Skip to content

build(ci): publish the wheels through PyPI Trusted Publishing - #45

Merged
SMI-Lab-Inha merged 2 commits into
devfrom
build/publish
Oct 22, 2026
Merged

build(ci): publish the wheels through PyPI Trusted Publishing#45
SMI-Lab-Inha merged 2 commits into
devfrom
build/publish

Conversation

@SMI-Lab-Inha

@SMI-Lab-Inha SMI-Lab-Inha commented Oct 22, 2026

Copy link
Copy Markdown
Owner

Summary

Third packaging step. #44 builds and smoke-tests the sdist and the three release wheels; this PR lets the same workflow upload them through PyPI Trusted Publishing, with no stored token. Nothing is uploaded by this PR itself.

What changes:

  • publish-testpypi (new job in .github/workflows/wheels.yml):
    • runs only on a manual run with the new upload = testpypi input;
    • uploads to TestPyPI behind the testpypi environment;
    • skips a version already on TestPyPI instead of failing.
  • publish-pypi (new job):
    • runs only when a GitHub release is published, behind the pypi environment (required reviewer);
    • first checks that the set is exactly one sdist and three wheels, all of the release tag's version.
  • Both jobs:
    • need all four build jobs, so only smoke-tested distributions are uploaded;
    • have id-token: write and nothing else;
    • use pypa/gh-action-pypi-publish pinned by commit to v1.14.2 (July 2026; v1.14.3 is two days old).
  • Setup done: the Trusted Publishers on pypi.org and test.pypi.org (this repository, wheels.yml, environments pypi / testpypi) and both GitHub environments with a required reviewer.
  • RELEASE.md:
    • a TestPyPI preflight: install from TestPyPI in a clean environment and run release/smoke_test_wheel.py;
    • the approval step at publication (a PyPI version can be yanked but never replaced);
    • the PyPI check when closing the release;
    • the publisher and environment setup in the new-repository checklist.
  • DEVELOPMENT.md and CHANGELOG updated.

Verification

  • pre-commit run --all-files passes; python -m pytest tests 57 passed.
  • The upload conditions were checked by hand:
    • the TestPyPI job is skipped on pull requests and releases;
    • the PyPI job is skipped on manual runs and pull requests;
    • this PR's own wheels run must show both publish jobs as skipped.
  • The first real use is the TestPyPI preflight of 0.3.0, run manually after this merges.

Checklist

  • pre-commit run --all-files passes
  • ctest --test-dir build --output-on-failure passes (no Fortran or CMake change)
  • python -m pytest tests python/tests passes (if Python or validation records changed)
  • VALIDATION.md updated if a validation result changed (none changed)
  • CHANGELOG.md updated under [Unreleased] (heading added if missing) for user-visible changes
  • Documentation in doc/ updated for changed inputs, options, or outputs (the install instructions change with the 0.3.0 release)
  • Conventional Commit title (feat:, fix:, docs:, ...)
  • Commits are signed off (git commit -s) under the
    Developer Certificate of Origin

@SMI-Lab-Inha
build(ci): publish the wheels through PyPI Trusted Publishing
5af2097 
wheels.yml gains two publish jobs that upload the sdist and the three
release wheels its build jobs smoke-tested, with no stored token
(id-token: write only; the publishers are registered on pypi.org and
test.pypi.org for this repository, wheels.yml and the environments
pypi and testpypi):

- publish-testpypi: a manual run with upload = testpypi; a version
  already on TestPyPI is skipped;
- publish-pypi: a published GitHub release, behind the pypi environment,
  after checking that the distribution set is one sdist and three wheels
  of the release tag's version.

pypa/gh-action-pypi-publish is pinned to v1.14.2 by commit. RELEASE.md
adds the TestPyPI preflight with a clean-environment install and smoke
test, the approval step, and the publisher setup of a new repository.

Signed-off-by: Jae Hoon Seo <jaehoon.seo@inha.ac.kr>
@SMI-Lab-Inha

SMI-Lab-Inha commented Oct 22, 2026

Copy link
Copy Markdown
Owner Author

@codex review

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 22, 2026 •
edited
Loading

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-10-22T10:53:51.410072Z fa2a969 Manual request
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 22, 2026

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. Breezy!

Reviewed commit: 5af209789c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

@SMI-Lab-Inha
docs(development): link RELEASE.md by its repository URL
fa2a969 
DEVELOPMENT.md is part of the Sphinx manual, which does not include RELEASE.md, so the relative link was an unresolved cross-reference and failed the -W documentation build.

Signed-off-by: Jae Hoon Seo <jaehoon.seo@inha.ac.kr>
@SMI-Lab-Inha

SMI-Lab-Inha commented Oct 22, 2026

Copy link
Copy Markdown
Owner Author

@codex review

@read-the-docs-community

read-the-docs-community Bot commented Oct 22, 2026

Copy link
Copy Markdown

Documentation build overview

📚 CableDyn | 🛠️ Build #35322666 | 📁 Comparing fa2a969 against latest (d3ddfeb)

  🔍 Preview build  

10 files changed · ± 10 modified

± Modified

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 22, 2026

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. Chef's kiss.

Reviewed commit: fa2a969297

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

@SMI-Lab-Inha
SMI-Lab-Inha merged commit 419007e into dev Oct 22, 2026
21 checks passed
@SMI-Lab-Inha
SMI-Lab-Inha deleted the build/publish branch October 22, 2026 12:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@SMI-Lab-Inha