on-push workflow (bopen/xarray-sentinel)

The on-push workflow from bopen/xarray-sentinel, explained and optimized by Latchkey.

CI health: C - fair

Point runs-on at Latchkey and get caching, job timeouts, SHA-pinned actions, self-healing for flaky steps, and up to 58% lower cost, applied automatically.

Grade your own workflow free or run it on Latchkey →

Source: bopen/xarray-sentinel.github/workflows/on-push.ymlLicense Apache-2.0View source

What it does

This is the on-push workflow from the bopen/xarray-sentinel repository, a real project running GitHub Actions. It is shown here with attribution under its Apache-2.0 license.

Below, Latchkey shows a faster, safer version produced by its optimization engine.

The workflow

workflow (.yml)

name: on-push

on:
  push:
    branches:
    - main
    tags:
    - '*'
  pull_request:
    branches:
    - main

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

defaults:
  run:
    shell: bash -l {0}

jobs:
  pre-commit:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v7
    - uses: actions/setup-python@v6
      with:
        python-version: 3.x
    - uses: pre-commit/action@v3.0.1

  unit-tests:
    name: unit-tests
    runs-on: ubuntu-latest
    strategy:
      matrix:
        python-version:
        - "3.14"

    steps:
    - uses: actions/checkout@v7
    - name: Install uv and set the python version
      uses: astral-sh/setup-uv@v7
      with:
        version: "0.11.17"
        enable-cache: true
        python-version: ${{ matrix.python-version }}

    - name: Run unit tests
      run: make unit-tests COV_REPORT=xml

  check-typing:
    needs: [unit-tests]
    runs-on: ubuntu-latest

    steps:
    - uses: actions/checkout@v7
    - name: Install uv and set the python version
      uses: astral-sh/setup-uv@v7
      with:
        version: "0.11.17"
        enable-cache: true
        python-version: "3.14"
    - name: Run type checks
      run: make check-typing

  docs-build:
    needs: [unit-tests]
    runs-on: ubuntu-latest

    steps:
    - uses: actions/checkout@v7
    - name: Install uv
      uses: astral-sh/setup-uv@v7
      with:
        version: "0.11.17"
        enable-cache: true
        python-version: "3.14"
    - name: Build documentation
      run: uv run --frozen make docs-build

  integration-tests:
    needs: [unit-tests]
    if: |
      success() && true
    runs-on: ubuntu-latest
    strategy:
      matrix:
        python-version:
        - "3.10"
        - "3.11"
        - "3.12"
        - "3.13"

    steps:
    - uses: actions/checkout@v7

    - name: Install uv and set the python version
      uses: astral-sh/setup-uv@v7
      with:
        version: "0.11.17"
        enable-cache: true
        python-version: ${{ matrix.python-version }}

    - name: Run unit tests
      run: uv run --frozen -m pytest .

  minver-tests:
    needs: [unit-tests]
    if: |
      success() && true
    runs-on: ubuntu-latest

    steps:
    - uses: actions/checkout@v7

    - name: Install uv and set the python version
      uses: astral-sh/setup-uv@v7
      with:
        version: "0.11.17"
        enable-cache: true
        python-version: "3.14"
    - name: Run tests
      run: uv run --resolution lowest-direct -p python3.10 -m pytest .

  distribution:
    runs-on: ubuntu-latest
    needs: [unit-tests, check-typing, docs-build, integration-tests]
    if: |
      always() &&
      needs.unit-tests.result == 'success' &&
      needs.check-typing.result == 'success' &&
      needs.docs-build.result == 'success' &&
      (needs.integration-tests.result == 'success' || needs.integration-tests.result == 'skipped')

    steps:
    - uses: actions/checkout@v7
    - uses: actions/setup-python@v6
      with:
        python-version-file: ".python-version"
    - name: Install package
      run: |
        python -m pip install --upgrade pip
        python -m pip install build twine
    - name: Build distribution
      run: |
        python -m build
    - name: Check wheels
      run: |
        cd dist || exit
        python -m pip install xarray_sentinel*.whl || exit
        python -m twine check --strict * || exit
        python -c "import xarray_sentinel" || exit
        cd ..
    - uses: actions/upload-artifact@v7
      with:
        name: distribution
        path: dist

  upload-to-pypi:
    runs-on: ubuntu-latest
    needs: distribution
    if: |
      always() && true &&
      needs.distribution.result == 'success' &&
      github.event_name == 'push' &&
      startsWith(github.ref, 'refs/tags')
    environment:
      name: pypi
      url: https://pypi.org/p/xarray-sentinel
    permissions:
      id-token: write  # IMPORTANT: this permission is mandatory for trusted publish

    steps:
    - uses: actions/download-artifact@v8
      with:
        name: distribution
        path: dist
    - uses: pypa/gh-action-pypi-publish@v1.14.0
      with:
        verbose: true

The same workflow, on Latchkey

Estimated ~20% faster on cache hits, plus fewer wasted runs and a safer supply chain. Added and changed lines are highlighted.

name: on-push
 
on:
  push:
    branches:
    - main
    tags:
    - '*'
  pull_request:
    branches:
    - main
 
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true
 
defaults:
  run:
    shell: bash -l {0}
 
jobs:
  pre-commit:
    timeout-minutes: 30
    runs-on: latchkey-small
    steps:
    - uses: actions/checkout@v7
    - uses: actions/setup-python@v6
      with:
        cache: 'pip'
        python-version: 3.x
    - uses: pre-commit/action@v3.0.1
 
  unit-tests:
    timeout-minutes: 30
    name: unit-tests
    runs-on: latchkey-small
    strategy:
      matrix:
        python-version:
        - "3.14"
 
    steps:
    - uses: actions/checkout@v7
    - name: Install uv and set the python version
      uses: astral-sh/setup-uv@v7
      with:
        version: "0.11.17"
        enable-cache: true
        python-version: ${{ matrix.python-version }}
 
    - name: Run unit tests
      run: make unit-tests COV_REPORT=xml
 
  check-typing:
    timeout-minutes: 30
    needs: [unit-tests]
    runs-on: latchkey-small
 
    steps:
    - uses: actions/checkout@v7
    - name: Install uv and set the python version
      uses: astral-sh/setup-uv@v7
      with:
        version: "0.11.17"
        enable-cache: true
        python-version: "3.14"
    - name: Run type checks
      run: make check-typing
 
  docs-build:
    timeout-minutes: 30
    needs: [unit-tests]
    runs-on: latchkey-small
 
    steps:
    - uses: actions/checkout@v7
    - name: Install uv
      uses: astral-sh/setup-uv@v7
      with:
        version: "0.11.17"
        enable-cache: true
        python-version: "3.14"
    - name: Build documentation
      run: uv run --frozen make docs-build
 
  integration-tests:
    timeout-minutes: 30
    needs: [unit-tests]
    if: |
      success() && true
    runs-on: latchkey-small
    strategy:
      matrix:
        python-version:
        - "3.10"
        - "3.11"
        - "3.12"
        - "3.13"
 
    steps:
    - uses: actions/checkout@v7
 
    - name: Install uv and set the python version
      uses: astral-sh/setup-uv@v7
      with:
        version: "0.11.17"
        enable-cache: true
        python-version: ${{ matrix.python-version }}
 
    - name: Run unit tests
      run: uv run --frozen -m pytest .
 
  minver-tests:
    timeout-minutes: 30
    needs: [unit-tests]
    if: |
      success() && true
    runs-on: latchkey-small
 
    steps:
    - uses: actions/checkout@v7
 
    - name: Install uv and set the python version
      uses: astral-sh/setup-uv@v7
      with:
        version: "0.11.17"
        enable-cache: true
        python-version: "3.14"
    - name: Run tests
      run: uv run --resolution lowest-direct -p python3.10 -m pytest .
 
  distribution:
    timeout-minutes: 30
    runs-on: latchkey-small
    needs: [unit-tests, check-typing, docs-build, integration-tests]
    if: |
      always() &&
      needs.unit-tests.result == 'success' &&
      needs.check-typing.result == 'success' &&
      needs.docs-build.result == 'success' &&
      (needs.integration-tests.result == 'success' || needs.integration-tests.result == 'skipped')
 
    steps:
    - uses: actions/checkout@v7
    - uses: actions/setup-python@v6
      with:
        cache: 'pip'
        python-version-file: ".python-version"
    - name: Install package
      run: |
        python -m pip install --upgrade pip
        python -m pip install build twine
    - name: Build distribution
      run: |
        python -m build
    - name: Check wheels
      run: |
        cd dist || exit
        python -m pip install xarray_sentinel*.whl || exit
        python -m twine check --strict * || exit
        python -c "import xarray_sentinel" || exit
        cd ..
    - uses: actions/upload-artifact@v7
      with:
        name: distribution
        path: dist
 
  upload-to-pypi:
    timeout-minutes: 30
    runs-on: latchkey-small
    needs: distribution
    if: |
      always() && true &&
      needs.distribution.result == 'success' &&
      github.event_name == 'push' &&
      startsWith(github.ref, 'refs/tags')
    environment:
      name: pypi
      url: https://pypi.org/p/xarray-sentinel
    permissions:
      id-token: write  # IMPORTANT: this permission is mandatory for trusted publish
 
    steps:
    - uses: actions/download-artifact@v8
      with:
        name: distribution
        path: dist
    - uses: pypa/gh-action-pypi-publish@v1.14.0
      with:
        verbose: true

What changed

Run on Latchkey managed runners with one line (runs-on), which apply the fixes below automatically and self-heal transient failures. This example uses latchkey-small; pick the runner size that fits the job.
Cache dependency installs on the setup step so they are served from cache.
Add a job timeout so a hung step cannot burn hours of runner time.

3 third-party actions are referenced by a movable tag. Pin them to the commit SHA (Latchkey resolves and applies this automatically) so a repointed tag cannot change what runs.

What Latchkey heals here

This workflow has steps that commonly fail on transient issues (network, registries, flaky browsers). On Latchkey managed runners they are detected, retried, and self-healed instead of failing your build:

Dependency installs

This workflow runs 8 jobs (11 with the matrix expanded) per trigger. On Latchkey the same minutes cost up to 58% less than GitHub-hosted, with zero queue time.

Actions used in this workflow

actions/checkout actions/setup-python pre-commit/action astral-sh/setup-uv actions/upload-artifact actions/download-artifact