ci: harden supply chain security for release pipelines

.github/CODEOWNERS

@@ -0,0 +1,2 @@
+# Default: require experiment-sdk team review for all files
+* @amplitude/experiment-sdk

.github/workflows/docs.yml

@@ -7,10 +7,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
 
       - name: Set up pdoc
         run:  pip install pdoc3
@@ -19,7 +19,7 @@ jobs:
         run:  pdoc ./src/amplitude_experiment -o ./docs --html
 
       - name: Deploy
-        uses: JamesIves/github-pages-deploy-action@4.1.5
+        uses: JamesIves/github-pages-deploy-action@0f24da7de3e7e135102609a4c9633b025be8411b # 4.1.5
         with:
           branch: gh-pages
           folder: docs/amplitude_experiment

.github/workflows/jira-issue-create.yml

@@ -12,15 +12,15 @@ jobs:
     name: SDK Bot Jira Issue Creation
     steps:
       - name: Login
-        uses: atlassian/gajira-login@master
+        uses: atlassian/gajira-login@c22a5debd482401472b285de4f6deedf70ddbb92 # master
         env:
           JIRA_BASE_URL: ${{ secrets.JIRA_BASE_URL }}
           JIRA_USER_EMAIL: ${{ secrets.JIRA_USER_EMAIL }}
           JIRA_API_TOKEN: ${{ secrets.JIRA_API_TOKEN }}
 
       - name: Create issue
         id: create
-        uses: atlassian/gajira-create@master
+        uses: atlassian/gajira-create@1c54357fdde9dab6273a0e26d67cb175ffffe498 # master
         with:
           project: ${{ secrets.JIRA_PROJECT }}
           issuetype: Task

.github/workflows/publish-to-pypi.yml

@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: ${{ github.actor }} permission check to do a release
-        uses: "lannonbr/repo-permission-check-action@2.0.2"
+        uses: lannonbr/repo-permission-check-action@2bb8c89ba8bf115c4bfab344d6a6f442b24c9a1f # 2.0.2
         with:
           permission: "write"
         env:
@@ -25,19 +25,22 @@ jobs:
     name: Build and publish to PyPI
     runs-on: ubuntu-latest
     needs: [authorize]
+    permissions:
+      contents: write
+      id-token: write
     steps:
       - name: Checkout for release to PyPI
-        uses: actions/checkout@v3
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
         with:
           fetch-depth: 0
 
       - name: Set up Python 3.8
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
           python-version: 3.8
 
       - name: Install dependencies
-        run: python -m pip install build setuptools wheel twine amplitude_analytics parameterized python-dotenv~=0.21.1 python-semantic-release==7.34.6
+        run: python -m pip install build setuptools wheel twine amplitude_analytics parameterized python-dotenv~=0.21.1
 
       - name: Install requirements
         run: pip install -r requirements.txt && pip install -r requirements-dev.txt
@@ -50,19 +53,26 @@ jobs:
           EU_SECRET_KEY: ${{ secrets.EU_SECRET_KEY }}
         run: python -m unittest discover -s ./tests -p '*_test.py'
 
-      - name: Publish distribution PyPI --dry-run
+      - name: Python Semantic Release --dry-run
         if: ${{ github.event.inputs.dryRun == 'true'}}
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          semantic-release publish --noop
-      - name: Publish distribution PyPI
+        uses: python-semantic-release/python-semantic-release@350c48fcb3ffcdfd2e0a235206bc2ecea6b69df0 # v10.5.3
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          push: false
+          vcs_release: false
+
+      - name: Publish to Test PyPI
+        if: ${{ github.event.inputs.dryRun == 'true'}}
+        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0
+        with:
+          repository-url: https://test.pypi.org/legacy/
+
+      - name: Python Semantic Release
         if: ${{ github.event.inputs.dryRun == 'false'}}
-        run: |
-          git config user.name amplitude-sdk-bot
-          git config user.email amplitude-sdk-bot@users.noreply.github.com
-          semantic-release publish
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          REPOSITORY_USERNAME: __token__
-          REPOSITORY_PASSWORD: ${{ secrets.PYPI_API_TOKEN }}
+        uses: python-semantic-release/python-semantic-release@350c48fcb3ffcdfd2e0a235206bc2ecea6b69df0 # v10.5.3
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Publish to PyPI
+        if: ${{ github.event.inputs.dryRun == 'false'}}
+        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0

.github/workflows/publish-to-test-pypi.yml

@@ -8,7 +8,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: ${{ github.actor }} permission check to do a release
-        uses: "lannonbr/repo-permission-check-action@2.0.2"
+        uses: lannonbr/repo-permission-check-action@2bb8c89ba8bf115c4bfab344d6a6f442b24c9a1f # 2.0.2
         with:
           permission: "write"
         env:
@@ -18,23 +18,43 @@ jobs:
     name: Build and publish to TestPyPI
     runs-on: ubuntu-latest
     needs: [authorize]
+    environment: Unit Test
+    permissions:
+      contents: read
+      id-token: write
     steps:
-      - uses: actions/checkout@v3
+      - name: Checkout for release to PyPI
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
+        with:
+          fetch-depth: 0
 
       - name: Set up Python 3.8
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
           python-version: 3.8
 
       - name: Install dependencies
-        run: python -m pip install build setuptools wheel twine amplitude_analytics parameterized
+        run: python -m pip install build setuptools wheel twine amplitude_analytics parameterized python-dotenv~=0.21.1
+
+      - name: Install requirements
+        run: pip install -r requirements.txt && pip install -r requirements-dev.txt
+
+      - name: Run Test
+        env:
+          API_KEY: ${{ secrets.API_KEY }}
+          SECRET_KEY: ${{ secrets.SECRET_KEY }}
+          EU_API_KEY: ${{ secrets.EU_API_KEY }}
+          EU_SECRET_KEY: ${{ secrets.EU_SECRET_KEY }}
+        run: python -m unittest discover -s ./tests -p '*_test.py'
 
-      - name: Build a binary wheel and a source tarball
-        run: python -m build --sdist --wheel --outdir dist/ .
+      - name: Publish distribution PyPI --dry-run
+        uses: python-semantic-release/python-semantic-release@350c48fcb3ffcdfd2e0a235206bc2ecea6b69df0 # v10.5.3
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          push: false
+          vcs_release: false
 
-      - name: Publish distribution Test PyPI
-        uses: pypa/gh-action-pypi-publish@release/v1
+      - name: Publish to Test PyPI
+        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0
         with:
-          user: __token__
-          password: ${{ secrets.TEST_PYPI_API_TOKEN }}
-          repository_url: https://test.pypi.org/legacy/
+          repository-url: https://test.pypi.org/legacy/

.github/workflows/test.yml

@@ -11,10 +11,10 @@ jobs:
         python-version: [ "3.8" ]
     steps:
       - name: Checkout source code
-        uses: actions/checkout@v3
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
 
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
           python-version: ${{ matrix.python-version }}
           cache: 'pip'

pyproject.toml

@@ -1,14 +1,20 @@
 [tool.semantic_release]
-version_variable = [
+version_variables = [
     "src/amplitude_experiment/version.py:__version__"
 ]
 major_on_zero = true
-branch = "main"
-upload_to_PyPI = true
-upload_to_release = true
 build_command = "pip install build && python -m build"
-version_source = "commit"
-commit_version_number = true
-commit_subject = "chore(release): Bump version to {version}"
 commit_message = "chore(release): Bump version to {version}"
 commit_author = "amplitude-sdk-bot <amplitude-sdk-bot@users.noreply.github.com>"
+
+[tool.semantic_release.publish]
+upload_to_vcs_release = true
+
+[tool.semantic_release.branches.main]
+match = "(main|master)"
+prerelease = false
+
+[tool.semantic_release.branches.alpha]
+match = "^(?!.*main|master).*$"
+prerelease = true
+prerelease_token = "alpha"