Skip to content

Commit cf6a26b

Browse files
agriyakhetarpalagriyakhetarpal
authored
Add a workflow to release and sign wheels (#22)
1 parent 3d0f1e8 commit cf6a26b

File tree

2 files changed

+141
-7
lines changed

2 files changed

+141
-7
lines changed

‎.github/workflows/cd.yml‎

Lines changed: 123 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,123 @@
1+
name: CD
2+
3+
on:
4+
workflow_dispatch:
5+
inputs:
6+
version:
7+
description: "The version to build Zig wheels for, use 'latest' for latest release, 'master' for nightly builds"
8+
required: true
9+
default: "latest"
10+
suffix:
11+
description: >
12+
Suffix to append to the version in the wheel filename, i.e., for dev versions and version specifiers
13+
required: false
14+
default: ""
15+
platforms:
16+
description: >
17+
Comma-separated values of platforms to build wheels for
18+
required: false
19+
default: "x86_64-windows,aarch64-windows,x86-windows,x86_64-macos,aarch64-macos,i386-linux,x86-linux,x86_64-linux,aarch64-linux,armv7a-linux,arm-linux,powerpc64le-linux,s390x-linux,riscv64-linux"
20+
push_to_pypi:
21+
description: >
22+
Whether to push the built wheels to PyPI. Can be 'true' or 'false', defaults to 'false'.
23+
required: true
24+
default: "false"
25+
26+
permissions: {}
27+
28+
jobs:
29+
build_wheels:
30+
name: Build wheels
31+
runs-on: ubuntu-latest
32+
permissions:
33+
contents: read
34+
steps:
35+
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
36+
with:
37+
persist-credentials: false
38+
- uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
39+
with:
40+
python-version: "3.x"
41+
42+
- uses: astral-sh/setup-uv@557e51de59eb14aaaba2ed9621916900a91d50c6 # v6.6.1
43+
44+
- name: Build wheels for all requested platforms
45+
shell: bash
46+
env:
47+
GITHUB_EVENT_INPUTS_PLATFORMS: ${{ github.event.inputs.platforms }}
48+
GITHUB_EVENT_INPUTS_VERSION: ${{ github.event.inputs.version }}
49+
GITHUB_EVENT_INPUTS_SUFFIX: ${{ github.event.inputs.suffix }}
50+
run: |
51+
platforms=${GITHUB_EVENT_INPUTS_PLATFORMS}
52+
IFS=',' read -r -a platform_array <<< "$platforms"
53+
for platform in "${platform_array[@]}"; do
54+
uv run make_wheels.py \
55+
--outdir dist/ \
56+
--version ${GITHUB_EVENT_INPUTS_VERSION} \
57+
--suffix ${GITHUB_EVENT_INPUTS_SUFFIX} \
58+
--platform "$platform"
59+
done
60+
61+
- name: Upload wheel artifacts
62+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
63+
with:
64+
name: zig_wheels
65+
path: dist/*.whl
66+
if-no-files-found: error
67+
68+
deploy_wheels:
69+
name: Deploy wheels
70+
needs: [build_wheels]
71+
if: >-
72+
github.event.inputs.push_to_pypi == 'true' &&
73+
github.repository == 'ziglang/zig-pypi'
74+
environment: pypi
75+
runs-on: ubuntu-latest
76+
permissions:
77+
id-token: write # for OIDC trusted publishing
78+
attestations: write # for the GitHub Actions Attestations feature
79+
contents: read
80+
steps:
81+
- name: Download all wheel artifacts
82+
uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
83+
with:
84+
path: dist/
85+
merge-multiple: true
86+
87+
- name: Sanity check wheel artifacts
88+
run: ls -R dist/
89+
90+
- name: Generate artifact attestations
91+
uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3.0.0
92+
with:
93+
subject-path: dist/*
94+
95+
# This will publish the list of wheels inputted to the action to PyPI (set to
96+
# off, by default).
97+
# The workflow may be triggered multiple times with the `push_to_pypi` input
98+
# set to 'true' to publish the wheels for any configurable version (non-dev).
99+
- name: Publish wheels to PyPI
100+
uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0
101+
with:
102+
packages-dir: dist/
103+
104+
inspect_wheels:
105+
name: Inspect wheels
106+
needs: [build_wheels]
107+
runs-on: ubuntu-latest
108+
steps:
109+
- name: Download all built wheel artifacts
110+
uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
111+
with:
112+
path: dist/
113+
merge-multiple: true
114+
115+
- name: Inspect wheel artifacts
116+
shell: bash
117+
run: |
118+
echo -e '## A list of built wheels and their SHA-256 checksums \n' >> $GITHUB_STEP_SUMMARY
119+
echo -e '```\n' >> $GITHUB_STEP_SUMMARY
120+
for wheel in dist/*.whl; do
121+
shasum --algorithm 256 "$wheel" >> $GITHUB_STEP_SUMMARY
122+
done
123+
echo -e '```\n' >> $GITHUB_STEP_SUMMARY

‎README.md‎

Lines changed: 18 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -51,16 +51,27 @@ The process of converting release archives to binary wheels is deterministic, an
5151

5252
[pypidl]: https://pypi.org/project/ziglang/#files
5353

54-
Uploading wheels
55-
----------------
54+
Uploading wheels to PyPI
55+
------------------------
5656

57-
Run the publishing utility:
57+
Trigger the publishing workflow from this repository manually (requires authorization)
58+
with the necessary inputs as mentioned in the [workflow file](.github/workflows/cd.yml)
59+
or in the GitHub Actions UI. The wheels are checked with `twine` before they are uploaded.
5860

59-
```shell
60-
pdm run twine dist/*
61-
```
61+
The workflow will upload the wheels to PyPI to make them available for installation. It
62+
is possible to trigger it multiple times to upload wheels for different versions or
63+
platforms.
64+
65+
Verifying the provenance of wheels uploaded to PyPI
66+
---------------------------------------------------
67+
68+
To establish build provenance, the workflow generates attestations for the uploaded wheels
69+
using the [GitHub Actions Attestations feature](https://docs.github.com/en/actions/security-for-github-actions/using-artifact-attestations/using-artifact-attestations-to-establish-provenance-for-builds)
70+
when it is run. Please navigate to the [Attestations interface](https://github.com/ziglang/zig-pypi/attestations)
71+
to view the attestations for the uploaded wheels.
6272

63-
This command will upload the binary wheels built in the previous step to PyPI.
73+
The attestations may be verified via the [GitHub (`gh`) CLI](https://cli.github.com/manual/gh_attestation_verify)
74+
or via the [GitHub API](https://docs.github.com/en/rest/users/attestations).
6475

6576
License
6677
-------

0 commit comments

Comments
 (0)