ci: Restrict id-token OIDC permission to release job
#744
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build wheels Release | |
| on: | |
| pull_request: | |
| branches: | |
| - main | |
| push: | |
| branches: | |
| - main | |
| tags: | |
| - "*" | |
| workflow_dispatch: | |
| permissions: | |
| contents: write | |
| env: | |
| CARGO_TERM_COLOR: always | |
| CACHE_CARGO: true | |
| jobs: | |
| build_selene_core: | |
| runs-on: ubuntu-latest | |
| outputs: | |
| wheel-ready: ${{ steps.upload_selene_core.outputs.artifact-id }} | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Cache selene-core wheel | |
| id: selene_core_wheel_cache | |
| uses: actions/cache@v5 | |
| with: | |
| path: wheelhouse/selene_core-*.whl | |
| key: selene-core-wheel-${{ hashFiles('selene-core/**') }} | |
| ################################################################## | |
| # | |
| # If no cache hit, build selene-core... | |
| # | |
| - uses: actions/cache@v5 | |
| if: steps.selene_core_wheel_cache.outputs.cache-hit != 'true' | |
| with: | |
| path: | | |
| ~/.cargo/ | |
| target/ | |
| key: selene-core-ci | |
| - name: "Set up Python" | |
| if: steps.selene_core_wheel_cache.outputs.cache-hit != 'true' | |
| uses: actions/setup-python@v6 | |
| with: | |
| python-version: '3.10' | |
| - name: Install rust toolchain | |
| if: steps.selene_core_wheel_cache.outputs.cache-hit != 'true' | |
| uses: dtolnay/rust-toolchain@stable | |
| - name: Build selene-core wheel | |
| if: steps.selene_core_wheel_cache.outputs.cache-hit != 'true' | |
| run: | | |
| mkdir -p wheelhouse | |
| python -m pip install --upgrade build | |
| python -m build --wheel --outdir wheelhouse selene-core | |
| # | |
| ################################################################# | |
| - name: Upload selene-core wheel | |
| id: upload_selene_core | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: selene-core | |
| path: wheelhouse/selene_core-*.whl | |
| if-no-files-found: error | |
| build_selene_sim: | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: [ubuntu-latest, ubuntu-24.04-arm, macos-14, macos-15-intel, windows-2022] | |
| name: "Selene wheels (${{matrix.os}})" | |
| runs-on: ${{ matrix.os }} | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Set up UV | |
| if: ${{ matrix.os != 'ubuntu-latest' }} | |
| uses: astral-sh/setup-uv@v8.1.0 | |
| with: | |
| enable-cache: true | |
| - name: Read Rust toolchain | |
| if: ${{ startsWith(matrix.os, 'macos-') }} | |
| id: rust_toolchain | |
| shell: bash | |
| run: | | |
| channel="$(awk -F'"' '/^channel = / { print $2 }' rust-toolchain.toml)" | |
| test -n "$channel" | |
| echo "channel=$channel" >> "$GITHUB_OUTPUT" | |
| - name: Install rust toolchain | |
| if: ${{ startsWith(matrix.os, 'macos-') }} | |
| uses: dtolnay/rust-toolchain@stable | |
| with: | |
| toolchain: ${{ steps.rust_toolchain.outputs.channel }} | |
| - name: Prepare cache dir (linux) | |
| if: ${{ matrix.os == 'ubuntu-latest' }} | |
| run: | | |
| mkdir /tmp/ci-cache | |
| chmod 755 /tmp/ci-cache | |
| # -------------------------------- | |
| # Build selene-sim wheel | |
| # -------------------------------- | |
| # If selene-core has changed, we will likely want to rebuild and test | |
| # selene-sim. If selene-sim has changed, we will want to rebuild and tests | |
| # selene-sim. As such, no wheel caching here. | |
| # | |
| # A later change may be to consider guppy->hugr->QIS->selene tests as | |
| # integration tests performed outside of the CIBuildWheel environment. | |
| # We can then just run "pure selene" tests, whatever they may look like, | |
| # within CIBuildWheel, and avoid rebuilding. For the time being, | |
| # guppy->hugr->QIS->selene tests are core to our selene testing strategy, | |
| # and are performed within CIBuildWheel to ensure that the tests succeed | |
| # on all compatible platforms. | |
| # -------------------------------- | |
| # Cache the rust build intermediates | |
| - uses: actions/cache@v5 | |
| with: | |
| path: | | |
| /tmp/ci-cache/selene | |
| target/ | |
| key: selene-sim--build-env--${{ matrix.os }}--${{ hashFiles('Cargo.lock') }} | |
| restore-keys: | | |
| selene-sim--build-env--${{ matrix.os }}-- | |
| # Perform the selene-sim build | |
| - name: Build selene-sim wheels | |
| uses: pypa/cibuildwheel@v3.4.1 | |
| - name: Upload wheels | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: selene-wheels-${{ matrix.os }} | |
| path: wheelhouse/*.whl | |
| if-no-files-found: error | |
| release: | |
| strategy: | |
| matrix: | |
| target: | |
| - name: selene-core | |
| upload: wheelhouse/selene_core-*.whl | |
| - name: selene-sim | |
| upload: wheelhouse/selene_sim-*.whl | |
| name: Release ${{ matrix.target.name }} | |
| runs-on: ubuntu-latest | |
| # always do a full build and test before release of any package | |
| needs: [build_selene_core, build_selene_sim] | |
| permissions: | |
| contents: write | |
| id-token: write | |
| steps: | |
| # note: we can't use if: on the entire job, as if statements are evaluated | |
| # before matrix expansion, so we follow the convention of guppylang and | |
| # use a step to check if we should run the release job | |
| - name: Check tag | |
| id: check-tag | |
| run: | | |
| echo "run=$SHOULD_RUN" >> $GITHUB_OUTPUT | |
| env: | |
| SHOULD_RUN: ${{ github.ref_type == 'tag' && startsWith(github.ref, format('refs/tags/{0}-v', matrix.target.name)) }} | |
| - uses: actions/download-artifact@v8 | |
| if: ${{ steps.check-tag.outputs.run == 'true' }} | |
| with: | |
| path: wheelhouse | |
| merge-multiple: true | |
| - name: GH Release | |
| if: ${{ steps.check-tag.outputs.run == 'true' }} | |
| uses: softprops/action-gh-release@v3 | |
| with: | |
| files: ${{ matrix.target.upload }} | |
| generate_release_notes: true | |
| - name: Setup Python | |
| if: ${{ steps.check-tag.outputs.run == 'true' }} | |
| uses: actions/setup-python@v6 | |
| with: | |
| python-version: 3.12 | |
| - name: Install twine | |
| if: ${{ steps.check-tag.outputs.run == 'true' }} | |
| run: python -m pip install twine | |
| - name: Upload to pypi | |
| if: ${{ steps.check-tag.outputs.run == 'true' }} | |
| run: | | |
| twine upload --verbose --non-interactive ${{ matrix.target.upload }} |