CI: fix wheel upload to anaconda [wheel build]

[andyfaff]

Should hopefully fix #18597
@tylerjereddy

[andyfaff]

Don't know why the page says I removed the labels, perhaps because I was adding labels at the same time?

[tupui]

@andyfaff what is the upload logic with the maintenance branch? I could not find the information in our doc https://scipy.github.io/devdocs/dev/contributor/continuous_integration.html#wheel-builds

Are the builds going to scientific-python-nightly-wheels as well or somewhere else?

[andyfaff]

For wheels built on cirrus the upload logic for the maintenance branch ("staging") is:

    # If it's a push event to a maintenance branch, and the commit message contains
    # '[wheel build]' then upload to staging
    COMMIT_MSG=$(git log --no-merges -1)
    if [[ "$COMMIT_MSG" == *"[wheel build]"* ]] && [[ $CIRRUS_BRANCH == maintenance* ]]; then
          export IS_PUSH="true"
    fi

The upload script for all wheel building is controlled by upload_wheels.sh. The uploads for staging are directed to is to multibuild-wheels-staging. Cron jobs get uploaded to scientific-python-nightly-wheels.

The logic for GHA generated wheels is:

      # upload to staging if it's a push to a maintenance branch and the last
      # commit message contains '[wheel build]'
      IS_PUSH: ${{ github.event_name == 'push' && startsWith(github.ref, 'refs/heads/maintenance') && contains(needs.get_commit_message.outputs.message, '1') }}
      IS_SCHEDULE_DISPATCH: ${{ github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' }}

[andyfaff]

The logic for GHA and cirrusci is pretty much congruent.

[tupui]

I see that but that's not very clear at first glance. Could you add some documentation itself? Right where we currently describe CirrusCI?

One point which was not clear is where we need to put the secrets. I was on a call with Sebastian looking at this for NumPy and it was not straightforward.

[rgommers]

LGTM, let's give this a go and see if it resolves the problem.

[rgommers]

One point which was not clear is where we need to put the secrets. I was on a call with Sebastian looking at this for NumPy and it was not straightforward.

Cirrus CI works very differently than GHA. Last time things worked as expected for me though after following https://cirrus-ci.org/guide/writing-tasks/#encrypted-variables.

[tupui]

Yes but then did you update the secret on CirrusCI? The hash in our config should be updated too no?

[rgommers]

This PR was about wheels uploading from the maintenance branch to the staging bucket, not the nightly one. That secret did not change. The jobs passed (https://cirrus-ci.com/task/4708269558595584), so this seems to be fine and this can be backported.

Separately, I'll look at the nightly uploads secret.

[tupui]

Yes I know, sorry I was maybe not clear as I was discussing this in multiple places. I am talking about the new one.