-
Notifications
You must be signed in to change notification settings - Fork 32
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
ci: update on-tag pypi release action #3078
Conversation
This PR causes the following changes to the html docs (ubuntu-latest-3.11):
See CI logs for the full diff. |
This PR causes the following changes to the html docs (ubuntu-latest-3.11):
See CI logs for the full diff. |
The main problem with the workflow is that the GA security model doesn't allow jobs to depend on other jobs that include secrets. So the 'test-release' part cannot depend on 'create-python-dist', as long as the latter uses secrets to upload the packages. Either the upload needs to split off to its own job, or we need to find a way to work around the restriction. The idea behind this test workflow was to check if the sdist/wheel packages were created correctly (to catch issues like #2040). I don't think we need the full copy of the special jobs from the main test files. Since we release universal wheel, we should be good enough to just check that both packages install OK on all supported platofrms Not sure if there's a quick fix for the existing release scripts. I used to test them on a local repo creating test tags (and skipping uploads), because of GA security constraints. It might be worth using this opportunity to adjust how CI should work combined with release scripts. |
The logs from the previous run have expired, but I do see "Skip output 'sdist' since it may contain secret.". On my fork, it doesn't seem to have a problem with this https://github.com/kmantel/PsyNeuLink/actions/runs/11527544088. Is that what you meant by how you tested it? Where it's possibly different repo or secrets settings that are letting it through. Or maybe the security model has changed since this was last looked at? I can see the benefit of reworking CI to use wheels; if shifting to that, I think I'd just go ahead with the next release first without any CI changes. |
Thanks. hm, it looks like the rules now allow the existing flow. I think it makes sense to fix/resurrect the script independently of changes to the main CI jobs. I assumed that the test-release job will fail, but if it runs, it should do something useful. |
@@ -69,9 +69,60 @@ jobs: | |||
strategy: | |||
fail-fast: false | |||
matrix: | |||
python-version: [3.7, 3.8, 3.9] | |||
os: [ubuntu-latest, macos-latest, windows-latest] | |||
dist: [wheel, sdist] |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
'dist' might still be needed
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
It's in the previous matrix that I'm putting back, and it's used by the - name: Install wheel
and - name: Install sdist
steps
.github/workflows/test-release.yml
Outdated
python-architecture: ['x64'] | ||
extra-args: [''] | ||
os: [ubuntu, macos, windows] | ||
version-restrict: [''] |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
'version-restrict' is not used in this job
.github/workflows/test-release.yml
Outdated
dist: [wheel, sdist] | ||
python-version: ['3.7', '3.11', '3.12'] | ||
python-architecture: ['x64'] | ||
extra-args: [''] |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
'extra-args' are not used in this job
.github/workflows/test-release.yml
Outdated
os: [ubuntu-latest, macos-latest, windows-latest] | ||
dist: [wheel, sdist] | ||
python-version: ['3.7', '3.11', '3.12'] | ||
python-architecture: ['x64'] |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
'python-architecture' is not used in the setup-python action, so it can be dropped from the matrix. It might be a good idea to test macos both aarch64 and x64, but if there's only one arch using the default is IMO sufficient.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
For the ci in general or for this workflow/wheel-based ci?
.github/workflows/test-release.yml
Outdated
os: [ubuntu, macos, windows] | ||
version-restrict: [''] | ||
include: | ||
# code-coverage build on macos python 3.9 |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think we can skip the specialized jobs in release testing.
32-bit and version restrict tests need modifications of the requirements files which is not done in this workflow.
dd6248b
to
f960879
Compare
This PR causes the following changes to the html docs (ubuntu-latest-3.11):
See CI logs for the full diff. |
1 similar comment
This PR causes the following changes to the html docs (ubuntu-latest-3.11):
See CI logs for the full diff. |
dd7a427
to
44368fc
Compare
This PR causes the following changes to the html docs (ubuntu-latest-3.11):
See CI logs for the full diff. |
No description provided.