From 7aa9bfd946ffafc6c2c2382a95c58fdff5c80a11 Mon Sep 17 00:00:00 2001 From: David Vesterlund Date: Tue, 27 Oct 2026 17:32:32 +0100 Subject: [PATCH] Make nightly CI fail visibly and keep one publish path Release review 2026-10-24 found two CI problems shared by all SDK repos: - nightly.yml used continue-on-error, "|| true" and "|| echo", so a broken install or failing test suite still produced a green run. - publish.yml (release published) and release.yml (v* tag) could both try to upload the same version. Only publish.yml is registered as a PyPI Trusted Publisher; release.yml uploads failed with invalid-publisher. Nightly now upgrades all dependencies eagerly, runs pip check and fails on test failures. release.yml is removed; publish.yml is the single path and is gated on tests.yml (now reusable via workflow_call), a tag/version match and twine check --strict. No package code or version change. Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com> --- .github/workflows/nightly.yml | 26 +++++++-------- .github/workflows/publish.yml | 59 ++++++++++++++++++++++++----------- .github/workflows/release.yml | 59 ----------------------------------- .github/workflows/tests.yml | 1 + 4 files changed, 53 insertions(+), 92 deletions(-) delete mode 100644 .github/workflows/release.yml diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml index dc48ffd..f6a767f 100644 --- a/.github/workflows/nightly.yml +++ b/.github/workflows/nightly.yml @@ -1,5 +1,8 @@ name: Nightly SDK Breakage Detection +# Installs the newest releases of every dependency and fails visibly when the +# install, dependency resolution or tests break. Do not add continue-on-error, +# "|| true" or "|| echo" here: a red nightly run is the signal. on: schedule: - cron: "0 2 * * *" @@ -9,27 +12,22 @@ jobs: nightly: name: Test against latest SDK versions runs-on: ubuntu-latest - continue-on-error: true steps: - uses: actions/checkout@v4 - - name: Checkout WestQuant Core + - name: Checkout WestQuant Core main uses: actions/checkout@v4 with: repository: WestQuantOpen/westquant-core path: _westquant-core - uses: actions/setup-python@v5 with: - python-version: "3.10" - - name: Install latest SDKs + python-version: "3.12" + - name: Install latest dependencies run: | - pip install --upgrade pip - pip install -e ./_westquant-core[test] - pip install --upgrade qiskit pytket pennylane pulser 2>/dev/null || true - pip install -e .[test] 2>/dev/null || pip install -e . + python -m pip install --upgrade pip + pip install -e ./_westquant-core + pip install --upgrade --upgrade-strategy eager -e ".[test]" + pip check + pip freeze - name: Run tests - run: | - pytest tests/ -v || echo "Nightly tests failed — SDK breakage detected" - - name: Report status - if: always() - run: | - echo "Nightly run completed. Check for SDK breakage above." + run: pytest tests/ -v diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index a05c99c..40a9cc5 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -1,34 +1,55 @@ name: Publish to PyPI +# Single publication path. PyPI Trusted Publishing is bound to this file name +# (publish.yml) and the "pypi" environment. Tests must pass and the release tag +# must match the pyproject version before anything is uploaded. on: release: types: [published] workflow_dispatch: - inputs: - confirm: - description: 'Type "publish" to confirm' - required: true - default: 'publish' + +permissions: + contents: read jobs: - publish: - name: Build and publish + test: + uses: ./.github/workflows/tests.yml + + build: + needs: test runs-on: ubuntu-latest - environment: pypi - permissions: - id-token: write steps: - uses: actions/checkout@v4 - uses: actions/setup-python@v5 with: - python-version: "3.10" - - name: Build package + python-version: "3.12" + - name: Check release tag matches package version + if: github.event_name == 'release' run: | - pip install build - python -m build - - name: Check package + version=$(python -c "import tomllib; print(tomllib.load(open('pyproject.toml', 'rb'))['project']['version'])") + if [ "${GITHUB_REF_NAME#v}" != "$version" ]; then + echo "::error::Release tag $GITHUB_REF_NAME does not match pyproject version $version" + exit 1 + fi + - name: Build and check distributions run: | - pip install twine - twine check dist/* - - name: Publish to PyPI - uses: pypa/gh-action-pypi-publish@release/v1 + python -m pip install --upgrade build twine + python -m build + twine check --strict dist/* + - uses: actions/upload-artifact@v4 + with: + name: python-package-distributions + path: dist/ + + publish: + needs: build + runs-on: ubuntu-latest + environment: pypi + permissions: + id-token: write + steps: + - uses: actions/download-artifact@v4 + with: + name: python-package-distributions + path: dist/ + - uses: pypa/gh-action-pypi-publish@release/v1 diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml deleted file mode 100644 index 2c051e6..0000000 --- a/.github/workflows/release.yml +++ /dev/null @@ -1,59 +0,0 @@ -name: Release to PyPI - -on: - push: - tags: - - "v*" - -permissions: - contents: read - -jobs: - test: - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 - - name: Checkout WestQuant Core - uses: actions/checkout@v4 - with: - repository: WestQuantOpen/westquant-core - path: _westquant-core - - uses: actions/setup-python@v5 - with: - python-version: "3.12" - - name: Install - run: | - python -m pip install --upgrade pip - pip install -e ./_westquant-core[test] - pip install -e .[test] - - run: pytest -q - - name: Native SDK smoke - run: python integration/smoke.py - - build: - needs: test - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 - - uses: actions/setup-python@v5 - with: - python-version: "3.12" - - run: python -m pip install --upgrade build - - run: python -m build - - uses: actions/upload-artifact@v4 - with: - name: python-package-distributions - path: dist/ - - publish: - needs: build - runs-on: ubuntu-latest - environment: pypi - permissions: - id-token: write - steps: - - uses: actions/download-artifact@v4 - with: - name: python-package-distributions - path: dist/ - - uses: pypa/gh-action-pypi-publish@release/v1 diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index b02ed70..5603c0c 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -1,6 +1,7 @@ name: Tests on: + workflow_call: push: branches: [main] pull_request: