🐛 Add custom packaging workflow for Python

Packaging workflows are allowed to have `contents: write` permission.
By adding relekang/python-semantic-release to the list of
packaging GitHub Actions workflows, we avoid false positivies in
the token permission check.

checks/packaging.go

@@ -178,6 +178,17 @@ func isPackagingWorkflow(workflow *actionlint.Workflow, fp string, dl checker.De
 			},
 			LogText: "candidate python publishing workflow using pypi",
 		},
+		{
+			// Python packages.
+			// This is a custom Python packaging workflow based on semantic versioning.
+			// TODO(#1642): accept custom workflows through a separate configuration.
+			Steps: []*fileparser.JobMatcherStep{
+				{
+					Uses: "relekang/python-semantic-release",
+				},
+			},
+			LogText: "candidate python publishing workflow using pypi",
+		},
 		{
 			// Go packages.
 			Steps: []*fileparser.JobMatcherStep{

checks/packaging_test.go

@@ -78,6 +78,11 @@ func TestIsPackagingWorkflow(t *testing.T) {
 			filename: "./testdata/.github/workflows/github-workflow-packaging-pypi.yaml",
 			expected: true,
 		},
+		{
+			name:     "python semantic release publish",
+			filename: "./testdata/github-workflow-packaging-python-semantic-release.yaml",
+			expected: true,
+		},
 		{
 			name:     "go publish",
 			filename: "./testdata/.github/workflows/github-workflow-packaging-go.yaml",

checks/testdata/github-workflow-packaging-python-semantic-release.yaml

@@ -0,0 +1,24 @@
+# Copyright 2022 Security Scorecard Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      - name: Python Semantic Release
+        uses: relekang/[email protected]
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          pypi_token: ${{ secrets.TEST_PYPI_API_TOKEN }}