Bump yara-python-dex to 1.1.0 and fix publishing

.github/dependabot.yml

@@ -0,0 +1,6 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly

.github/workflows/build_publish.yml

@@ -4,69 +4,57 @@ on:
   release:
     types: [created]
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Build wheels on ${{ matrix.os }}
     runs-on: ${{ matrix.os }}
     strategy:
+      fail-fast: false
       matrix:
-        os: [ubuntu-latest, windows-latest, macOS-latest]
+        os: [ubuntu-latest, ubuntu-24.04-arm, windows-latest, macos-latest]
 
     steps:
-      - uses: actions/checkout@v5.0.0
-
-      - uses: actions/setup-python@v5.6.0
-        name: Install Python
-
-      - name: Install cibuildwheel
-        run: python -m pip install cibuildwheel==4.2.1
-
-      - name: Get submodules
-        run: git submodule update --init --recursive
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          submodules: recursive
+          persist-credentials: false
 
-      - name: Build wheels for Windows
-        if: startsWith(matrix.os, 'windows')
-        run: |
-          python -m cibuildwheel --output-dir wheels
-        env:
-           CIBW_SKIP: "cp27-* pp27-*"  # skip Python 2.7 wheels
-           CIBW_ENABLE: "pypy pypy-eol"
-
-      - name: Build wheels for mac and manylinux
-        if: "!startsWith(matrix.os, 'windows')"
-        run: |
-          python -m cibuildwheel --output-dir wheels
-        env:
-           CIBW_ARCHS_MACOS: "auto auto32 x86_64 universal2 arm64"
-           CIBW_ENABLE: "pypy pypy-eol"
+      - name: Build wheels
+        uses: pypa/cibuildwheel@e090b81e30c4d855ea63bf4b6e59204c09a101ae # v4.2.1
 
-      - uses: actions/upload-artifact@v4.6.2
-        name: Upload wheels
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
-          name: wheels
-          path: ./wheels/*.whl
+          name: wheels-${{ matrix.os }}
+          path: ./wheelhouse/*.whl
+          if-no-files-found: error
 
   publish:
-     needs: build
-     name: Publish to PyPI
-     runs-on: ubuntu-latest
+    needs: build
+    name: Publish to PyPI
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/project/yara-python-dex/
+    permissions:
+      id-token: write
+      contents: read
+      actions: read
 
-     steps:
-     - name: Set up Python
-       uses: actions/setup-python@v5.3.0
-       with:
-         python-version: '3.x'
-     - name: Install twine
-       run: |
-         python -m pip install --upgrade pip
-         pip install twine
-     - name: Download Artifacts
-       uses: actions/download-artifact@v5.0.0
-       with:
-         name: wheels
-         path: ./wheels
-     - name: Publish
-       env:
-         TWINE_USERNAME: ${{ secrets.PYPI_USERNAME }}
-         TWINE_PASSWORD: ${{ secrets.PYPI_PASSWORD }}
-       run: twine upload ./wheels/* --skip-existing
+    steps:
+      - name: Download Artifacts
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          pattern: wheels-*
+          path: dist
+          merge-multiple: true
+
+      - name: Publish package distributions to PyPI
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
+        with:
+          # Many native wheels plus Sigstore attestations can exceed GitHub's
+          # ~5 minute OIDC token lifetime.
+          attestations: false
+          skip-existing: true

.github/workflows/build_test.yml

@@ -2,38 +2,23 @@ name: Build Test
 
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Build wheels on ${{ matrix.os }}
     runs-on: ${{ matrix.os }}
     strategy:
+      fail-fast: false
       matrix:
-        os: [ubuntu-latest, windows-latest, macOS-latest]
+        os: [ubuntu-latest, ubuntu-24.04-arm, windows-latest, macos-latest]
 
     steps:
-      - uses: actions/checkout@v5.0.0
-
-      - uses: actions/setup-python@v5.6.0
-        name: Install Python
-
-      - name: Install cibuildwheel
-        run: python -m pip install cibuildwheel==4.2.1
-
-      - name: Get submodules
-        run: git submodule update --init --recursive
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          submodules: recursive
+          persist-credentials: false
 
-      - name: Build wheels for Windows
-        if: startsWith(matrix.os, 'windows')
-        run: |
-          python -m cibuildwheel --output-dir wheels
-        env:
-           CIBW_SKIP: "cp27-* pp27-*"  # skip Python 2.7 wheels
-           CIBW_ENABLE: "pypy pypy-eol"
-
-      - name: Build wheels for mac and manylinux
-        if: "!startsWith(matrix.os, 'windows')"
-        run: |
-          python -m cibuildwheel --output-dir wheels
-        env:
-           CIBW_ARCHS_MACOS: "auto auto32 x86_64 universal2 arm64"
-           CIBW_ENABLE: "pypy pypy-eol"
+      - name: Build wheels
+        uses: pypa/cibuildwheel@e090b81e30c4d855ea63bf4b6e59204c09a101ae # v4.2.1

.github/workflows/test.yml

@@ -2,22 +2,28 @@ name: Test
 
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   test:
-
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v5.0.0
-    - name: Set up Python
-      uses: actions/setup-python@v5.6.0
-      with:
-        python-version: '3.x'
-    - name: Install dependencies
-      run: |
-        python -m pip install --upgrade pip
-        pip install setuptools wheel
-    - name: Build
-      run: |
-        git submodule update --init --recursive
-        python setup.py bdist_wheel
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          submodules: recursive
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.x"
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install setuptools wheel
+
+      - name: Build
+        run: python setup.py bdist_wheel

pyproject.toml

@@ -0,0 +1,9 @@
+[tool.cibuildwheel]
+# Build CPython betas/RCs when cibuildwheel ships them. Stable new CPython
+# versions land automatically once Dependabot bumps pypa/cibuildwheel.
+enable = ["cpython-prerelease", "pypy", "pypy-eol"]
+# 32-bit is no longer in the default manylinux images used by cibuildwheel 4.
+skip = ["*-win32", "*_i686"]
+
+[tool.cibuildwheel.macos]
+archs = ["x86_64", "arm64"]

setup.py

@@ -315,7 +315,7 @@ def run(self):
 
 setup(
     name='yara-python-dex',
-    version='1.0.9',
+    version='1.1.0',
     description='Python interface for YARA',
     long_description=readme,
     long_description_content_type='text/markdown',