Files
cibuildwheel/examples/github-deploy.yml
T
Agriya KhetarpalandJoe Rickerby 42d1caec22 Add a small note about security implications of using cibuildwheel in CI runners (#2711)
* Bump to actions/checkout v6 everywhere

* Add a note about security

* Not persisting credentials is still valuable

* Fix bad indentation

* Improve wording, remove link to PyPA guides

Co-Authored-By: Joe Rickerby <1244307+joerick@users.noreply.github.com>

---------

Co-authored-by: Joe Rickerby <1244307+joerick@users.noreply.github.com>
2026-02-06 18:54:08 +00:00

108 lines
3.1 KiB
YAML
Raw Blame History

This file contains ambiguous Unicode characters
This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
name: Build and upload to PyPI
on:
workflow_dispatch:
pull_request:
push:
branches:
- main
release:
types:
- published
jobs:
build_wheels:
name: Build wheels for ${{ matrix.os }}
runs-on: ${{ matrix.runs-on }}
strategy:
matrix:
include:
- os: linux-intel
runs-on: ubuntu-latest
- os: linux-arm
runs-on: ubuntu-24.04-arm
- os: windows-intel
runs-on: windows-latest
- os: windows-arm
runs-on: windows-11-arm
- os: macos-intel
# macos-15-intel is the last x86_64 runner
runs-on: macos-15-intel
- os: macos-arm
# macos-14+ (including latest) are ARM64 runners
runs-on: macos-latest
- os: android-intel
runs-on: ubuntu-latest
platform: android
- os: android-arm
# GitHub Actions doesnt currently support the Android emulator on any ARM
# runner. So we build on a non-ARM runner, which will skip the tests.
runs-on: ubuntu-latest
platform: android
archs: arm64_v8a
- os: ios
runs-on: macos-latest
platform: ios
- os: pyodide
runs-on: ubuntu-latest
platform: pyodide
steps:
- uses: actions/checkout@v6
with:
persist-credentials: false
- name: Build wheels
uses: pypa/cibuildwheel@v3.3.1
env:
CIBW_PLATFORM: ${{ matrix.platform || 'auto' }}
CIBW_ARCHS: ${{ matrix.archs || 'auto' }}
# Can also be configured directly, using `with:`
# with:
# package-dir: .
# output-dir: wheelhouse
# config-file: "{package}/pyproject.toml"
- uses: actions/upload-artifact@v4
with:
name: cibw-wheels-${{ matrix.os }}-${{ strategy.job-index }}
path: ./wheelhouse/*.whl
build_sdist:
name: Build source distribution
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v6
with:
persist-credentials: false
- name: Build sdist
run: pipx run build --sdist
- uses: actions/upload-artifact@v4
with:
name: cibw-sdist
path: dist/*.tar.gz
upload_pypi:
needs: [build_wheels, build_sdist]
runs-on: ubuntu-latest
environment: pypi
permissions:
id-token: write
if: github.event_name == 'release' && github.event.action == 'published'
# or, alternatively, upload to PyPI on every tag starting with 'v' (remove on: release above to use this)
# if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
steps:
- uses: actions/download-artifact@v5
with:
# unpacks all CIBW artifacts into dist/
pattern: cibw-*
path: dist
merge-multiple: true
- uses: pypa/gh-action-pypi-publish@release/v1
# To test uploads to TestPyPI, uncomment the following:
# with:
# repository-url: https://test.pypi.org/legacy/