build-wheel.yml

name: Build pip wheel

permissions: read-all

on:
  push:
    branches: [ "main" ]
  workflow_dispatch:

jobs:
  build:
    name: Build wheel
    runs-on: ${{ github.repository_owner == 'intel' && 'intel-ubuntu-latest' || 'ubuntu-latest' }}
    permissions:
      id-token: write
      attestations: write
      contents: read
    strategy:
      fail-fast: false
      matrix:
        python-version:
        - "3.12"
    if: github.repository == 'intel/cve-bin-tool' # run on origin repo only
    steps:
    - name: Harden Runner
      uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
      with:
        egress-policy: audit

    - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
    - uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
      with:
        python-version: ${{ matrix.python-version }}
        cache: 'pip'
    - name: Install dependencies
      run: |
        python -m pip install --upgrade pip setuptools wheel build
    - name: Build
      run: |
        python -m build .
    - name: Get built filenames
      id: filename
      run: |
        echo "tar=$(cd dist/ && echo *.tar.gz)" >> $GITHUB_OUTPUT
        echo "whl=$(cd dist/ && echo *.tar.gz)" >> $GITHUB_OUTPUT
    #- name: Attest Build Provenance for tar
    #  uses: actions/attest-build-provenance@ef244123eb79f2f7a7e75d99086184180e6d0018 # v1.4.4
    #  with:
    #    subject-path: "dist/${{ steps.filename.outputs.tar }}"
    #- name: Attest Build Provenance for whl
    #  uses: actions/attest-build-provenance@ef244123eb79f2f7a7e75d99086184180e6d0018 # v1.4.4
    #  with:
    #    subject-path: "dist/${{ steps.filename.outputs.whl }}"
    # TODO Upload to pypi on release creation