Validate repaired t-encrypt wheel in workflows#305
Merged
Conversation
oleksandrSydorenkoJ
requested review from
kladkogex and
olehnikolaiev
as code owners
July 16, 2026 19:10
Contributor
There was a problem hiding this comment.
Pull request overview
This PR tightens the CI/CD pipeline around the t-encrypt Python wheel by ensuring the Linux wheel is auditwheel repair’d and validated (including twine check --strict) before it can be uploaded to PyPI, preventing accidental publication of a non–PyPI-compliant linux_x86_64 wheel.
Changes:
- Repair the raw
t-encryptwheel withauditwheel repairand fail CI if the output wheel is notmanylinux-tagged. - Add
twine check --strictvalidation for the repaired wheel in CI, and validate the artifact on Ubuntu 22.04 and 24.04. - Update the publish workflow to upload
dist/*.tar.gzpluswheelhouse/*.whl(repaired) instead of the rawdist/*.whl.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| .github/workflows/test.yml | Builds a raw wheel, repairs it into wheelhouse/, enforces manylinux tagging, runs strict twine check, and uploads/validates the repaired artifact across Ubuntu versions. |
| .github/workflows/publish.yml | Ensures patchelf is available, repairs the wheel before publishing, runs strict twine check on sdist + repaired wheel, and uploads only the intended artifacts to PyPI. |
…work/libBLS into 302-openssl-3-for-python-builds
PropzSaladaz
approved these changes
Jul 17, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What:
Add workflow checks so the
t-encryptwheel is repaired and validated before PyPI upload.Why:
The publish job produced a raw Linux wheel (
linux_x86_64) that reached PyPI upload and failed with400 Bad Request. The repaired PyPI-facing wheel should be validated in CI on every commit, not only at the end of publish.How:
patchelfwhereauditwheel repairis used.t-encryptwheel intowheelhouse/withauditwheel repair.manylinux-tagged.twine check --stricton the repaired wheel intest.yml.dist/*.tar.gzandwheelhouse/*.whlinstead of rawdist/*.whl.Checklist: