ppkarwasz opened a new pull request, #37: URL: https://github.com/apache/tooling-actions/pull/37
## Summary New composite action `upload-source-to-atr` that composes a source release candidate in one step: 1. creates a reproducible source archive of `HEAD` with `git archive | gzip -n`, following the [reproducible archives](https://reproducible-builds.org/docs/archives/) guidance, 2. computes its SHA-512 checksum and the [SWHID](https://swhid.org/) of the expanded tree with [`asfswhid`](https://github.com/apache/tooling-asfswhid), 3. signs it with the PMC key imported through the ASF-allowlisted `crazy-max/ghaction-import-gpg`, 4. uploads the archive, checksum and signature to ATR through the existing `upload-to-atr` action, referenced with the `$/` self-repository syntax. Inputs are the ATR project and version, an optional archive prefix (default `apache-<project>-<version>-src`) and top-level directory, the GPG key and passphrase from the repository secrets, and the expected fingerprint from a repository or organization variable. This generalizes the workflow @tisonkun wrote in apache/asyncband#319 so that other projects do not have to copy it. ## Other changes - The shell and Python logic lives in scripts next to `action.yml`; the license-header hook now covers `.sh` and `.py` files. - `asfswhid` is pinned with hashes in `requirements.txt` and tracked by Dependabot. - zizmor is bumped to v1.30.1, the first release line that understands the `$/` reference. ## Testing - `pre-commit run --all-files` passes. - The archive, SWHID and signing scripts were run end to end in an `ubuntu:24.04` container with a throwaway key; the archive is byte-for-byte reproducible and the SWHID matches the git tree id unless `.gitattributes` alter the export. - A real upload to ATR still needs a project key and trust configuration. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
