Skip to content

Commit 4db6de9

Browse files
MaxusmustiMaxusmusti
committed
Add action for package build/publish on release
Signed-off-by: Mustafa Eyceoz <[email protected]>
1 parent 26116b9 commit 4db6de9

File tree

2 files changed

+136
-3
lines changed

2 files changed

+136
-3
lines changed

‎.github/workflows/pypi.yaml‎

Lines changed: 133 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,133 @@
1+
# SPDX-License-Identifier: Apache-2.0
2+
3+
name: Build, test, and upload PyPI package
4+
5+
on:
6+
push:
7+
branches:
8+
- "main"
9+
- "release-**"
10+
tags:
11+
- "v*"
12+
pull_request:
13+
branches:
14+
- "main"
15+
- "release-**"
16+
release:
17+
types:
18+
- published
19+
20+
env:
21+
LC_ALL: en_US.UTF-8
22+
23+
defaults:
24+
run:
25+
shell: bash
26+
27+
permissions:
28+
contents: read
29+
30+
jobs:
31+
# Create and verify release artifacts
32+
# - build source dist (tar ball) and wheel
33+
# - validate artifacts with various tools
34+
# - upload artifacts to GHA
35+
build-package:
36+
name: Build and check packages
37+
runs-on: ubuntu-latest
38+
steps:
39+
- name: "Harden Runner"
40+
uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
41+
with:
42+
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
43+
44+
45+
- name: "Checkout"
46+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
47+
with:
48+
# for setuptools-scm
49+
fetch-depth: 0
50+
51+
- name: "Build and Inspect"
52+
uses: hynek/build-and-inspect-python-package@c52c3a4710070b50470d903818a7b25115dcd076 # v2.13.0
53+
54+
# push to Test PyPI on
55+
# - a new GitHub release is published
56+
# - a PR is merged into main branch
57+
publish-test-pypi:
58+
name: Publish packages to test.pypi.org
59+
# environment: publish-test-pypi
60+
if: ${{ (github.repository_owner == 'Red-Hat-AI-Innovation-Team') && ((github.event.action == 'published') || ((github.event_name == 'push') && (github.ref == 'refs/heads/main'))) }}
61+
permissions:
62+
contents: read
63+
# see https://docs.pypi.org/trusted-publishers/
64+
id-token: write
65+
runs-on: ubuntu-latest
66+
needs: build-package
67+
68+
steps:
69+
- name: "Harden Runner"
70+
uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
71+
with:
72+
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
73+
74+
- name: "Download build artifacts"
75+
uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
76+
with:
77+
name: Packages
78+
path: dist
79+
80+
- name: "Upload to Test PyPI"
81+
uses: pypa/gh-action-pypi-publish@76f52bc884231f62b9a034ebfe128415bbaabdfc # v1.12.4
82+
with:
83+
repository-url: https://test.pypi.org/legacy/
84+
85+
# push to Production PyPI on
86+
# - a new GitHub release is published
87+
publish-pypi:
88+
name: Publish release to pypi.org
89+
# environment: publish-pypi
90+
if: ${{ (github.repository_owner == 'Red-Hat-AI-Innovation-Team') && (github.event.action == 'published') }}
91+
permissions:
92+
# see https://docs.pypi.org/trusted-publishers/
93+
id-token: write
94+
# allow gh release upload
95+
contents: write
96+
97+
runs-on: ubuntu-latest
98+
needs: build-package
99+
100+
steps:
101+
- name: "Harden Runner"
102+
uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
103+
with:
104+
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
105+
106+
- name: "Download build artifacts"
107+
uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
108+
with:
109+
name: Packages
110+
path: dist
111+
112+
- name: "Sigstore sign package"
113+
uses: sigstore/gh-action-sigstore-python@f7ad0af51a5648d09a20d00370f0a91c3bdf8f84 # v3.0.1
114+
with:
115+
inputs: |
116+
./dist/*.tar.gz
117+
./dist/*.whl
118+
release-signing-artifacts: false
119+
120+
- name: "Upload artifacts and signatures to GitHub release"
121+
run: |
122+
gh release upload '${{ github.ref_name }}' dist/* --repo '${{ github.repository }}'
123+
env:
124+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
125+
126+
# PyPI does not accept .sigstore artifacts and
127+
# gh-action-pypi-publish has no option to ignore them.
128+
- name: "Remove sigstore signatures before uploading to PyPI"
129+
run: |
130+
rm ./dist/*.sigstore.json
131+
132+
- name: "Upload to PyPI"
133+
uses: pypa/gh-action-pypi-publish@76f52bc884231f62b9a034ebfe128415bbaabdfc # v1.12.4

‎pyproject.toml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,19 +6,19 @@ build-backend = "setuptools.build_meta"
66

77
[project]
88
name = "training-hub"
9-
description = "An algorithm-focused interface for common llm training, continual learning, and reinforcement learning techniques"
9+
description = "An algorithm-focused interface for common language model training, continual learning, and reinforcement learning techniques"
1010
readme = "README.md"
1111
license = {text = "Apache-2.0"}
1212
requires-python = ">=3.11"
1313
dependencies = [
14-
"instructlab-training",
14+
"instructlab-training>=0.11",
1515
"torch"
1616
]
1717
dynamic = ["version"]
1818

1919
[project.optional-dependencies]
2020
cuda = [
21-
"instructlab-training[cuda]"
21+
"instructlab-training[cuda]>=0.11"
2222
]
2323

2424
[project.urls]

0 commit comments

Comments
 (0)