publish pypi package through reusable_pypi_deployment.yml
What the developer wrote
Authored by Mathias BROUSSET
publish pypi package through reusable_pypi_deployment.yml
What changed, and why it matters
This commit adds a new automated GitHub Actions job that builds and publishes a Python package to PyPI whenever a Git tag starting with 'pyclient' is pushed. It is a routine CI/CD configuration change with no apparent security relevance.
No security action required. Reviewers may optionally verify that the reusable workflow and PyPI token secret are scoped appropriately, but this is standard release automation.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The diff adds a python_package_and_deploy job to .github/workflows/ci-workflow.yml that reuses LedgerHQ/ledger-app-workflows/.github/workflows/reusable_pypi_deployment.yml@v1. It triggers on tags matching refs/tags/pyclient*, builds the ledger_bitcoin package from ./bitcoin_client/, and publishes it to PyPI using secrets.PYPI_PUBLIC_API_TOKEN with JFrog deployment enabled. The .vscode/settings.json change is a trivial whitespace/newline adjustment.
Changed components
.github/workflows/ci-workflow.yml.vscode/settings.jsonInspect captured patch +14 / −2
diff --git a/.github/workflows/ci-workflow.yml b/.github/workflows/ci-workflow.yml
index 7bce7d6..c6add67 100644
--- a/.github/workflows/ci-workflow.yml
+++ b/.github/workflows/ci-workflow.yml
@@ -241,6 +241,19 @@ jobs:
name: benchmarks-log
path: tests_perf/benchmarks.json
+ python_package_and_deploy:
+ name: Build and deploy the bitcoin client Python package
+ uses: LedgerHQ/ledger-app-workflows/.github/workflows/reusable_pypi_deployment.yml@v1
+ if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/pyclient')
+ with:
+ package_name: ledger_bitcoin
+ package_directory: ./bitcoin_client/
+ jfrog_deployment: true
+ release: true
+ publish: true
+ secrets:
+ pypi_token: ${{ secrets.PYPI_PUBLIC_API_TOKEN }}
+
job_test_js_lib:
name: Tests with the JS library
needs: job_build
@@ -282,7 +295,6 @@ jobs:
yarn install
LOG_SPECULOS=1 LOG_APDUS=1 SPECULOS="/speculos/speculos.py" yarn test
-
deploy_js_client_check_tag:
name: Check that tag matches version in package.json prior to deploying on JFrog
needs: job_test_js_lib
diff --git a/.vscode/settings.json b/.vscode/settings.json
index 093c26d..ad935fa 100644
--- a/.vscode/settings.json
+++ b/.vscode/settings.json
@@ -7,4 +7,4 @@
"ledgerDevTools.appSettings": {
"selectedUseCase": "release"
}
-}
\ No newline at end of file
+}
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.