build-wheel.yml

name: Build pip wheel

permissions: read-all

on:
  push:
    branches: [ "main" ]
  workflow_dispatch:

jobs:
  build:
    name: Build wheel
    runs-on: ${{ github.repository_owner == 'intel' && 'intel-ubuntu-latest' || 'ubuntu-latest' }}
    permissions:
      id-token: write
      attestations: write
      contents: read
    strategy:
      fail-fast: false
      matrix:
        python-version:
        - "3.12"
    if: github.repository == 'intel/cve-bin-tool' # run on origin repo only
    steps:
    - name: Harden Runner
      uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
      with:
        egress-policy: audit

    - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
    - uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 # v5.2.0
      with:
        python-version: ${{ matrix.python-version }}
        cache: 'pip'
    - name: Install dependencies
      run: |
        python -m pip install --upgrade pip setuptools wheel build
    - name: Build
      run: |
        python -m build .
    - name: Get built filenames
      id: filename
      run: |
        echo "tar=$(cd dist/ && echo *.tar.gz)" >> $GITHUB_OUTPUT
        echo "whl=$(cd dist/ && echo *.tar.gz)" >> $GITHUB_OUTPUT
    - name: Attest Build Provenance for tar
      uses: actions/attest-build-provenance@1c608d11d69870c2092266b3f9a6f3abbf17002c # v1.4.3
      with:
        subject-path: "dist/${{ steps.filename.outputs.tar }}"
    - name: Attest Build Provenance for whl
      uses: actions/attest-build-provenance@1c608d11d69870c2092266b3f9a6f3abbf17002c # v1.4.3
      with:
        subject-path: "dist/${{ steps.filename.outputs.whl }}"
    # TODO Upload to pypi on release creation