Repository navigation

test(acceptance): publish locked installed-package harness #12

	name: Installed package acceptance

	on:
	push:
	pull_request:
	workflow_dispatch:

	permissions:
	contents: read

	jobs:
	build:
	outputs:
	package-artifact-id: ${{ steps.upload-package.outputs.artifact-id }}
	runs-on: ubuntu-latest
	timeout-minutes: 20
	steps:
	- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
	with:
	persist-credentials: false
	- uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
	with:
	python-version: '3.14'
	- uses: astral-sh/setup-uv@d0cc045d04ccac9d8b7881df0226f9e82c39688e # v6
	- run: uv sync --frozen
	- run: uv run python -m build --wheel --outdir candidate
	- run: bash scripts/build-acceptance.sh candidate/*.whl candidate
	- uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
	id: upload-package
	with:
	name: client-acceptance
	path: candidate/*
	if-no-files-found: error

	acceptance-check:
	needs: build
	uses: ./.github/workflows/verify-acceptance.yml
	with:
	package-artifact-id: ${{ needs.build.outputs.package-artifact-id }}

	attest:
	if: github.event_name != 'pull_request'
	needs: [build, acceptance-check]
	runs-on: ubuntu-latest
	timeout-minutes: 5
	permissions:
	contents: read
	id-token: write
	attestations: write
	steps:
	- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
	with:
	artifact-ids: ${{ needs.build.outputs.package-artifact-id }}
	merge-multiple: true
	path: candidate
	- uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4
	with:
	subject-path: candidate/*