ci: harden release pipeline dependencies, wheel builds, and checkout credentials

.github/renovate.json5

@@ -5,6 +5,9 @@
       "helpers:pinGitHubActionDigestsToSemver",
       ":semanticCommits"
     ],
+    // Wait 3 days before proposing updates to allow PyPI / upstream registries
+    // to quarantine compromised releases (e.g. LiteLLM v1.107.0).
+    "minimumReleaseAge": "3 days",
     constraints: {
       python: "==3.10"
     },

.github/scripts/update-version-patch.sh

@@ -3,9 +3,9 @@
 sed -i "/\[stable\]/{n;s/version=.*/version=$1/}" eachdist.ini
 sed -i "/\[prerelease\]/{n;s/version=.*/version=$2/}" eachdist.ini
 
-./scripts/eachdist.py update_patch_versions \
-    --stable_version=$1 \
-    --unstable_version=$2 \
-    --stable_version_prev=$3 \
-    --unstable_version_prev=$4
+uv run --no-project --exclude-newer 3d --with toml ./scripts/eachdist.py update_patch_versions \
+    --stable_version="$1" \
+    --unstable_version="$2" \
+    --stable_version_prev="$3" \
+    --unstable_version_prev="$4"
 

.github/scripts/update-version.sh

@@ -3,4 +3,4 @@
 sed -i "/\[stable\]/{n;s/version=.*/version=$1/}" eachdist.ini
 sed -i "/\[prerelease\]/{n;s/version=.*/version=$2/}" eachdist.ini
 
-./scripts/eachdist.py update_versions --versions stable,prerelease
+uv run --no-project --exclude-newer 3d --with toml ./scripts/eachdist.py update_versions --versions stable,prerelease

.github/workflows/backport.yml

@@ -25,8 +25,7 @@ jobs:
         with:
           # history is needed to run git cherry-pick below
           fetch-depth: 0
-          # zizmor: ignore[artipacked] Credentials are required by the branch push below.
-          persist-credentials: true
+          persist-credentials: false
 
       - name: Use CLA approved github bot
         run: .github/scripts/use-cla-approved-github-bot.sh
@@ -42,17 +41,19 @@ jobs:
         id: create_pr
         env:
           NUMBER: ${{ github.event.inputs.number }}
-          # not using secrets.GITHUB_TOKEN since pull requests from that token do not run workflows
-          GITHUB_TOKEN: ${{ steps.otelbot-token.outputs.token }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # not using secrets.GITHUB_TOKEN for pr create since pull requests from that token do not run workflows
+          PR_TOKEN: ${{ steps.otelbot-token.outputs.token }}
         run: |
           commit=$(gh pr view $NUMBER --json mergeCommit --jq .mergeCommit.oid)
           title=$(gh pr view $NUMBER --json title --jq .title)
 
           branch="otelbot/backport-${NUMBER}-to-${GITHUB_REF_NAME//\//-}"
 
           git cherry-pick $commit
+          gh auth setup-git
           git push origin HEAD:$branch
-          pr_url=$(gh pr create --title "[$GITHUB_REF_NAME] $title" \
+          pr_url=$(GH_TOKEN="${PR_TOKEN}" gh pr create --title "[$GITHUB_REF_NAME] $title" \
                                 --body "Clean cherry-pick of #$NUMBER to the \`$GITHUB_REF_NAME\` branch." \
                                 --head $branch \
                                 --base $GITHUB_REF_NAME)

.github/workflows/prepare-patch-release.yml

@@ -14,11 +14,10 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          # zizmor: ignore[artipacked] Credentials are required by the branch push below.
-          persist-credentials: true
+          persist-credentials: false
 
-      - name: Install dependencies
-        run: pip install toml towncrier
+      - name: Set up uv
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
 
       - run: |
           if [[ ! $GITHUB_REF_NAME =~ ^release/v[0-9]+\.[0-9]+\.x-0\.[0-9]+bx$ ]]; then
@@ -28,8 +27,8 @@ jobs:
 
       - name: Set environment variables
         run: |
-          stable_version=$(./scripts/eachdist.py version --mode stable)
-          unstable_version=$(./scripts/eachdist.py version --mode prerelease)
+          stable_version=$(uv run --no-project --exclude-newer 3d --with toml ./scripts/eachdist.py version --mode stable)
+          unstable_version=$(uv run --no-project --exclude-newer 3d --with toml ./scripts/eachdist.py version --mode prerelease)
 
           if [[ $stable_version =~ ^([0-9]+\.[0-9]+)\.([0-9]+)$ ]]; then
             stable_major_minor="${BASH_REMATCH[1]}"
@@ -61,7 +60,7 @@ jobs:
         run: .github/scripts/update-version-patch.sh $STABLE_VERSION $UNSTABLE_VERSION $STABLE_VERSION_PREV $UNSTABLE_VERSION_PREV
 
       - name: Generate changelog
-        run: towncrier build --yes --version "$STABLE_VERSION/$UNSTABLE_VERSION"
+        run: uv run --no-project --exclude-newer 3d --with towncrier towncrier build --yes --version "$STABLE_VERSION/$UNSTABLE_VERSION"
 
       - name: Use CLA approved github bot
         run: .github/scripts/use-cla-approved-github-bot.sh
@@ -76,15 +75,17 @@ jobs:
       - name: Create pull request
         id: create_pr
         env:
-          # not using secrets.GITHUB_TOKEN since pull requests from that token do not run workflows
-          GITHUB_TOKEN: ${{ steps.otelbot-token.outputs.token }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # not using secrets.GITHUB_TOKEN for pr create since pull requests from that token do not run workflows
+          PR_TOKEN: ${{ steps.otelbot-token.outputs.token }}
         run: |
           message="Prepare release ${STABLE_VERSION}/${UNSTABLE_VERSION}"
           branch="otelbot/prepare-release-${STABLE_VERSION}-${UNSTABLE_VERSION}"
 
           git commit -a -m "$message"
+          gh auth setup-git
           git push origin HEAD:$branch
-          pr_url=$(gh pr create --title "[$GITHUB_REF_NAME] $message" \
+          pr_url=$(GH_TOKEN="${PR_TOKEN}" gh pr create --title "[$GITHUB_REF_NAME] $message" \
                        --body "$message." \
                        --head $branch \
                        --base $GITHUB_REF_NAME)
@@ -101,16 +102,16 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: main
-          # zizmor: ignore[artipacked] Credentials are required by the branch push below.
-          persist-credentials: true
+          persist-credentials: false
 
       - name: Use CLA approved github bot
         run: .github/scripts/use-cla-approved-github-bot.sh
 
       - name: Backport patch release changelog to main
         id: backport_pr
         env:
-          GITHUB_TOKEN: ${{ steps.otelbot-token.outputs.token }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR_TOKEN: ${{ steps.otelbot-token.outputs.token }}
         run: |
           release_branch="otelbot/prepare-release-${STABLE_VERSION}-${UNSTABLE_VERSION}"
           message="Backport ${STABLE_VERSION}/${UNSTABLE_VERSION} changelog"
@@ -123,8 +124,9 @@ jobs:
           git checkout FETCH_HEAD -- CHANGELOG.md
           git commit -m "$message"
 
+          gh auth setup-git
           git push origin HEAD:$branch
-          pr_url=$(gh pr create --title "$message" \
+          pr_url=$(GH_TOKEN="${PR_TOKEN}" gh pr create --title "$message" \
                                 --body "$body" \
                                 --head $branch \
                                 --base main)

.github/workflows/prepare-release-branch.yml

@@ -17,8 +17,8 @@ jobs:
         with:
           persist-credentials: false
 
-      - name: Install toml
-        run: pip install toml
+      - name: Set up uv
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
 
       - name: Verify prerequisites
         env:
@@ -30,7 +30,7 @@ jobs:
           fi
 
           if [[ ! -z $PRERELEASE_VERSION ]]; then
-            stable_version=$(./scripts/eachdist.py version --mode stable)
+            stable_version=$(uv run --no-project --exclude-newer 3d --with toml ./scripts/eachdist.py version --mode stable)
             stable_version=${stable_version//.dev/}
             if [[ $PRERELEASE_VERSION != ${stable_version}* ]]; then
               echo "$PRERELEASE_VERSION is not a prerelease for the version on main ($stable_version)"
@@ -47,24 +47,24 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          # zizmor: ignore[artipacked] Credentials are required by the branch pushes below.
-          persist-credentials: true
+          persist-credentials: false
 
-      - name: Install dependencies
-        run: pip install toml towncrier
+      - name: Set up uv
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
 
       - name: Create release branch
         env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           PRERELEASE_VERSION: ${{ github.event.inputs.prerelease_version }}
         run: |
           if [[ -z $PRERELEASE_VERSION ]]; then
-            stable_version=$(./scripts/eachdist.py version --mode stable)
+            stable_version=$(uv run --no-project --exclude-newer 3d --with toml ./scripts/eachdist.py version --mode stable)
             stable_version=${stable_version//.dev/}
           else
             stable_version=$PRERELEASE_VERSION
           fi
 
-          unstable_version=$(./scripts/eachdist.py version --mode prerelease)
+          unstable_version=$(uv run --no-project --exclude-newer 3d --with toml ./scripts/eachdist.py version --mode prerelease)
           unstable_version=${unstable_version//.dev/}
 
           if [[ $stable_version =~ ^([0-9]+)\.([0-9]+)\.0$ ]]; then
@@ -79,6 +79,7 @@ jobs:
             exit 1
           fi
 
+          gh auth setup-git
           git push origin HEAD:$release_branch_name
 
           echo "STABLE_VERSION=$stable_version" >> $GITHUB_ENV
@@ -89,7 +90,7 @@ jobs:
         run: .github/scripts/update-version.sh $STABLE_VERSION $UNSTABLE_VERSION
 
       - name: Generate changelog
-        run: towncrier build --yes --version "$STABLE_VERSION/$UNSTABLE_VERSION"
+        run: uv run --no-project --exclude-newer 3d --with towncrier towncrier build --yes --version "$STABLE_VERSION/$UNSTABLE_VERSION"
 
       - name: Use CLA approved github bot
         run: .github/scripts/use-cla-approved-github-bot.sh
@@ -104,15 +105,17 @@ jobs:
       - name: Create pull request against the release branch
         id: create_release_branch_pr
         env:
-          # not using secrets.GITHUB_TOKEN since pull requests from that token do not run workflows
-          GITHUB_TOKEN: ${{ steps.otelbot-token.outputs.token }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # not using secrets.GITHUB_TOKEN for pr create since pull requests from that token do not run workflows
+          PR_TOKEN: ${{ steps.otelbot-token.outputs.token }}
         run: |
           message="Prepare release ${STABLE_VERSION}/${UNSTABLE_VERSION}"
           branch="otelbot/prepare-release-${STABLE_VERSION}-${UNSTABLE_VERSION}"
 
           git commit -a -m "$message"
+          gh auth setup-git
           git push origin HEAD:$branch
-          pr_url=$(gh pr create --title "[$RELEASE_BRANCH_NAME] $message" \
+          pr_url=$(GH_TOKEN="${PR_TOKEN}" gh pr create --title "[$RELEASE_BRANCH_NAME] $message" \
                        --body "$message." \
                        --head $branch \
                        --base $RELEASE_BRANCH_NAME)
@@ -135,24 +138,23 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          # zizmor: ignore[artipacked] Credentials are required by the branch push below.
-          persist-credentials: true
+          persist-credentials: false
 
-      - name: Install dependencies
-        run: pip install toml towncrier
+      - name: Set up uv
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
 
       - name: Set environment variables
         env:
           PRERELEASE_VERSION: ${{ github.event.inputs.prerelease_version }}
         run: |
           if [[ -z $PRERELEASE_VERSION ]]; then
-            stable_version=$(./scripts/eachdist.py version --mode stable)
+            stable_version=$(uv run --no-project --exclude-newer 3d --with toml ./scripts/eachdist.py version --mode stable)
             stable_version=${stable_version//.dev/}
           else
             stable_version=$PRERELEASE_VERSION
           fi
 
-          unstable_version=$(./scripts/eachdist.py version --mode prerelease)
+          unstable_version=$(uv run --no-project --exclude-newer 3d --with toml ./scripts/eachdist.py version --mode prerelease)
           unstable_version=${unstable_version//.dev/}
 
           if [[ $stable_version =~ ^([0-9]+)\.([0-9]+)\.0$ ]]; then
@@ -188,7 +190,7 @@ jobs:
         run: .github/scripts/update-version.sh $STABLE_NEXT_VERSION $UNSTABLE_NEXT_VERSION
 
       - name: Generate changelog
-        run: towncrier build --yes --version "$STABLE_VERSION/$UNSTABLE_VERSION"
+        run: uv run --no-project --exclude-newer 3d --with towncrier towncrier build --yes --version "$STABLE_VERSION/$UNSTABLE_VERSION"
 
       - name: Use CLA approved github bot
         run: .github/scripts/use-cla-approved-github-bot.sh
@@ -203,16 +205,18 @@ jobs:
       - name: Create pull request against main
         id: create_main_pr
         env:
-          # not using secrets.GITHUB_TOKEN since pull requests from that token do not run workflows
-          GITHUB_TOKEN: ${{ steps.otelbot-token.outputs.token }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # not using secrets.GITHUB_TOKEN for pr create since pull requests from that token do not run workflows
+          PR_TOKEN: ${{ steps.otelbot-token.outputs.token }}
         run: |
           message="Update version to ${STABLE_NEXT_VERSION}/${UNSTABLE_NEXT_VERSION}"
           body="Update version to \`${STABLE_NEXT_VERSION}/${UNSTABLE_NEXT_VERSION}\`."
           branch="otelbot/update-version-to-${STABLE_NEXT_VERSION}-${UNSTABLE_NEXT_VERSION}"
 
           git commit -a -m "$message"
+          gh auth setup-git
           git push origin HEAD:$branch
-          pr_url=$(gh pr create --title "$message" \
+          pr_url=$(GH_TOKEN="${PR_TOKEN}" gh pr create --title "$message" \
                        --body "$body" \
                        --head $branch \
                        --base main)

.github/workflows/release.yml

@@ -21,13 +21,13 @@ jobs:
         with:
           persist-credentials: false
 
-      - name: Install toml
-        run: pip install toml
+      - name: Set up uv
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
 
       - name: Set environment variables
         run: |
-          stable_version=$(./scripts/eachdist.py version --mode stable)
-          unstable_version=$(./scripts/eachdist.py version --mode prerelease)
+          stable_version=$(uv run --no-project --exclude-newer 3d --with toml ./scripts/eachdist.py version --mode stable)
+          unstable_version=$(uv run --no-project --exclude-newer 3d --with toml ./scripts/eachdist.py version --mode prerelease)
 
           if [[ $stable_version =~ ^([0-9]+)\.([0-9]+)\.([0-9]+) ]]; then
             stable_major="${BASH_REMATCH[1]}"
@@ -84,10 +84,6 @@ jobs:
       - name: Build wheels
         run: ./scripts/build.sh
 
-      - name: Install twine
-        run: |
-          pip install twine
-
       # The step below publishes to testpypi in order to catch any issues
       # with the package configuration that would cause a failure to upload
       # to pypi. One example of such a failure is if a classifier is
@@ -99,14 +95,14 @@ jobs:
           TWINE_USERNAME: '__token__'
           TWINE_PASSWORD: ${{ secrets.test_pypi_token }}
         run: |
-          twine upload --repository testpypi --skip-existing --verbose dist/*
+          uv run --no-project --exclude-newer 3d --with twine twine upload --repository testpypi --skip-existing --verbose dist/*
 
       - name: Publish to PyPI
         env:
           TWINE_USERNAME: '__token__'
           TWINE_PASSWORD: ${{ secrets.pypi_password }}
         run: |
-          twine upload --skip-existing --verbose dist/*
+          uv run --no-project --exclude-newer 3d --with twine twine upload --skip-existing --verbose dist/*
 
       - name: Generate release notes
         env: