Conversation
vcpkg's openblas port does NOT bundle LAPACK kernels — the previous CMakeLists assumed it did and only linked OpenBLAS, leaving sposv_/dgesv_/sgeev_ etc. unresolved at link time. Now find vcpkg's separate ``lapack`` CONFIG package alongside OpenBLAS and link both. The Linux/macOS module-mode path is unchanged. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Add a new ``build-release-wheels.yml`` that's the single source of truth for release-quality wheels: triggered on ``v*.*.*`` tag push and ``workflow_dispatch``, builds the full Python × OS matrix with cibuildwheel (tests inside, then upload-artifact). Rewrite ``release.yml`` to skip the build entirely. It now triggers via ``workflow_run`` when ``build-release-wheels.yml`` succeeds on a tag, downloads the wheels + sdist from that exact build via ``download-artifact``'s cross-workflow ``run-id`` API, publishes to PyPI via trusted publishing, and creates the GitHub release. Rewrite ``publish-testpypi.yml`` as a pure dispatch+download flow: operator supplies a ``build-run-id`` input pointing at a successful ``build-release-wheels.yml`` run, the workflow pulls those exact artifacts and publishes them to TestPyPI. Net effect: release time drops from ~95-110 min to ~35-50 min, PyPI publish is structurally gated on the full matrix passing, and the ~200 lines of cibuildwheel config duplicated between release.yml and publish-testpypi.yml collapse into one place. ``python_ci.yml`` stays untouched as the PR-time fast path. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
build-release-wheels.yml now caches:
* C:/vcpkg/installed on Windows — the ``vcpkg install openblas
lapack:x64-windows-release`` step takes ~10-15 min cold and
becomes a no-op on cache hit
* ~/.cache/cibuildwheel + the Windows equivalent — saves the
per-row Python-interpreter / pip download time
* pip downloads on the sdist job via setup-python's ``cache: pip``
release.yml and publish-testpypi.yml now pass ``attestations: true``
to pypa/gh-action-pypi-publish, which produces SLSA Build Level 3
provenance (in-toto + Sigstore, signed by the GitHub Actions
runner's OIDC identity) and uploads it to PyPI alongside the wheel
under PEP 740. The publish jobs gain ``attestations: write``
permission.
README.md (root) and python/README.md gain the SLSA Build Level 3
badge from slsa.dev, with a short paragraph explaining what the
attestations cover and how a downloader can verify a wheel via
``pypi-attestations verify``.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
``actions/upload-artifact`` rejects ``*`` in artifact names because NTFS can't represent it, so ``wheels-ubuntu-latest-cp311-manylinux*`` crashed every Linux row. Apply ``replace(matrix.cibw-build, '*', '')`` both in the artifact name and the cibuildwheel cache key so the matrix-glob pattern collapses to a filesystem-safe suffix (``cp311-manylinux`` rather than ``cp311-manylinux*``). Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
GitHub Actions expression syntax has no ``replace()`` function (the allowed built-ins are contains / startsWith / endsWith / format / join / toJSON / fromJSON / hashFiles). The previous commit's ``replace(matrix.cibw-build, '*', '')`` got rejected at workflow parse time. Add an artifact-safe ``tag`` field to each matrix row (``cp311-linux``, ``cp311-macos``, ``cp311-win``, …) and reference that for the artifact name and the cibuildwheel cache key. ``cibw-build`` keeps its glob form so cibuildwheel still picks up all manylinux / macosx variants per row. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Replace the workflow_run chain with the native "Publish release"
button on GitHub. build-release-wheels.yml now stages wheels +
sdist on a draft release; clicking "Publish release" in the UI
creates the tag, emits release:published, and release.yml uploads
the assets to PyPI with PEP 740 attestations.
build-release-wheels.yml:
* drop ``push: tags`` trigger; require workflow_dispatch with a
``tag`` input (e.g. v1.0.6)
* append a ``prepare_draft_release`` job that downloads every
artifact and calls softprops/action-gh-release@v2 with
``draft: true``. Re-running with the same tag replaces the
draft's assets in place, so failed builds are fully
recoverable — no git tag exists yet, no PyPI commitment
release.yml:
* trigger on ``release: types: [published]``
* download the release's attached assets via ``gh release
download``
* publish to PyPI with ``attestations: true`` and
``skip-existing: true`` for retry-safety
publish-testpypi.yml unchanged (still manual workflow_dispatch +
build-run-id input — TestPyPI isn't part of the release-UI gate).
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Set ``FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true`` at the workflow level for build-release-wheels.yml, python_ci.yml, release.yml, and publish-testpypi.yml. Silences the Node.js 20 deprecation warning that fires for ``actions/cache@v4`` (used directly) and ``actions/setup-python@v5`` (bundled inside ``pypa/cibuildwheel@v3.1``). GitHub deprecates Node 20 on 2026-06-02 and removes it on 2026-09-16; the env var is GitHub's documented opt-in mechanism for the transition period. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.