Build workflow (explosion/srsly)

The Build workflow from explosion/srsly, explained and optimized by Latchkey.

CI health: A - excellent

Point runs-on at Latchkey and get job timeouts, self-healing for flaky steps, and up to 58% lower cost, applied automatically.

Grade your own workflow free or run it on Latchkey →

Source: explosion/srsly.github/workflows/cibuildwheel.ymlLicense MITView source

What it does

This is the Build workflow from the explosion/srsly repository, a real project running GitHub Actions. It is shown here with attribution under its MIT license.

Below, Latchkey shows a faster, safer version produced by its optimization engine.

The workflow

workflow (.yml)

name: Build

concurrency:
  group: ${{ github.workflow }}
  cancel-in-progress: true

on:
  push:
    tags:
      # ytf did they invent their own syntax that's almost regex?
      # ** matches 'zero or more of any character'
      - 'release-v[0-9]+.[0-9]+.[0-9]+**'
      - 'prerelease-v[0-9]+.[0-9]+.[0-9]+**'
jobs:
  build_wheels:
    uses: explosion/gha-cibuildwheel/.github/workflows/cibuildwheel.yml@2c98f757f13d112cf73fcf4b627249f1fffb5aae # main
    permissions:
      contents: write
      actions: read
    with:
      wheel-name-pattern: "srsly-*.whl"
      pure-python: true
    secrets:
      gh-token: ${{ secrets.GITHUB_TOKEN }}

  retag_release:
    needs: build_wheels
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
      - name: Retag release from release-v* to v*
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          # Strip release- or prerelease- prefix to get the v* tag
          TRIGGER_TAG="${GITHUB_REF_NAME}"
          if [[ "$TRIGGER_TAG" == release-* ]]; then
            VERSION_TAG="${TRIGGER_TAG#release-}"
          elif [[ "$TRIGGER_TAG" == prerelease-* ]]; then
            VERSION_TAG="${TRIGGER_TAG#prerelease-}"
          else
            echo "Unexpected tag format: $TRIGGER_TAG"
            exit 1
          fi

          # Create the v* tag on the same commit
          git tag "$VERSION_TAG" "$GITHUB_SHA"
          git push origin "$VERSION_TAG"

          # Re-point the draft release to the v* tag
          gh release edit "$TRIGGER_TAG" --tag "$VERSION_TAG"

          # Delete the trigger tag
          git push origin --delete "$TRIGGER_TAG"

The same workflow, on Latchkey

Removes redundant runs and caps runaway jobs. Added and changed lines are highlighted.

name: Build
 
concurrency:
  group: ${{ github.workflow }}
  cancel-in-progress: true
 
on:
  push:
    tags:
      # ytf did they invent their own syntax that's almost regex?
      # ** matches 'zero or more of any character'
      - 'release-v[0-9]+.[0-9]+.[0-9]+**'
      - 'prerelease-v[0-9]+.[0-9]+.[0-9]+**'
jobs:
  build_wheels:
    timeout-minutes: 30
    uses: explosion/gha-cibuildwheel/.github/workflows/cibuildwheel.yml@2c98f757f13d112cf73fcf4b627249f1fffb5aae # main
    permissions:
      contents: write
      actions: read
    with:
      wheel-name-pattern: "srsly-*.whl"
      pure-python: true
    secrets:
      gh-token: ${{ secrets.GITHUB_TOKEN }}
 
  retag_release:
    timeout-minutes: 30
    needs: build_wheels
    runs-on: latchkey-small
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
      - name: Retag release from release-v* to v*
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          # Strip release- or prerelease- prefix to get the v* tag
          TRIGGER_TAG="${GITHUB_REF_NAME}"
          if [[ "$TRIGGER_TAG" == release-* ]]; then
            VERSION_TAG="${TRIGGER_TAG#release-}"
          elif [[ "$TRIGGER_TAG" == prerelease-* ]]; then
            VERSION_TAG="${TRIGGER_TAG#prerelease-}"
          else
            echo "Unexpected tag format: $TRIGGER_TAG"
            exit 1
          fi
 
          # Create the v* tag on the same commit
          git tag "$VERSION_TAG" "$GITHUB_SHA"
          git push origin "$VERSION_TAG"
 
          # Re-point the draft release to the v* tag
          gh release edit "$TRIGGER_TAG" --tag "$VERSION_TAG"
 
          # Delete the trigger tag
          git push origin --delete "$TRIGGER_TAG"

What changed

Run on Latchkey managed runners with one line (runs-on), which apply the fixes below automatically and self-heal transient failures. This example uses latchkey-small; pick the runner size that fits the job.
Add a job timeout so a hung step cannot burn hours of runner time.

This workflow runs 2 jobs per trigger. On Latchkey the same minutes cost up to 58% less than GitHub-hosted, with zero queue time.

Actions used in this workflow

actions/checkout