ci: harden supply chain security for release pipelines

[zhukaihan]

Summary

• SHA pin all external GitHub Actions to full commit SHAs across all 6 workflows (P0)
• Migrate PyPI and TestPyPI publishing to OIDC trusted publishers, removing long-lived PYPI_API_TOKEN and TEST_PYPI_API_TOKEN secrets (P0)
• Add CODEOWNERS file requiring @amplitude/experiment-sdk review for workflows, build config, and package metadata (P1)

Addresses SKY-10115 per the supply chain security baseline defined in SKY-10076.

Changes

OIDC Trusted Publishers (P0)

• publish-to-pypi.yml: Replaced REPOSITORY_USERNAME/REPOSITORY_PASSWORD token auth with pypa/gh-action-pypi-publish using OIDC. Added id-token: write permission. Changed environment from Unit Test to pypi. Disabled semantic-release's built-in PyPI upload (upload_to_PyPI = false in pyproject.toml) in favor of the dedicated publish action.
• publish-to-test-pypi.yml: Replaced user/password token auth with OIDC trusted publishing. Added testpypi environment and id-token: write permission.

SHA Pinning (P0)

All external actions pinned to full commit SHAs with version comments:

Action	Version	Workflows
actions/checkout	v3, v2	all
actions/setup-python	v6	all
lannonbr/repo-permission-check-action	2.0.2	publish-to-pypi, publish-to-test-pypi
pypa/gh-action-pypi-publish	v1.13.0	publish-to-pypi, publish-to-test-pypi
JamesIves/github-pages-deploy-action	4.1.5	docs
atlassian/gajira-login	master	jira-issue-create
atlassian/gajira-create	master	jira-issue-create

CODEOWNERS (P1)

Added .github/CODEOWNERS requiring @amplitude/sdk review for:

• .github/workflows/
• .github/CODEOWNERS
• setup.py
• pyproject.toml

Prerequisites (manual steps required before merging)

1. Configure PyPI trusted publisher: On pypi.org, add a trusted publisher for amplitude/experiment-python-server workflow publish-to-pypi.yml environment pypi
2. Configure TestPyPI trusted publisher: On test.pypi.org, add a trusted publisher for amplitude/experiment-python-server workflow publish-to-test-pypi.yml environment testpypi
3. Create GitHub environments: Create pypi and testpypi environments in repo settings
4. Revoke old tokens: After verifying OIDC publishing works, remove PYPI_API_TOKEN and TEST_PYPI_API_TOKEN from repo secrets

Test plan

• Configure PyPI and TestPyPI trusted publishers (see prerequisites above)
• Create pypi and testpypi GitHub environments
• Run Publish to TestPyPI workflow to verify OIDC publishing works
• Run Publish to PyPI workflow with dryRun=true to verify dry run still works
• Run Publish to PyPI workflow with dryRun=false to verify full release works
• Revoke old PYPI_API_TOKEN and TEST_PYPI_API_TOKEN secrets

🤖 Generated with Claude Code

---

Note

Medium Risk
Touches release/publishing workflows and semantic-release configuration; mistakes could break automated releases or publish to the wrong registry, though changes are largely CI/security hardening.

Overview
Hardens CI/release supply chain by adding a repo-wide .github/CODEOWNERS default owner and pinning all GitHub Actions in workflows to immutable commit SHAs.

Reworks PyPI/TestPyPI publishing to use OIDC trusted publishing via pypa/gh-action-pypi-publish, adding explicit permissions (incl. id-token: write), running tests before publishing, and switching semantic-release usage to the python-semantic-release action (with updated pyproject.toml semantic-release keys/branch config) rather than token-based uploads.

^{Written by Cursor Bugbot for commit 31396ec. This will update automatically on new commits. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

There are 4 total unresolved issues (including 3 from previous reviews).

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

[Copilot]

Pull request overview

Hardens CI/release supply-chain security by pinning third-party GitHub Actions to commit SHAs, migrating PyPI/TestPyPI publishing toward OIDC trusted publishing, and adding CODEOWNERS protections around repo changes affecting releases.

Changes:

• Pin external GitHub Actions to full commit SHAs across workflows.
• Refactor PyPI/TestPyPI publishing workflows to use OIDC (id-token: write) and pypa/gh-action-pypi-publish.
• Update semantic-release configuration in pyproject.toml and add a default .github/CODEOWNERS.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
pyproject.toml	Updates python-semantic-release configuration to support revised publishing/release flow.
.github/workflows/test.yml	Pins actions/checkout and actions/setup-python to SHAs.
.github/workflows/publish-to-test-pypi.yml	Migrates TestPyPI publishing to OIDC + pinned actions; adds job permissions and test run.
.github/workflows/publish-to-pypi.yml	Migrates PyPI publishing to OIDC + pinned actions; updates semantic-release invocation and adds dry-run path to TestPyPI.
.github/workflows/jira-issue-create.yml	Pins Atlassian Jira actions to SHAs.
.github/workflows/docs.yml	Pins checkout/setup-python and GitHub Pages deploy action to SHAs.
.github/CODEOWNERS	Introduces CODEOWNERS rules for review enforcement.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The step names reference PyPI (Checkout for release to PyPI, Publish distribution PyPI --dry-run) in the TestPyPI workflow, which is misleading for readers/operators. Rename these steps to match TestPyPI/dry-run intent to reduce release-run confusion.