Repository navigation
Enable pypi distribution for pythonocc #1502
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,186 @@ | ||
| # pythonocc-core wheels for PyPI: Linux x86_64/aarch64, macOS x86_64/arm64, | ||
| # Windows AMD64, for CPython 3.11 to 3.15, plus the sdist. | ||
| # | ||
| # For each platform, a first job builds the native dependencies (SWIG, OCCT | ||
| # and its 3rd parties) with the scripts of ci/wheels/deps/ and saves them to | ||
| # the GitHub cache, then one job per Python version restores them and runs | ||
| # cibuildwheel (configured in pyproject.toml). Pushing a tag also uploads | ||
| # the wheels and the sdist to PyPI, through trusted publishing. | ||
|
|
||
| name: Wheels | ||
|
|
||
| # the pypi/* branches build the wheels, the review/* branches are left to | ||
| # the Azure conda pipeline. No pull_request trigger: a full build takes hours | ||
| on: | ||
| push: | ||
| branches: ["master", "pypi/**"] | ||
| # the paths filter does not apply to the tags | ||
| tags: ["*"] | ||
| paths: | ||
| - pyproject.toml | ||
| - CMakeLists.txt | ||
| - ci/wheels/** | ||
| - .github/workflows/wheels.yml | ||
| workflow_dispatch: | ||
|
|
||
| concurrency: | ||
| group: ${{ github.workflow }}-${{ github.ref }} | ||
| cancel-in-progress: true | ||
|
|
||
| permissions: | ||
| contents: read | ||
|
|
||
| jobs: | ||
| deps: | ||
| name: "${{ matrix.platform.name }}: dependencies" | ||
| runs-on: ${{ matrix.platform.os }} | ||
| timeout-minutes: 360 | ||
| strategy: | ||
| fail-fast: false | ||
| matrix: | ||
| platform: &platforms | ||
| # deps_path: the Linux tarball directory (mounted at /host in the | ||
| # manylinux container), the macOS/Windows install prefix. The | ||
| # prefix must be the same in the deps and wheels jobs. | ||
| - name: linux-x86_64 | ||
| os: ubuntu-24.04 | ||
| manylinux: quay.io/pypa/manylinux_2_28_x86_64 | ||
| deps_path: /home/runner/pyocc-deps-cache | ||
| deps_files: ci/wheels/deps/linux.sh | ||
| - name: linux-aarch64 | ||
| os: ubuntu-24.04-arm | ||
| manylinux: quay.io/pypa/manylinux_2_28_aarch64 | ||
| deps_path: /home/runner/pyocc-deps-cache | ||
| deps_files: ci/wheels/deps/linux.sh | ||
| - name: macos-x86_64 | ||
| os: macos-15-intel | ||
| arch: x86_64 | ||
| deps_path: /Users/runner/pyocc-deps | ||
| deps_files: ci/wheels/deps/macos.sh ci/wheels/triplets/x64-osx-pyocc.cmake | ||
| - name: macos-arm64 | ||
| os: macos-15 | ||
| arch: arm64 | ||
| deps_path: /Users/runner/pyocc-deps | ||
| deps_files: ci/wheels/deps/macos.sh ci/wheels/triplets/arm64-osx-pyocc.cmake | ||
| - name: windows-AMD64 | ||
| os: windows-2022 | ||
| arch: AMD64 | ||
| deps_path: C:/pyocc-deps | ||
| deps_files: ci/wheels/deps/windows.ps1 ci/wheels/triplets/x64-windows-pyocc.cmake | ||
| steps: | ||
| - uses: actions/checkout@v7 | ||
|
|
||
| - id: key | ||
| name: Dependencies cache key | ||
| shell: bash | ||
| run: | | ||
| set -eu | ||
| # bump DEPS_CACHE_VERSION to invalidate the caches | ||
| DEPS_CACHE_VERSION=1 | ||
| HASH=$(cat ${{ matrix.platform.deps_files }} | sha256sum | cut -c1-16) | ||
| echo "key=pyocc-deps-${{ matrix.platform.name }}-${DEPS_CACHE_VERSION}-${HASH}" >> "$GITHUB_OUTPUT" | ||
|
|
||
| - id: cache | ||
| uses: actions/cache@v6 | ||
| with: | ||
| path: ${{ matrix.platform.deps_path }} | ||
| key: ${{ steps.key.outputs.key }} | ||
|
|
||
| - name: Build SWIG and OCCT (manylinux container) | ||
| if: steps.cache.outputs.cache-hit != 'true' && runner.os == 'Linux' | ||
| run: | | ||
| set -eux | ||
| mkdir -p "${{ matrix.platform.deps_path }}" | ||
| docker run --rm \ | ||
| -v "$GITHUB_WORKSPACE:/project" \ | ||
| -v "${{ matrix.platform.deps_path }}:/deps-cache" \ | ||
| -e PYOCC_DEPS_CACHE=/deps-cache \ | ||
| ${{ matrix.platform.manylinux }} \ | ||
| bash /project/ci/wheels/deps/linux.sh | ||
|
|
||
| - name: Build SWIG and OCCT | ||
| if: steps.cache.outputs.cache-hit != 'true' && runner.os == 'macOS' | ||
| run: bash ci/wheels/deps/macos.sh | ||
| env: | ||
| ARCH: ${{ matrix.platform.arch }} | ||
| PYOCC_DEPS_PREFIX: ${{ matrix.platform.deps_path }} | ||
|
|
||
| - name: Build OCCT | ||
| if: steps.cache.outputs.cache-hit != 'true' && runner.os == 'Windows' | ||
| run: ./ci/wheels/deps/windows.ps1 | ||
| shell: pwsh | ||
| env: | ||
| PYOCC_DEPS_PREFIX: ${{ matrix.platform.deps_path }} | ||
|
|
||
| wheels: | ||
| name: "${{ matrix.platform.name }}: ${{ matrix.python }}" | ||
| needs: deps | ||
| runs-on: ${{ matrix.platform.os }} | ||
| timeout-minutes: 360 | ||
| strategy: | ||
| fail-fast: false | ||
| matrix: | ||
| platform: *platforms | ||
| python: [cp311, cp312, cp313, cp314, cp315] | ||
| steps: | ||
| - uses: actions/checkout@v7 | ||
|
|
||
| - id: key | ||
| name: Dependencies cache key | ||
| shell: bash | ||
| run: | | ||
| set -eu | ||
| # must match the deps job | ||
| DEPS_CACHE_VERSION=1 | ||
| HASH=$(cat ${{ matrix.platform.deps_files }} | sha256sum | cut -c1-16) | ||
| echo "key=pyocc-deps-${{ matrix.platform.name }}-${DEPS_CACHE_VERSION}-${HASH}" >> "$GITHUB_OUTPUT" | ||
|
|
||
| - uses: actions/cache/restore@v6 | ||
| with: | ||
| path: ${{ matrix.platform.deps_path }} | ||
| key: ${{ steps.key.outputs.key }} | ||
| fail-on-cache-miss: true | ||
|
|
||
| - uses: pypa/cibuildwheel@v4.3.1 | ||
| env: | ||
| CIBW_BUILD: ${{ matrix.python }}-* | ||
| CIBW_ARCHS_MACOS: ${{ matrix.platform.arch }} | ||
| # Linux: the host filesystem is mounted at /host in the container | ||
| PYOCC_DEPS_CACHE: /host${{ matrix.platform.deps_path }} | ||
| PYOCC_DEPS_PREFIX: ${{ matrix.platform.deps_path }} | ||
|
|
||
| - uses: actions/upload-artifact@v7 | ||
| with: | ||
| name: wheels-${{ matrix.platform.name }}-${{ matrix.python }} | ||
| path: wheelhouse/*.whl | ||
|
|
||
| sdist: | ||
| name: Source distribution | ||
| runs-on: ubuntu-24.04 | ||
| steps: | ||
| - uses: actions/checkout@v7 | ||
| - run: pipx run build --sdist | ||
| - uses: actions/upload-artifact@v7 | ||
| with: | ||
| name: sdist | ||
| path: dist/*.tar.gz | ||
|
|
||
| publish: | ||
| name: Upload to PyPI | ||
| if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/') | ||
|
There was a problem hiding this comment. 🟡 Medium · Mismatched tags publish wrong version When a pushed release tag does not match the CMake-derived package version, the workflow publishes artifacts using the version derived from Validate the release tag against the built distribution version and fail before publishing when they differ. Also at Prompt for AI agentsIn `.github/workflows/wheels.yml` at line 170:
**Mismatched tags publish wrong version**
When a pushed release tag does not match the CMake-derived package version, the workflow publishes artifacts using the version derived from `CMakeLists.txt` without checking it against the tag, so a mismatched release tag uploads a differently versioned distribution to PyPI.
Validate the release tag against the built distribution version and fail before publishing when they differ.
Also at `pyproject.toml:75`. |
||
| needs: [wheels, sdist] | ||
| runs-on: ubuntu-24.04 | ||
| # the trusted publisher configured on PyPI for this repository, this | ||
| # workflow and this environment | ||
| environment: | ||
| name: pypi | ||
| url: https://pypi.org/p/pythonocc-core | ||
| permissions: | ||
| id-token: write | ||
| steps: | ||
| - uses: actions/download-artifact@v8 | ||
| with: | ||
| path: dist | ||
| merge-multiple: true | ||
| - run: ls -l dist | ||
| - uses: pypa/gh-action-pypi-publish@v1.14.2 | ||
|
There was a problem hiding this comment. 🟡 Medium · Retries leave releases incomplete When a PyPI upload fails or is canceled after one or more distributions have been accepted, the publish action rejects already-uploaded files on retry, leaving the remaining distributions unpublished. Configure publishing to skip files already present on PyPI so a retry can upload the remaining distributions. Prompt for AI agentsIn `.github/workflows/wheels.yml` at line 186:
**Retries leave releases incomplete**
When a PyPI upload fails or is canceled after one or more distributions have been accepted, the publish action rejects already-uploaded files on retry, leaving the remaining distributions unpublished.
Configure publishing to skip files already present on PyPI so a retry can upload the remaining distributions. |
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -64,3 +64,6 @@ _build/ | |
| .Trashes | ||
| ehthumbs.db | ||
| Thumbs.db | ||
|
|
||
| # cibuildwheel | ||
| wheelhouse/ | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,61 @@ | ||
| # PyPI wheels | ||
|
|
||
| The pythonocc-core wheels published on PyPI are built by | ||
| [cibuildwheel](https://cibuildwheel.pypa.io) in the GitHub Actions workflow | ||
| `.github/workflows/wheels.yml`: | ||
|
|
||
| | Platform | Wheels | Runner | | ||
| |----------|--------------------------------------------|------------------------------| | ||
| | Linux | `manylinux_2_28_x86_64`, `manylinux_2_28_aarch64` | `ubuntu-24.04`, `ubuntu-24.04-arm` | | ||
| | macOS | `macosx_11_0_x86_64`, `macosx_11_0_arm64` | `macos-15-intel`, `macos-15` | | ||
| | Windows | `win_amd64` | `windows-2022` | | ||
|
|
||
| for CPython 3.11 to 3.15, plus the sdist. | ||
|
|
||
| * `pyproject.toml`: the scikit-build-core build, the version is read from | ||
| `CMakeLists.txt`, and the cibuildwheel configuration. | ||
| * `deps/`: the native dependencies build scripts: SWIG, OCCT and its 3rd | ||
| parties (freetype, FreeImage, RapidJSON). | ||
| * Linux: built in the manylinux_2_28 container, 3rd parties from the | ||
| system (EPEL for FreeImage). | ||
| * macOS, Windows: built on the runner, 3rd parties built by vcpkg through | ||
| the OCCT vcpkg manifest, with the triplets of `triplets/`. | ||
|
|
||
| For each platform, a first job builds the dependencies and saves them to the | ||
| GitHub cache (the key is a hash of the platform scripts and triplet), then one | ||
| job per Python version restores them and builds and tests a wheel. The | ||
| libraries are vendored in the wheels by auditwheel (Linux), delocate (macOS) | ||
| and delvewheel (Windows). | ||
|
|
||
| The workflow runs on the pushes to master and pypi/* that change the | ||
| packaging, on demand (workflow_dispatch), and on the tags. The review/* | ||
| branches are only built by the Azure conda pipeline. | ||
|
|
||
| ## Releasing | ||
|
|
||
| Pushing a tag builds the wheels and the sdist and uploads them to PyPI | ||
| through [trusted publishing](https://docs.pypi.org/trusted-publishers/). | ||
| This requires, once: | ||
|
|
||
| * on PyPI, a trusted publisher for the `pythonocc-core` project: owner | ||
| `tpaviot`, repository `pythonocc-core`, workflow `wheels.yml`, environment | ||
| `pypi`. | ||
| * on GitHub, a `pypi` environment in the repository settings (optionally | ||
| with required reviewers, to approve each upload). | ||
|
|
||
| When upgrading SWIG or OCCT, update the versions in the three `deps/` | ||
| scripts, the cache is invalidated by their change. | ||
|
|
||
| ## Building locally | ||
|
|
||
| Linux wheels can be built on any machine with docker: | ||
|
|
||
| ```bash | ||
| pip install cibuildwheel | ||
| # optional: cache SWIG and OCCT between runs (/host is the host filesystem) | ||
| export PYOCC_DEPS_CACHE=/host$HOME/.cache/pyocc-deps | ||
| CIBW_BUILD='cp312-*' cibuildwheel --platform linux | ||
| ``` | ||
|
|
||
| from a clean checkout: cibuildwheel copies the whole source tree into the | ||
| container. |
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🟠 High · Unreviewed tags publish releases
When a contributor who can create tags but is not authorized to approve releases tags an unreviewed commit, the wildcard tag trigger runs the release workflow for any tag, and the publish job uploads its artifacts without a required approval gate. A contributor able to tag an unreviewed commit but not authorized to approve a release can therefore publish that commit's package to PyPI.
Restrict release tags and require approval through a protected GitHub environment or tag ruleset before publishing.
Also at
.github/workflows/wheels.yml:170.Prompt for AI agents