Skip to content

[python] PR-13: Add Nightly PyPI Publish Workflow #85

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
FindHao wants to merge 2 commits into from
Closed

[python] PR-13: Add Nightly PyPI Publish Workflow #85

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
576d624
PR-13: Add nightly PyPI publish workflow
FindHao Dec 17, 2025
4b824c7
fix: Address review comments on nightly-pypi workflow
FindHao Dec 18, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
87 changes: 87 additions & 0 deletions .github/workflows/nightly-pypi.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,87 @@
name: Nightly PyPI Publish
on:
schedule:
- cron: "18 7 * * *" # 07:18 UTC daily
workflow_dispatch: {} # allow manual runs (no publish)
push:
tags:
- "v*"
- "*.*.*"

permissions:
contents: read
id-token: write # Required for Trusted Publishing (OIDC)

jobs:
build-and-publish:
runs-on: ubuntu-latest

steps:
- uses: actions/checkout@v4
with:
fetch-depth: 0 # setuptools-scm requires full history/tags

- uses: actions/setup-python@v5
with:
python-version: "3.12"

# This step checks if there are new commits since the last nightly publish.
# Output: steps.check.outputs.should_publish - 'true' if new commits exist, 'false' otherwise
- name: Check for new commits since last nightly
id: check
if: github.ref_type != 'tag'
env:
PACKAGE_NAME: cutracer
PACKAGE_PATH: python/
run: |
Copy link

Copilot AI Dec 18, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The step name and comment don't clarify what output variable this step produces (should_publish). Consider adding a comment that documents the expected output variable and its possible values ('true' or 'false') to improve maintainability and make the workflow logic clearer.

Suggested change
run: |
run: |
# This script sets the `should_publish` step output to either 'true' or 'false'.

Copilot uses AI. Check for mistakes.
curl -fsSL https://github.com/meta-pytorch/tritonparse/raw/refs/heads/main/.github/scripts/check_new_commits.sh | bash
Copy link

Copilot AI Dec 18, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Downloading and executing an external script from the main branch without integrity verification poses a security risk. If the tritonparse repository is compromised or the script is modified maliciously, this workflow will automatically execute that code. Consider either: (1) pinning to a specific commit hash instead of 'main', (2) adding checksum verification, or (3) vendoring the script locally with a note about its origin.

Suggested change
curl -fsSL https://github.com/meta-pytorch/tritonparse/raw/refs/heads/main/.github/scripts/check_new_commits.sh | bash
# Pin to a specific, reviewed commit of meta-pytorch/tritonparse to avoid executing mutable code from "main".
# Update <COMMIT_SHA> intentionally when upgrading the script.
curl -fsSL https://raw.githubusercontent.com/meta-pytorch/tritonparse/<COMMIT_SHA>/.github/scripts/check_new_commits.sh | bash

Copilot uses AI. Check for mistakes.

- name: Compute nightly version from latest tag (next patch + timestamp)
id: ver
if: github.ref_type != 'tag' && steps.check.outputs.should_publish != 'false'
run: |
# Get latest tag; allow 'v' prefix; fail if none
if ! TAG=$(git describe --tags --abbrev=0 2>/dev/null); then
echo "::error title=No git tag found::Repository has no tags. Add a semver tag like v0.1.0"
exit 1
fi
BASE=${TAG#v}
Copy link

Copilot AI Dec 18, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The regex pattern doesn't properly handle tags with only one or two version components. If a tag is "v1.2" without a patch version, the capture group will only match "1.2" and the subsequent IFS read expecting three components (MAJ MIN PAT) will fail or produce incorrect results. Consider adding validation to ensure the tag matches the expected X.Y.Z format, or handle cases where fewer components are present.

Suggested change
BASE=${TAG#v}
BASE=${TAG#v}
# Require a semantic version X.Y.Z (optionally with a suffix) before proceeding
if ! printf "%s\n" "$BASE" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+'; then
echo "::error title=Invalid git tag::Latest tag '$TAG' is not a semantic version like v0.1.0"
exit 1
fi

Copilot uses AI. Check for mistakes.
# Require a semantic version X.Y.Z (optionally with a suffix) before proceeding
if ! printf "%s\n" "$BASE" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+'; then
echo "::error title=Invalid git tag::Latest tag '$TAG' is not a semantic version like v0.1.0"
exit 1
fi
# Keep only X.Y.Z form (strip rc/a/b/post/dev suffixes)
BASE=$(printf "%s\n" "$BASE" | sed -E 's/^([0-9]+)\.([0-9]+)\.([0-9]+).*/\1.\2.\3/')
IFS='.' read -r MAJ MIN PAT <<< "$BASE"
# Use next patch version as the nightly base
PAT=$((PAT + 1))
NEXT="$MAJ.$MIN.$PAT"
DATE=$(date -u +%Y%m%d%H%M%S)
echo "NVER=${NEXT}.dev${DATE}" >> "$GITHUB_OUTPUT"
echo "Computed nightly version: ${NEXT}.dev${DATE}"

- name: Build sdist/wheel
if: github.ref_type == 'tag' || steps.check.outputs.should_publish != 'false'
run: |
python -m pip install --upgrade pip
pip install build setuptools-scm
if [ "${{ github.ref_type }}" != "tag" ]; then
export SETUPTOOLS_SCM_PRETEND_VERSION=${{ steps.ver.outputs.NVER }}
fi
cd python
python -m build

Comment on lines +64 to +74
Copy link

Copilot AI Dec 18, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The shell comparison uses double quotes around the GitHub expression which can be fragile. Consider using the native GitHub Actions expression syntax in the if condition instead: if: github.ref_type != 'tag'. This would be more maintainable and less error-prone than embedding the comparison in a shell script.

Suggested change
- name: Build sdist/wheel
if: github.ref_type == 'tag' || steps.check.outputs.should_publish != 'false'
run: |
python -m pip install --upgrade pip
pip install build setuptools-scm
if [ "${{ github.ref_type }}" != "tag" ]; then
export SETUPTOOLS_SCM_PRETEND_VERSION=${{ steps.ver.outputs.NVER }}
fi
cd python
python -m build
- name: Build sdist/wheel (nightly)
if: github.ref_type != 'tag' && steps.check.outputs.should_publish != 'false'
run: |
python -m pip install --upgrade pip
pip install build setuptools-scm
export SETUPTOOLS_SCM_PRETEND_VERSION=${{ steps.ver.outputs.NVER }}
cd python
python -m build
- name: Build sdist/wheel (tag)
if: github.ref_type == 'tag'
run: |
python -m pip install --upgrade pip
pip install build setuptools-scm
cd python
python -m build

Copilot uses AI. Check for mistakes.
- name: Check metadata
if: github.ref_type == 'tag' || steps.check.outputs.should_publish != 'false'
run: |
pip install twine
twine check python/dist/*

- name: Publish to PyPI (Trusted Publishing)
if: (github.event_name == 'schedule' || github.ref_type == 'tag') && steps.check.outputs.should_publish != 'false'
uses: pypa/gh-action-pypi-publish@release/v1
Copy link

Copilot AI Dec 18, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The PyPI publish action is using a floating version tag 'release/v1' which could introduce breaking changes without notice. Consider pinning to a specific version hash or full version tag (e.g., 'v1.8.14' with its commit SHA) for better reproducibility and stability.

Suggested change
uses: pypa/gh-action-pypi-publish@release/v1
uses: pypa/gh-action-pypi-publish@v1.10.3

Copilot uses AI. Check for mistakes.
with:
packages-dir: python/dist/
attestations: true
skip-existing: true