Skip to content

Validate repaired t-encrypt wheel in workflows#305

Merged
PropzSaladaz merged 4 commits into
developfrom
302-openssl-3-for-python-builds
Jul 17, 2026
Merged

Validate repaired t-encrypt wheel in workflows#305
PropzSaladaz merged 4 commits into
developfrom
302-openssl-3-for-python-builds

Conversation

@oleksandrSydorenkoJ

Copy link
Copy Markdown
Contributor

What:

Add workflow checks so the t-encrypt wheel is repaired and validated before PyPI upload.

Why:

The publish job produced a raw Linux wheel (linux_x86_64) that reached PyPI upload and failed with 400 Bad Request. The repaired PyPI-facing wheel should be validated in CI on every commit, not only at the end of publish.

How:

  • Install patchelf where auditwheel repair is used.
  • Repair the raw t-encrypt wheel into wheelhouse/ with auditwheel repair.
  • Fail if the repaired wheel is not manylinux-tagged.
  • Run twine check --strict on the repaired wheel in test.yml.
  • Upload and validate the repaired wheel artifact on Ubuntu 22.04 and Ubuntu 24.04.
  • Publish dist/*.tar.gz and wheelhouse/*.whl instead of raw dist/*.whl.

Checklist:

  • Documentation N/A
  • Tests
  • Ready to be merged

Copilot AI review requested due to automatic review settings July 16, 2026 19:10
@oleksandrSydorenkoJ oleksandrSydorenkoJ linked an issue Jul 16, 2026 that may be closed by this pull request

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR tightens the CI/CD pipeline around the t-encrypt Python wheel by ensuring the Linux wheel is auditwheel repair’d and validated (including twine check --strict) before it can be uploaded to PyPI, preventing accidental publication of a non–PyPI-compliant linux_x86_64 wheel.

Changes:

  • Repair the raw t-encrypt wheel with auditwheel repair and fail CI if the output wheel is not manylinux-tagged.
  • Add twine check --strict validation for the repaired wheel in CI, and validate the artifact on Ubuntu 22.04 and 24.04.
  • Update the publish workflow to upload dist/*.tar.gz plus wheelhouse/*.whl (repaired) instead of the raw dist/*.whl.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File Description
.github/workflows/test.yml Builds a raw wheel, repairs it into wheelhouse/, enforces manylinux tagging, runs strict twine check, and uploads/validates the repaired artifact across Ubuntu versions.
.github/workflows/publish.yml Ensures patchelf is available, repairs the wheel before publishing, runs strict twine check on sdist + repaired wheel, and uploads only the intended artifacts to PyPI.

@PropzSaladaz
PropzSaladaz merged commit da651fa into develop Jul 17, 2026
9 checks passed
@PropzSaladaz
PropzSaladaz deleted the 302-openssl-3-for-python-builds branch July 17, 2026 10:06
@github-actions github-actions Bot locked and limited conversation to collaborators Jul 17, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

OpenSSL 3 for Python Builds

3 participants