From 515bef95d866f7e2bc32f012d24589e880c7680c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mateusz=20W=C3=B3jcik?= Date: Thu, 24 Sep 2026 08:37:51 +0200 Subject: [PATCH 1/2] Fetch CI secrets from AWS Secrets Manager and publish to PyPI via OIDC. Replace GitHub Actions secrets for Docker Hub with branch-restricted OIDC, and switch PyPI uploads to trusted publishing instead of API tokens. Co-authored-by: Cursor --- .github/workflows/github-actions.yml | 42 +++++++++++++++++++--------- run-build | 2 +- 2 files changed, 30 insertions(+), 14 deletions(-) diff --git a/.github/workflows/github-actions.yml b/.github/workflows/github-actions.yml index d89e40a..f509426 100644 --- a/.github/workflows/github-actions.yml +++ b/.github/workflows/github-actions.yml @@ -1,9 +1,6 @@ # This workflow will build the project, run integration tests, and release. -# Because secrets are not available on external forks, this job is expected to fail -# on external pull requests. - -# publishing instructions from -# https://packaging.python.org/en/latest/guides/publishing-package-distribution-releases-using-github-actions-ci-cd-workflows/ +# Secret-backed jobs fetch credentials from AWS Secrets Manager using GitHub OIDC. +# PyPI uploads use trusted publishing (GitHub OIDC), not API tokens. name: Build, Check, Publish @@ -16,15 +13,31 @@ on: jobs: build: runs-on: ubuntu-latest + permissions: + id-token: write + contents: read steps: - name: Checkout Repo uses: actions/checkout@v3 + - name: Configure AWS credentials for Docker Hub secrets (OIDC) + if: github.event_name != 'pull_request' + uses: aws-actions/configure-aws-credentials@v6 + with: + role-to-assume: arn:aws:iam::301904545275:role/oidc-github-hellosign-dropbox-sign-python-branch-main + aws-region: us-west-2 + + - name: Get Docker Hub secrets from AWS Secrets Manager + if: github.event_name != 'pull_request' + uses: aws-actions/aws-secretsmanager-get-secrets@v3 + with: + secret-ids: | + DOCKER_USERNAME,github-actions/hellosign/shared/docker-username + DOCKER_TOKEN,github-actions/hellosign/shared/docker-token + parse-json-secrets: false + - name: Build SDK run: ./run-build - env: - DOCKER_USERNAME: ${{secrets.DOCKER_USERNAME}} - DOCKER_TOKEN: ${{secrets.DOCKER_TOKEN}} - name: Ensure no changes in Generated Code run: ./bin/check-clean-git-status @@ -39,6 +52,9 @@ jobs: && github.ref != 'refs/heads/main' && github.event_name == 'pull_request' needs: [ build ] + permissions: + id-token: write + contents: read steps: - name: Checkout uses: actions/checkout@v3 @@ -57,9 +73,8 @@ jobs: - name: Publish distribution to Test PyPI uses: pypa/gh-action-pypi-publish@release/v1 with: - password: ${{ secrets.PYPI_TEST_API_KEY }} - repository_url: https://test.pypi.org/legacy/ - skip_existing: true + repository-url: https://test.pypi.org/legacy/ + skip-existing: true verbose: true # This job runs on merging to "main" branch @@ -71,6 +86,9 @@ jobs: && github.ref == 'refs/heads/main' && github.event_name != 'pull_request' needs: [ build ] + permissions: + id-token: write + contents: read steps: - name: Checkout uses: actions/checkout@v3 @@ -88,8 +106,6 @@ jobs: - name: Publish distribution to PyPI uses: pypa/gh-action-pypi-publish@release/v1 - with: - password: ${{ secrets.PYPI_API_KEY }} # This job runs on merging to "main" branch # Creates a new tag using the value in the VERSION file diff --git a/run-build b/run-build index 179dec4..09284e8 100755 --- a/run-build +++ b/run-build @@ -7,7 +7,7 @@ set -e DIR=$(cd `dirname $0` && pwd) WORKING_DIR="/app/python" -if [[ -n "$GITHUB_ACTIONS" ]]; then +if [[ -n "$GITHUB_ACTIONS" && -n "${DOCKER_USERNAME:-}" && -n "${DOCKER_TOKEN:-}" ]]; then printf "\nLogging in to docker.com ...\n" echo "${DOCKER_TOKEN}" | docker login -u "${DOCKER_USERNAME}" --password-stdin fi From d1e55063f728a02154e96f632870c605743647f0 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mateusz=20W=C3=B3jcik?= Date: Thu, 24 Sep 2026 08:43:37 +0200 Subject: [PATCH 2/2] Remove Test PyPI publish and label the prod upload as trusted publishing. Co-authored-by: Cursor --- .github/workflows/github-actions.yml | 45 ++++------------------------ 1 file changed, 5 insertions(+), 40 deletions(-) diff --git a/.github/workflows/github-actions.yml b/.github/workflows/github-actions.yml index f509426..5e86fa6 100644 --- a/.github/workflows/github-actions.yml +++ b/.github/workflows/github-actions.yml @@ -42,53 +42,18 @@ jobs: - name: Ensure no changes in Generated Code run: ./bin/check-clean-git-status - # This job runs on pull requests - # Publishes to test.pypi.org, useful as a dry run - # Step still passes even if package version was already uploaded - publish-test: - runs-on: ubuntu-latest - if: >- - github.repository == 'hellosign/dropbox-sign-python' - && github.ref != 'refs/heads/main' - && github.event_name == 'pull_request' - needs: [ build ] - permissions: - id-token: write - contents: read - steps: - - name: Checkout - uses: actions/checkout@v3 - - - name: Set up Python 3.10 - uses: actions/setup-python@v3 - with: - python-version: "3.10" - - - name: Install pypa/build - run: python -m pip install build --user - - - name: Build a binary wheel and a source tarball - run: python -m build --sdist --wheel --outdir dist/ . - - - name: Publish distribution to Test PyPI - uses: pypa/gh-action-pypi-publish@release/v1 - with: - repository-url: https://test.pypi.org/legacy/ - skip-existing: true - verbose: true - # This job runs on merging to "main" branch - # Builds and publishes package to pypi.org + # Builds and publishes package to pypi.org with trusted publishing publish-prod: runs-on: ubuntu-latest + permissions: + contents: read + id-token: write if: >- github.repository == 'hellosign/dropbox-sign-python' && github.ref == 'refs/heads/main' && github.event_name != 'pull_request' needs: [ build ] - permissions: - id-token: write - contents: read steps: - name: Checkout uses: actions/checkout@v3 @@ -104,7 +69,7 @@ jobs: - name: Build a binary wheel and a source tarball run: python -m build --sdist --wheel --outdir dist/ . - - name: Publish distribution to PyPI + - name: Publish package with trusted publishing uses: pypa/gh-action-pypi-publish@release/v1 # This job runs on merging to "main" branch