18+
steps:
19+
- uses: actions/checkout@v4
20+
- name: Set up Python ${{ matrix.python-version }}
21+
uses: actions/setup-python@v5
22+
with:
23+
python-version: ${{ matrix.python-version }}
24+
- name: Install dependencies
25+
run: |
26+
python -m pip install --upgrade pip
27+
pip install -r requirements.txt
28+
pip install black isort flake8 pytest pytest-cov
29+
- name: Run tests and linting
30+
run: |
31+
black --check githubauthlib tests
32+
isort --check githubauthlib tests
33+
flake8 githubauthlib tests
34+
pytest tests/ --cov=githubauthlib --cov-report=xml --cov-fail-under=90
35+
36+
publish:
37+
needs: test
38+
if: startsWith(github.ref, 'refs/tags/v')
39+
runs-on: ubuntu-latest
40+
environment: pypi
41+
permissions:
42+
id-token: write
43+
44+
steps:
45+
- uses: actions/checkout@v4
46+
- name: Set up Python
47+
uses: actions/setup-python@v5
48+
with:
49+
python-version: '3.12'
50+
- name: Install dependencies
51+
run: |
52+
python -m pip install --upgrade pip
53+
pip install build
54+
- name: Build package
55+
run: python -m build
56+
- name: Publish to PyPI
57+
uses: pypa/gh-action-pypi-publish@release/v1

‎PYPI.md

+85-1
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,7 @@ You'll need `twine` to securely upload your package to PyPI. If you don't have i
4747

4848
```bash
4949
pip install twine
50-
``````
50+
```
5151

5252
5. Upload the package to PyPI:
5353
Use `twine` to upload your package to PyPI. Run the following command:
@@ -98,3 +98,87 @@ Now that your package is on PyPI, you can install it using `pip` like any other
9898
That's it! Your package is now available on PyPI and can be easily installed by others using `pip install githubauthlib`.
9999

100100
Keep in mind that publishing packages on PyPI is a public act, and it's essential to ensure your code is properly documented, well-tested, and adheres to best practices. Make sure to thoroughly test your package and keep it up-to-date with new releases if necessary.
101+
102+
# Publishing to PyPI using GitHub Actions Trusted Publisher
103+
104+
This project uses GitHub Actions and PyPI's trusted publisher workflow for secure, automated package publishing.
105+
106+
## Overview
107+
108+
Instead of manual uploads or stored credentials, we use GitHub's OIDC (OpenID Connect) integration with PyPI for secure publishing. This means:
109+
110+
- No API tokens or credentials needed
111+
- Automated publishing on version tags
112+
- Secure authentication via OIDC
113+
114+
## Publishing Process
115+
116+
1. **Local Build and Test**
117+
118+
```bash
119+
# Run the build script to verify everything locally
120+
./scripts/build_and_publish.sh
121+
```
122+
123+
This will:
124+
- Create a virtual environment
125+
- Run all tests and checks
126+
- Build the package locally
127+
- Clean up afterward
128+
129+
2. **Create and Push a Version Tag**
130+
131+
```bash
132+
# Create and push a new version tag
133+
git tag v1.0.0
134+
git push origin v1.0.0
135+
```
136+
137+
The version number should match what's in `setup.py`.
138+
139+
3. **Automated Publishing**
140+
- GitHub Actions will trigger on the tag push
141+
- The workflow will:
142+
- Run all tests
143+
- Build the package
144+
- Publish to PyPI using OIDC authentication
145+
- Monitor the Actions tab for progress
146+
147+
4. **Verify Publication**
148+
- Check the package page: https://pypi.org/project/githubauthlib/
149+
- Try installing the package:
150+
151+
```bash
152+
pip install githubauthlib
153+
```
154+
155+
## PyPI Project Configuration
156+
157+
The PyPI project is configured with the following trusted publisher settings:
158+
159+
- **Publisher**: GitHub Actions
160+
- **Organization**: fleXRPL
161+
- **Repository**: githubauthlib
162+
- **Workflow name**: workflow.yml
163+
- **Environment**: pypi
164+
165+
## Security Notes
166+
167+
- No credentials are stored in the repository or GitHub secrets
168+
- Authentication is handled via OIDC between GitHub and PyPI
169+
- Only tagged commits from the main branch can trigger publishing
170+
- All publishing attempts are logged and auditable
171+
172+
## Troubleshooting
173+
174+
If publishing fails:
175+
176+
1. Check the GitHub Actions logs
177+
2. Verify the version tag matches setup.py
178+
3. Ensure the workflow file matches PyPI's trusted publisher configuration
179+
4. Verify the package builds locally with `./scripts/build_and_publish.sh`
180+
181+
## Related Links
182+
183+
- [PyPI Trusted Publishers Documentation](https://docs.pypi.org/trusted-publishers/)
184+
- [GitHub Actions OIDC Documentation](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect)

‎README.md

+14
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,19 @@
11
# GitHub Authentication Library (githubauthlib)
22

3+
[![PyPI version](https://badge.fury.io/py/githubauthlib.svg)](https://pypi.org/project/githubauthlib/)
4+
[![Python](https://img.shields.io/pypi/pyversions/githubauthlib.svg)](https://pypi.org/project/githubauthlib/)
5+
[![Tests](https://github.com/fleXRPL/githubauthlib/actions/workflows/tests.yml/badge.svg)](https://github.com/fleXRPL/githubauthlib/actions/workflows/tests.yml)
6+
[![Quality Gate Status](https://sonarcloud.io/api/project_badges/measure?project=fleXRPL_githubauthlib&metric=alert_status)](https://sonarcloud.io/summary/new_code?id=fleXRPL_githubauthlib)
7+
[![Coverage](https://sonarcloud.io/api/project_badges/measure?project=fleXRPL_githubauthlib&metric=coverage)](https://sonarcloud.io/summary/new_code?id=fleXRPL_githubauthlib)
8+
[![Security Rating](https://sonarcloud.io/api/project_badges/measure?project=fleXRPL_githubauthlib&metric=security_rating)](https://sonarcloud.io/summary/new_code?id=fleXRPL_githubauthlib)
9+
[![Maintainability Rating](https://sonarcloud.io/api/project_badges/measure?project=fleXRPL_githubauthlib&metric=sqale_rating)](https://sonarcloud.io/summary/new_code?id=fleXRPL_githubauthlib)
10+
[![Vulnerabilities](https://sonarcloud.io/api/project_badges/measure?project=fleXRPL_githubauthlib&metric=vulnerabilities)](https://sonarcloud.io/summary/new_code?id=fleXRPL_githubauthlib)
11+
[![Dependabot Status](https://img.shields.io/badge/Dependabot-enabled-success.svg)](https://github.com/fleXRPL/githubauthlib/blob/main/.github/dependabot.yml)
12+
[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
13+
[![Code style: black](https://img.shields.io/badge/code%20style-black-000000.svg)](https://github.com/psf/black)
14+
[![Security: bandit](https://img.shields.io/badge/security-bandit-yellow.svg)](https://github.com/PyCQA/bandit)
15+
[![Downloads](https://pepy.tech/badge/githubauthlib)](https://pepy.tech/project/githubauthlib)
16+
317
A Python library for securely retrieving GitHub tokens from system keychains across different operating systems.
418

519
## Features

‎githubauthlib/__init__.py

+6-9
Original file line numberDiff line numberDiff line change
@@ -5,13 +5,10 @@
55
from various system-specific secure storage solutions.
66
"""
77

8-
from .github_auth import (
9-
get_github_token,
10-
GitHubAuthError,
11-
CredentialHelperError,
12-
UnsupportedPlatformError
13-
)
8+
from .github_auth import get_github_token
149

15-
__version__ = '1.0.0'
16-
__author__ = 'garotm'
17-
__license__ = 'MIT'
10+
__version__ = "1.0.0"
11+
__author__ = "garotm"
12+
__license__ = "MIT"
13+
14+
__all__ = ["get_github_token"]

0 commit comments

Comments
 (0)