Kobi Hikri
8d89e58b2c
Restore PEP 740 attestations on release
FastAPI's published wheels carried signed provenance up to 0.128.0, but lost it in
the migration to uv (#14676 , commit b4ba7f46 ). Verified against PyPI's integrity API:
fastapi 0.127.0 -> HTTP 200 (has provenance)
fastapi 0.128.0 -> HTTP 200 (has provenance)
fastapi 0.129.0 -> HTTP 404 (none) <- first release after the uv migration
fastapi 0.139.0 -> HTTP 404 (none) <- latest
That migration replaced `pypa/gh-action-pypi-publish` (which emits PEP 740
attestations by default for Trusted Publishing projects) with `uv publish`, whose
docs state it "does not currently generate attestations". The OIDC Trusted Publishing
identity (`id-token: write`) is still configured, so only the emission step was lost.
This keeps `uv build` and hands the upload back to gh-action-pypi-publish, restoring
attestation emission. No other change.
Co-Authored-By: Claude Fable 5 <[email protected] >
1 week ago
Yurii Motov
b75bd318f3
👷 Use `FASTAPI_LATEST_CHANGES` token in `bump-pre-commit-hooks` workflow ( #15984 )
1 week ago
Yurii Motov
8bd152772e
👷 Add GH workflow to bump pre-commit hook versions ( #15873 )
1 week ago
dependabot[bot]
1e60e32992
⬆ Bump CodSpeedHQ/action from 4.17.6 to 4.18.1 in the github-actions group ( #15950 )
Signed-off-by: dependabot[bot] <[email protected] >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2 weeks ago
Sebastián Ramírez
787e11b426
👷 Fix notify translations checkout target ( #15933 )
3 weeks ago
Sebastián Ramírez
f500ef131e
👷 Fix latest-changes checkout target ( #15932 )
3 weeks ago
Sebastián Ramírez
9c913b7bf7
⬆️ Update issue-manager to 0.8.1 ( #15928 )
3 weeks ago
Sebastián Ramírez
a52b4b9283
⬆️ Update latest-changes to 0.6.1 ( #15926 )
3 weeks ago
Yurii Motov
8da95e1842
👷 Remove not needed `allow-unsafe-pr-checkout: true` ( #15876 )
3 weeks ago
dependabot[bot]
f6f3d25d10
⬆ Bump the github-actions group with 5 updates ( #15872 )
Signed-off-by: dependabot[bot] <[email protected] >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yurii Motov <[email protected] >
3 weeks ago
dependabot[bot]
4a298abff1
⬆ Bump CodSpeedHQ/action from 4.17.0 to 4.17.5 in the github-actions group ( #15826 )
Signed-off-by: dependabot[bot] <[email protected] >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
3 weeks ago
Sebastián Ramírez
82c527e714
👷 Simplify pull request workflow triggers ( #15836 )
4 weeks ago
Sebastián Ramírez
f6ea6b1f12
👷 Update issue-manager to 0.7.1 ( #15833 )
4 weeks ago
Sebastián Ramírez
fcc8e1f994
⬆️ Update issue-manager to 0.7.0 ( #15831 )
4 weeks ago
Sebastián Ramírez
8f3db3d3e7
🔒 ️ Update zizmor workflow security checks ( #15820 )
1 month ago
Sebastián Ramírez
7cb1ab6264
👷 Fix test-alls-green ( #15803 )
1 month ago
dependabot[bot]
2c77ae3f76
⬆ Bump astral-sh/setup-uv from 8.1.0 to 8.2.0 in the github-actions group ( #15776 )
Signed-off-by: dependabot[bot] <[email protected] >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yurii Motov <[email protected] >
1 month ago
dependabot[bot]
13b2b4cb34
⬆ Bump the github-actions group with 3 updates ( #15720 )
Signed-off-by: dependabot[bot] <[email protected] >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yurii Motov <[email protected] >
1 month ago
dependabot[bot]
e95d3aab28
⬆ Bump the github-actions group with 2 updates ( #15682 )
Signed-off-by: dependabot[bot] <[email protected] >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2 months ago
Sebastián Ramírez
b4d58fddee
👷 Automate release preparation ( #15661 )
2 months ago
dependabot[bot]
2a1506d167
⬆ Bump CodSpeedHQ/action from 4.14.0 to 4.15.1 ( #15513 )
Signed-off-by: dependabot[bot] <[email protected] >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yurii Motov <[email protected] >
2 months ago
Yurii Motov
a3558be5f8
🔒 ️ Improve GitHub actions security ( #15607 )
2 months ago
Yurii Motov
59d4a80fcf
✅ Add `httpx2` test dependency to avoid deprecation warning ( #15603 )
2 months ago
dependabot[bot]
a314e3be3b
⬆ Bump cloudflare/wrangler-action from 3.15.0 to 4.0.0 ( #15571 )
Signed-off-by: dependabot[bot] <[email protected] >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2 months ago
Sebastián Ramírez
31ced9d49e
🔧 Migrate docs from MkDocs to Zensical ( #15563 )
2 months ago
Sofie Van Landeghem
622dcdc99c
🔒 ️ Only allow team members to modify dependencies ( #15548 )
2 months ago
dependabot[bot]
6939bf8bb7
⬆ Bump actions/add-to-project from 1.0.2 to 2.0.0 ( #15490 )
Signed-off-by: dependabot[bot] <[email protected] >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2 months ago
dependabot[bot]
a0f42dd7d5
⬆ Bump actions/labeler from 6.0.1 to 6.1.0 ( #15507 )
Signed-off-by: dependabot[bot] <[email protected] >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2 months ago
Motov Yurii
33ed5aecdf
👷 Fix missing credentials issue in `translate` workflow ( #15468 )
3 months ago
dependabot[bot]
4bad6d2597
⬆ Bump CodSpeedHQ/action from 4.12.1 to 4.14.0 ( #15436 )
Signed-off-by: dependabot[bot] <[email protected] >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
3 months ago
dependabot[bot]
3747204677
⬆ Bump astral-sh/setup-uv from 7.6.0 to 8.1.0 ( #15415 )
Signed-off-by: dependabot[bot] <[email protected] >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
3 months ago
dependabot[bot]
7402e33375
⬆ Bump cloudflare/wrangler-action from 3.14.1 to 3.15.0 ( #15405 )
Signed-off-by: dependabot[bot] <[email protected] >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
3 months ago
dependabot[bot]
c874e067dc
⬆ Bump actions/upload-artifact from 7.0.0 to 7.0.1 ( #15374 )
Signed-off-by: dependabot[bot] <[email protected] >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
3 months ago
dependabot[bot]
a595e44d28
⬆ Bump actions/cache from 5.0.4 to 5.0.5 ( #15385 )
Signed-off-by: dependabot[bot] <[email protected] >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
3 months ago
Motov Yurii
3f4169be1a
🔒 ️ Add zizmor and fix audit findings ( #15316 )
3 months ago
Sofie Van Landeghem
4b264878d7
⬆️ Support free-threaded Python 3.14t ( #15149 )
3 months ago
Sofie Van Landeghem
aeb9f4bb85
⬆️ Increase lower bound to `pydantic >=2.9.0.` and fix the test suite ( #15139 )
Co-authored-by: Motov Yurii <[email protected] >
4 months ago
Motov Yurii
6e5e94208e
🔨 Fix `commit_in_place` passed via env variable in `translate.yml` workflow ( #15151 )
4 months ago
Motov Yurii
d75bc1b724
👷 Re-enable translation workflow run by cron in CI (twice a month) ( #15145 )
* Re-enable translation workflow in CI
* Run translation workflow twice a month
4 months ago
dependabot[bot]
b4b76c811b
⬆ Bump dorny/paths-filter from 3 to 4 ( #15106 )
Bumps [dorny/paths-filter](https://github.com/dorny/paths-filter ) from 3 to 4.
- [Release notes](https://github.com/dorny/paths-filter/releases )
- [Changelog](https://github.com/dorny/paths-filter/blob/master/CHANGELOG.md )
- [Commits](https://github.com/dorny/paths-filter/compare/v3...v4 )
---
updated-dependencies:
- dependency-name: dorny/paths-filter
dependency-version: '4'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <[email protected] >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
4 months ago
dependabot[bot]
80c5fb6b1c
⬆ Bump actions/download-artifact from 7 to 8 ( #15020 )
Bumps [actions/download-artifact](https://github.com/actions/download-artifact ) from 7 to 8.
- [Release notes](https://github.com/actions/download-artifact/releases )
- [Commits](https://github.com/actions/download-artifact/compare/v7...v8 )
---
updated-dependencies:
- dependency-name: actions/download-artifact
dependency-version: '8'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <[email protected] >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
5 months ago
dependabot[bot]
2f098a3121
⬆ Bump actions/upload-artifact from 6 to 7 ( #15019 )
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact ) from 6 to 7.
- [Release notes](https://github.com/actions/upload-artifact/releases )
- [Commits](https://github.com/actions/upload-artifact/compare/v6...v7 )
---
updated-dependencies:
- dependency-name: actions/upload-artifact
dependency-version: '7'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <[email protected] >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
5 months ago
Motov Yurii
5aacc7b6a0
🔨 Run tests with `pytest-xdist` and `pytest-cov` ( #14992 )
5 months ago
Motov Yurii
6af3832126
👷 Allow skipping `benchmark` job in `test` workflow ( #14974 )
5 months ago
Sebastián Ramírez
4da264f0f3
👷 Do not run codspeed with coverage as it's not tracked ( #14966 )
5 months ago
Sebastián Ramírez
1cea8f659c
👷 Do not include benchmark tests in coverage to speed up coverage processing ( #14965 )
5 months ago
Sebastián Ramírez
c9455d5400
👷 Fix CI, do not attempt to publish `fastapi-slim` ( #14958 )
5 months ago
Motov Yurii
cf058239d1
👷 Always run tests on push to `master` branch and when run by scheduler ( #14940 )
5 months ago
Sebastián Ramírez
ad4e8e0060
➖ Drop support for Python 3.9 ( #14897 )
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
5 months ago
Sebastián Ramírez
ffb8965260
♻️ Update build setup for `fastapi-slim`, deprecate it, and make it only depend on `fastapi` ( #14894 )
5 months ago