tag-publish 1.3.0.dev7__tar.gz → 1.3.0.dev8__tar.gz

tag_publish-1.3.0.dev7/README.md → tag_publish-1.3.0.dev8/PKG-INFO

@@ -1,3 +1,45 @@
+Metadata-Version: 2.4
+Name: tag-publish
+Version: 1.3.0.dev8
+Summary: Tools used to publish Python packages, Docker images and Helm charts for GitHub tag and branch
+License: FreeBSD
+License-File: LICENSE
+Keywords: ci
+Author: Camptocamp
+Author-email: info@camptocamp.com
+Requires-Python: >=3.10
+Classifier: Development Status :: 5 - Production/Stable
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Typing :: Typed
+Provides-Extra: docker
+Provides-Extra: helm
+Provides-Extra: new
+Provides-Extra: pypi
+Provides-Extra: validation
+Requires-Dist: PyYAML (>=6,<7)
+Requires-Dist: applications-download (>=1,<2) ; extra == "helm"
+Requires-Dist: debian-inspector (>=31,<32) ; extra == "docker"
+Requires-Dist: githubkit (>=0,<1)
+Requires-Dist: id (>=1,<2) ; extra == "pypi"
+Requires-Dist: jsonschema-validator-new (>=0,<1) ; extra == "validation"
+Requires-Dist: multi-repo-automation (>=1,<2) ; extra == "new"
+Requires-Dist: requests (>=2,<3) ; extra == "pypi"
+Requires-Dist: ruamel-yaml (>=0,<1) ; extra == "new"
+Requires-Dist: security-md (>=1,<2)
+Requires-Dist: twine (>=6,<7) ; extra == "pypi"
+Project-URL: Bug Tracker, https://github.com/camptocamp/tag-publish/issues
+Project-URL: Repository, https://github.com/camptocamp/tag-publish
+Description-Content-Type: text/markdown
+
 # Tag Publish
 
 ## Publishing
@@ -23,11 +65,12 @@ permissions:
   contents: write
 ```
 
-Install the package in the worklow:
+Install the package in the worklow, with only the extras you need (see
+[Extras](#extras) below), to reduce the attack surface during the publishing:
 
 ```yaml
 - name: Install tag-publish
-  run: pip install tag-publish
+  run: pip install 'tag-publish[docker,helm]'
 ```
 
 Do the publishing:
@@ -39,6 +82,29 @@ Do the publishing:
     GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 ```
 
+## Extras
+
+To reduce the attack surface, the dependencies are split into optional extras, one
+per kind of publishing. Only install the extras you actually use: a plain
+`pip install tag-publish` installs the core only (`PyYAML`, `security-md`,
+`githubkit`) and will fail with an explicit message if you try a publishing whose
+extra is missing.
+
+| Extra        | Kind of publishing                | Dependencies                                        |
+| ------------ | --------------------------------- | --------------------------------------------------- |
+| `pypi`       | Python packages to PyPI           | `requests`, `twine`, `id` (OIDC trusted publishing) |
+| `docker`     | Docker images (dpkg audit)        | `debian-inspector`                                  |
+| `helm`       | Helm charts (GitHub/OCI)          | `applications-download` (chart-releaser, cosign)    |
+| `new`        | `tag-publish-new` command         | `multi-repo-automation`, `ruamel-yaml`              |
+| `validation` | `.github/publish.yaml` validation | `jsonschema-validator-new`                          |
+
+Notes:
+
+- The Node (npm) publishing needs no extra, it only uses the `npm` CLI.
+- The `validation` extra is optional: without it the schema validation of
+  `.github/publish.yaml` is skipped with a warning.
+- Install several extras at once, e.g. `pip install 'tag-publish[pypi,docker,helm]'`.
+
 ## New version
 
 To create a new version you should create a Git tag with the version number.
@@ -355,3 +421,4 @@ Install the pre-commit hooks:
 pip install pre-commit
 pre-commit install --allow-missing-config
 ```
+

tag_publish-1.3.0.dev7/PKG-INFO → tag_publish-1.3.0.dev8/README.md

@@ -1,39 +1,3 @@
-Metadata-Version: 2.4
-Name: tag-publish
-Version: 1.3.0.dev7
-Summary: Tools used to publish Python packages, Docker images and Helm charts for GitHub tag and branch
-License: FreeBSD
-License-File: LICENSE
-Keywords: ci
-Author: Camptocamp
-Author-email: info@camptocamp.com
-Requires-Python: >=3.10
-Classifier: Development Status :: 5 - Production/Stable
-Classifier: Environment :: Console
-Classifier: Intended Audience :: Developers
-Classifier: License :: OSI Approved :: MIT License
-Classifier: Operating System :: OS Independent
-Classifier: Programming Language :: Python
-Classifier: Programming Language :: Python :: 3
-Classifier: Programming Language :: Python :: 3.10
-Classifier: Programming Language :: Python :: 3.11
-Classifier: Programming Language :: Python :: 3.12
-Classifier: Programming Language :: Python :: 3.13
-Classifier: Typing :: Typed
-Requires-Dist: PyYAML (>=6,<7)
-Requires-Dist: applications-download (>=1,<2)
-Requires-Dist: debian-inspector (>=31,<32)
-Requires-Dist: githubkit (>=0,<1)
-Requires-Dist: id (>=1,<2)
-Requires-Dist: jsonschema-validator-new (>=0,<1)
-Requires-Dist: multi-repo-automation (>=1,<2)
-Requires-Dist: requests (>=2,<3)
-Requires-Dist: security-md (>=1,<2)
-Requires-Dist: twine (>=6,<7)
-Project-URL: Bug Tracker, https://github.com/camptocamp/tag-publish/issues
-Project-URL: Repository, https://github.com/camptocamp/tag-publish
-Description-Content-Type: text/markdown
-
 # Tag Publish
 
 ## Publishing
@@ -59,11 +23,12 @@ permissions:
   contents: write
 ```
 
-Install the package in the worklow:
+Install the package in the worklow, with only the extras you need (see
+[Extras](#extras) below), to reduce the attack surface during the publishing:
 
 ```yaml
 - name: Install tag-publish
-  run: pip install tag-publish
+  run: pip install 'tag-publish[docker,helm]'
 ```
 
 Do the publishing:
@@ -75,6 +40,29 @@ Do the publishing:
     GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 ```
 
+## Extras
+
+To reduce the attack surface, the dependencies are split into optional extras, one
+per kind of publishing. Only install the extras you actually use: a plain
+`pip install tag-publish` installs the core only (`PyYAML`, `security-md`,
+`githubkit`) and will fail with an explicit message if you try a publishing whose
+extra is missing.
+
+| Extra        | Kind of publishing                | Dependencies                                        |
+| ------------ | --------------------------------- | --------------------------------------------------- |
+| `pypi`       | Python packages to PyPI           | `requests`, `twine`, `id` (OIDC trusted publishing) |
+| `docker`     | Docker images (dpkg audit)        | `debian-inspector`                                  |
+| `helm`       | Helm charts (GitHub/OCI)          | `applications-download` (chart-releaser, cosign)    |
+| `new`        | `tag-publish-new` command         | `multi-repo-automation`, `ruamel-yaml`              |
+| `validation` | `.github/publish.yaml` validation | `jsonschema-validator-new`                          |
+
+Notes:
+
+- The Node (npm) publishing needs no extra, it only uses the `npm` CLI.
+- The `validation` extra is optional: without it the schema validation of
+  `.github/publish.yaml` is skipped with a warning.
+- Install several extras at once, e.g. `pip install 'tag-publish[pypi,docker,helm]'`.
+
 ## New version
 
 To create a new version you should create a Git tag with the version number.
@@ -391,4 +379,3 @@ Install the pre-commit hooks:
 pip install pre-commit
 pre-commit install --allow-missing-config
 ```
-

{tag_publish-1.3.0.dev7 → tag_publish-1.3.0.dev8}/pyproject.toml

@@ -21,23 +21,33 @@ exclude = ["tag_publish/node_modules/**/test"]
 
 [tool.poetry.dependencies]
 python = ">=3.10,<4.0"
-requests = "2.33.0"
-twine = "6.2.0"
 PyYAML = "6.0.3"
-id = "1.5.0"
 security-md = "1.0.0"
-applications-download = "1.7.0"
-jsonschema-validator-new = "0.3.2"
-debian-inspector = "31.1.1"
-multi-repo-automation = "1.7.0"
 githubkit = "0.14.3"
+requests = { version = "2.33.0", optional = true }
+twine = { version = "6.2.0", optional = true }
+id = { version = "1.5.0", optional = true }
+applications-download = { version = "1.7.0", optional = true }
+jsonschema-validator-new = { version = "0.3.2", optional = true }
+debian-inspector = { version = "31.1.1", optional = true }
+multi-repo-automation = { version = "1.7.0", optional = true }
+ruamel-yaml = { version = "0.19.1", optional = true }
+
+[tool.poetry.extras]
+pypi = ["requests", "twine", "id"]
+docker = ["debian-inspector"]
+helm = ["applications-download"]
+new = ["multi-repo-automation", "ruamel-yaml"]
+validation = ["jsonschema-validator-new"]
 
 [tool.poetry.group.dev.dependencies]
 prospector = { version = "1.19.1", extras = ["with_bandit", "with_mypy", "with_pyroma", "with_ruff"] }
 prospector-profile-duplicated = "1.12.0"
 prospector-profile-utils = "1.27.0"
 types-requests = "2.33.0.20260712"
-types-pyyaml = "6.0.12.20260518"
+types-pyyaml = "6.0.12.20260724"
+ruff = "0.15.21"
+pylint = "4.0.7"
 
 [tool.poetry-dynamic-versioning]
 enable = false
@@ -86,8 +96,15 @@ include = [
     "tag_publish/*.json",
 ]
 requires-python = ">=3.10"
-dependencies = ["requests<3,>=2", "twine<7,>=6", "PyYAML<7,>=6", "id<2,>=1", "security-md<2,>=1", "applications-download<2,>=1", "jsonschema-validator-new<1,>=0", "debian-inspector<32,>=31", "multi-repo-automation<2,>=1", "githubkit<1,>=0"]
-version = "1.3.0.dev7"
+dependencies = ["PyYAML<7,>=6", "security-md<2,>=1", "githubkit<1,>=0"]
+version = "1.3.0.dev8"
+
+[project.optional-dependencies]
+pypi = ["requests<3,>=2", "twine<7,>=6", "id<2,>=1"]
+docker = ["debian-inspector<32,>=31"]
+helm = ["applications-download<2,>=1"]
+new = ["multi-repo-automation<2,>=1", "ruamel-yaml<1,>=0"]
+validation = ["jsonschema-validator-new<1,>=0"]
 
 [project.urls]
 repository = "https://github.com/camptocamp/tag-publish"
@@ -99,7 +116,7 @@ tag-publish-new = "tag_publish.new:main"
 
 [build-system]
 requires = [
-    "poetry-core>=1.0.0",
-    "poetry-dynamic-versioning[plugin]>=0.19.0",
+    "poetry-core==2.4.0",
+    "poetry-dynamic-versioning[plugin]==1.10.0",
 ]
 build-backend = "poetry.core.masonry.api"

{tag_publish-1.3.0.dev7 → tag_publish-1.3.0.dev8}/tag_publish/__init__.py

@@ -1,20 +1,19 @@
 """Tag Publish main module."""
 
 import base64
+import importlib.util
 import json
 import os
 import pkgutil
 import re
 import subprocess  # nosec
+import sys
 from pathlib import Path
 from re import Match, Pattern
 from typing import Any, TypedDict, cast, overload
 
-import applications_download
 import githubkit
 import githubkit.versions.latest.models
-import jsonschema_validator
-import ruamel.yaml
 import security_md
 import yaml
 
@@ -32,6 +31,34 @@ VersionTransform = TypedDict(
 )
 
 
+def require_extra(extra: str, *module_names: str) -> None:
+    """
+    Check that the modules provided by an optional extra are installed.
+
+    Exit with an installation hint if any module is missing.
+
+    Arguments:
+        extra: The name of the extra that provides the modules
+        module_names: The importable module names to check
+
+    """
+
+    def is_missing(module_name: str) -> bool:
+        try:
+            return importlib.util.find_spec(module_name) is None
+        except (ModuleNotFoundError, ValueError):
+            # Raised when a parent package of a dotted module name is not installed.
+            return True
+
+    missing = [module_name for module_name in module_names if is_missing(module_name)]
+    if missing:
+        print(
+            f"::error::Missing optional dependencies: {', '.join(missing)}, "
+            f"install tag-publish with: pip install tag-publish[{extra}]",
+        )
+        sys.exit(1)
+
+
 class GH:
     """GitHub helper class."""
 
@@ -112,13 +139,22 @@ def get_config() -> tag_publish.configuration.Configuration:
     """Get the configuration, with project and auto detections."""
     config: tag_publish.configuration.Configuration = {}
     if Path(".github/publish.yaml").exists():
-        schema_data = pkgutil.get_data("tag_publish", "schema.json")
-        assert schema_data is not None
-        schema = json.loads(schema_data)
-
         with Path(".github/publish.yaml").open(encoding="utf-8") as open_file:
-            yaml_ = ruamel.yaml.YAML()
-            config = yaml_.load(open_file)
+            config = yaml.safe_load(open_file)
+
+        # The schema validation is optional, provided by the `validation` extra.
+        if importlib.util.find_spec("jsonschema_validator") is None:
+            print(
+                "::warning::The 'validation' extra is not installed, "
+                "the '.github/publish.yaml' schema validation is skipped",
+            )
+        else:
+            # Imported here because it is an optional dependency provided by the `validation` extra.
+            import jsonschema_validator  # noqa: PLC0415
+
+            schema_data = pkgutil.get_data("tag_publish", "schema.json")
+            assert schema_data is not None
+            schema = json.loads(schema_data)
             jsonschema_validator.validate(".github/publish.yaml", cast("dict[str, Any]", config), schema)
 
     return config
@@ -209,6 +245,10 @@ def download_application(application_name: str, binary_filename: Path | None = N
     binary_full_filename = Path.home() / ".local" / "bin" / binary_filename if binary_filename else None
 
     if not binary_full_filename.exists() if binary_full_filename else True:
+        require_extra("helm", "applications_download")
+        # Imported here because it is an optional dependency provided by the `helm` extra.
+        import applications_download  # noqa: PLC0415
+
         applications = applications_download.Applications()
         applications.install("helm/chart-releaser")
 

{tag_publish-1.3.0.dev7 → tag_publish-1.3.0.dev8}/tag_publish/cli.py

@@ -17,8 +17,6 @@ import yaml
 
 import tag_publish
 import tag_publish.configuration
-import tag_publish.lib.docker
-import tag_publish.lib.oidc
 import tag_publish.publish
 
 
@@ -195,8 +193,12 @@ def _handle_pypi_publish(
     success = True
     pypi_config = config.get("pypi", {})
     if pypi_config:
+        tag_publish.require_extra("pypi", "id", "requests", "twine")
+        # Imported here because it depends on optional dependencies provided by the `pypi` extra.
+        from tag_publish.lib import oidc  # noqa: PLC0415
+
         if "packages" in pypi_config:
-            tag_publish.lib.oidc.pypi_login()
+            oidc.pypi_login()
 
         for package in pypi_config.get("packages", []):
             if package.get("group", tag_publish.configuration.PIP_PACKAGE_GROUP_DEFAULT) == group:
@@ -289,6 +291,11 @@ def _handle_docker_publish(
     success = True
     docker_config = config.get("docker", {})
     if docker_config:
+        # Fail fast, before any push, if the dpkg audit dependencies are missing.
+        # Not required in dry-run because the dpkg audit is skipped (it exits before).
+        if not dry_run:
+            tag_publish.require_extra("docker", "debian_inspector")
+
         sys.stdout.flush()
         sys.stderr.flush()
         if docker_config.get("github_oidc_login", tag_publish.configuration.DOCKER_AUTO_LOGIN_DEFAULT):
@@ -376,11 +383,14 @@ def _handle_docker_publish(
         if dry_run:
             sys.exit(0)
 
+        # Imported here because it depends on an optional dependency provided by the `docker` extra.
+        from tag_publish.lib import docker  # noqa: PLC0415
+
         dpkg_versions_path = Path(".github/dpkg-versions.yaml")
-        versions_config, dpkg_config_found = tag_publish.lib.docker.get_versions_config()
+        versions_config, dpkg_config_found = docker.get_versions_config()
         dpkg_success = True
         for image in images_src:
-            dpkg_success &= tag_publish.lib.docker.check_versions(versions_config.get(image, {}), image)
+            dpkg_success &= docker.check_versions(versions_config.get(image, {}), image)
 
         if not dpkg_success:
             current_versions_in_images: dict[str, dict[str, str]] = {}
@@ -390,7 +400,7 @@ def _handle_docker_publish(
             for image in images_src:
                 if image in current_versions_in_images:
                     current_versions_in_images[image] = dict(current_versions_in_images[image])
-                _, versions_image = tag_publish.lib.docker.get_dpkg_packages_versions(image)
+                _, versions_image = docker.get_dpkg_packages_versions(image)
                 for dpkg_package, package_version in versions_image.items():
                     if dpkg_package not in current_versions_in_images.get(image, {}):
                         current_versions_in_images.setdefault(image, {})[dpkg_package] = str(package_version)

{tag_publish-1.3.0.dev7 → tag_publish-1.3.0.dev8}/tag_publish/new.py

@@ -6,10 +6,10 @@ import re
 import subprocess  # nosec
 from pathlib import Path
 
-import multi_repo_automation as mra
-import ruamel.yaml
 import security_md
 
+import tag_publish
+
 
 def _get_default_branch() -> str:
     """Get the default branch name."""
@@ -23,6 +23,13 @@ def _get_default_branch() -> str:
 
 def main() -> None:
     """Create a new version with its stabilization branch."""
+    tag_publish.require_extra("new", "multi_repo_automation", "ruamel.yaml")
+    # Imported here because they are optional dependencies provided by the `new` extra.
+    import multi_repo_automation as mra  # noqa: PLC0415
+    import ruamel.yaml  # noqa: PLC0415
+    import ruamel.yaml.comments  # noqa: PLC0415
+    import ruamel.yaml.error  # noqa: PLC0415
+
     args_parser = argparse.ArgumentParser(
         description="Create a new version with its stabilization branch",
         usage="""

{tag_publish-1.3.0.dev7 → tag_publish-1.3.0.dev8}/tag_publish/publish.py

@@ -8,8 +8,8 @@ import subprocess  # nosec
 import sys
 from pathlib import Path
 
-import ruamel
 import tomllib
+import yaml
 
 import tag_publish
 import tag_publish.configuration
@@ -292,13 +292,25 @@ def helm(
 
     chart_name = ""
     try:
-        yaml_ = ruamel.yaml.YAML()
-        with (Path(folder) / "Chart.yaml").open(encoding="utf-8") as open_file:
-            chart = yaml_.load(open_file)
-        chart["version"] = version
+        chart_path = Path(folder) / "Chart.yaml"
+        with chart_path.open(encoding="utf-8") as open_file:
+            chart_content = open_file.read()
+        chart = yaml.load(chart_content, Loader=yaml.SafeLoader)
         chart_name = chart.get("name", "")
-        with (Path(folder) / "Chart.yaml").open("w", encoding="utf-8") as open_file:
-            yaml_.dump(chart, open_file)
+        # The version is updated with a targeted replacement to preserve the file formatting and comments
+        new_chart_content, number_of_substitutions = re.subn(
+            r"^version:.*$",
+            f"version: {version}",
+            chart_content,
+            count=1,
+            flags=re.MULTILINE,
+        )
+        if number_of_substitutions != 1:
+            print("::endgroup::")
+            print(f"::error::Unable to find the 'version' key in '{chart_path}'")
+            return False
+        with chart_path.open("w", encoding="utf-8") as open_file:
+            open_file.write(new_chart_content)
         for index, dependency in enumerate(chart.get("dependencies", [])):
             if dependency["repository"].startswith("https://"):
                 subprocess.run(["helm", "repo", "add", str(index), dependency["repository"]], check=True)
@@ -319,6 +331,7 @@ def helm(
                 f"--git-repo={repo}",
                 f"--commit={commit_sha}",
                 "--release-name-template={{ .Version }}",
+                "--skip-existing",
                 f"--token={token}",
             ],
             check=True,
@@ -363,10 +376,15 @@ def helm(
             )
 
             if oci_config.get("sign", tag_publish.configuration.HELM_OCI_SIGN_DEFAULT):
-                print(f"Signing chart with cosign at oci://{oci_repository}:{version}")
+                print(f"Signing chart with cosign at oci://{oci_repository}/{chart_name}:{version}")
                 tag_publish.download_application("sigstore/cosign")
                 subprocess.run(
-                    ["cosign", "sign", f"oci://{oci_repository}:{version}", "--yes"],
+                    ["cosign", "login", registry, f"--username={owner}", "--password-stdin"],
+                    input=f"{token}\n".encode(),
+                    check=True,
+                )
+                subprocess.run(
+                    ["cosign", "sign", f"{oci_repository}/{chart_name}:{version}", "--yes"],
                     check=True,
                 )
 

{tag_publish-1.3.0.dev7 → tag_publish-1.3.0.dev8}/tag_publish/versions.yaml

@@ -1,3 +1,3 @@
 # https://docs.renovatebot.com/modules/datasource/#github-releases-datasource
 helm/chart-releaser: v1.8.1 # github-releases
-sigstore/cosign: v3.1.1 # github-releases
+sigstore/cosign: v3.1.2 # github-releases