Prep 3.0.0 (#143)

CHANGELOG.md

@@ -0,0 +1,64 @@
+# Changelog
+
+All notable changes to `gh-action-sigstore-python` will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
+
+All versions prior to 3.0.0 are untracked.
+
+## [Unreleased]
+
+## [3.0.0]
+
+### Added
+
+* `inputs` now allows recursive globbing with `**`
+ ([#106](https://github.com/sigstore/gh-action-sigstore-python/pull/106))
+
+### Removed
+
+* The following settings have been removed: `fulcio-url`, `rekor-url`,
+ `ctfe`, `rekor-root-pubkey`
+ ([#140](https://github.com/sigstore/gh-action-sigstore-python/pull/140))
+* The following output settings have been removed: `signature`,
+ `certificate`, `bundle`
+ ([#146](https://github.com/sigstore/gh-action-sigstore-python/pull/146))
+
+
+### Changed
+
+* `inputs` is now parsed according to POSIX shell lexing rules, improving
+ the action's consistency when used with filenames containing whitespace
+ or other significant characters
+ ([#104](https://github.com/sigstore/gh-action-sigstore-python/pull/104))
+
+* `inputs` is now optional *if* `release-signing-artifacts` is true
+ *and* the action's event is a `release` event. In this case, the action
+ takes no explicit inputs, but signs the source archives already attached
+ to the associated release
+ ([#110](https://github.com/sigstore/gh-action-sigstore-python/pull/110))
+
+* The default suffix has changed from `.sigstore` to `.sigstore.json`,
+ per Sigstore's client specification
+ ([#140](https://github.com/sigstore/gh-action-sigstore-python/pull/140))
+
+* `release-signing-artifacts` now defaults to `true`
+ ([#142](https://github.com/sigstore/gh-action-sigstore-python/pull/142))
+
+### Fixed
+
+* The `release-signing-artifacts` setting no longer causes a hard error
+ when used under the incorrect event
+ ([#103](https://github.com/sigstore/gh-action-sigstore-python/pull/103))
+
+* Various deprecations present in `sigstore-python`'s 2.x series have been
+ resolved
+ ([#140](https://github.com/sigstore/gh-action-sigstore-python/pull/140))
+
+* This workflow now supports CI runners that use PEP 668 to constrain global
+ package prefixes
+ ([#145](https://github.com/sigstore/gh-action-sigstore-python/pull/145))
+
+
+[Unreleased]: https://github.com/sigstore/gh-action-sigstore-python/compare/v3.0.0...HEAD
+[3.0.0]: https://github.com/sigstore/gh-action-sigstore-python/compare/v2.1.1...v3.0.0

README.md

@@ -29,7 +29,7 @@ jobs:
  - uses: actions/checkout@v3
  - name: install
  run: python -m pip install .
- - uses: sigstore/gh-action-sigstore-python@v2.1.1
+ - uses: sigstore/gh-action-sigstore-python@v3.0.0
  with:
  inputs: file.txt
 ```
@@ -53,15 +53,15 @@ provided unless [release-signing-artifacts](#release-signing-artifacts) is set t
 To sign one or more files:
 
 ```yaml
-- uses: sigstore/gh-action-sigstore-python@v2.1.1
+- uses: sigstore/gh-action-sigstore-python@v3.0.0
  with:
  inputs: file0.txt file1.txt file2.txt
 ```
 
 The `inputs` argument also supports file globbing:
 
 ```yaml
-- uses: sigstore/gh-action-sigstore-python@v2.1.1
+- uses: sigstore/gh-action-sigstore-python@v3.0.0
  with:
  inputs: ./path/to/inputs/*.txt
 ```
@@ -70,7 +70,7 @@ Multiple lines are fine, and whitespace in filenames can also be escaped using
 POSIX shell lexing rules:
 
 ```yaml
-- uses: sigstore/gh-action-sigstore-python@v2.1.1
+- uses: sigstore/gh-action-sigstore-python@v3.0.0
  with:
  inputs: |
  ./path/to/inputs/*.txt
@@ -90,7 +90,7 @@ The `identity-token` setting controls the OpenID Connect token provided to Fulci
 workflow will use the credentials found in the GitHub Actions environment.
 
 ```yaml
-- uses: sigstore/gh-action-sigstore-python@v2.1.1
+- uses: sigstore/gh-action-sigstore-python@v3.0.0
  with:
  inputs: file.txt
  identity-token: ${{ IDENTITY_TOKEN }} # assigned elsewhere
@@ -106,7 +106,7 @@ Server during OAuth2.
 Example:
 
 ```yaml
-- uses: sigstore/gh-action-sigstore-python@v2.1.1
+- uses: sigstore/gh-action-sigstore-python@v3.0.0
  with:
  inputs: file.txt
  oidc-client-id: alternative-sigstore-id
@@ -122,7 +122,7 @@ Connect Server during OAuth2.
 Example:
 
 ```yaml
-- uses: sigstore/gh-action-sigstore-python@v2.1.1
+- uses: sigstore/gh-action-sigstore-python@v3.0.0
  with:
  inputs: file.txt
  oidc-client-secret: alternative-sigstore-secret
@@ -138,7 +138,7 @@ instead of the default production instances.
 Example:
 
 ```yaml
-- uses: sigstore/gh-action-sigstore-python@v2.1.1
+- uses: sigstore/gh-action-sigstore-python@v3.0.0
  with:
  inputs: file.txt
  staging: true
@@ -161,7 +161,7 @@ and `verify-oidc-issuer` settings. Failing to pass these will produce an error.
 Example:
 
 ```yaml
-- uses: sigstore/gh-action-sigstore-python@v2.1.1
+- uses: sigstore/gh-action-sigstore-python@v3.0.0
  with:
  inputs: file.txt
  verify: true
@@ -184,7 +184,7 @@ This setting may only be used in conjunction with `verify-oidc-issuer`.
 Supplying it without `verify-oidc-issuer` will produce an error.
 
 ```yaml
-- uses: sigstore/gh-action-sigstore-python@v2.1.1
+- uses: sigstore/gh-action-sigstore-python@v3.0.0
  with:
  inputs: file.txt
  verify: true
@@ -209,7 +209,7 @@ Supplying it without `verify-cert-identity` will produce an error.
 Example:
 
 ```yaml
-- uses: sigstore/gh-action-sigstore-python@v2.1.1
+- uses: sigstore/gh-action-sigstore-python@v3.0.0
  with:
  inputs: file.txt
  verify: true
@@ -231,7 +231,7 @@ workflow artifact retention period is used.
 Example:
 
 ```yaml
-- uses: sigstore/gh-action-sigstore-python@v2.1.1
+- uses: sigstore/gh-action-sigstore-python@v3.0.0
  with:
  inputs: file.txt
  upload-signing-artifacts: true
@@ -258,7 +258,7 @@ permissions:
 
 # ...
 
-- uses: sigstore/gh-action-sigstore-python@v2.1.1
+- uses: sigstore/gh-action-sigstore-python@v3.0.0
  with:
  inputs: file.txt
  release-signing-artifacts: true
@@ -298,7 +298,7 @@ permissions:
  Example:
 
  ```yaml
- - uses: sigstore/gh-action-sigstore-python@v2.1.1
+ - uses: sigstore/gh-action-sigstore-python@v3.0.0
  with:
  inputs: file.txt
  internal-be-careful-debug: true