Publish to PyPI workflow (jrialland/python-astar)

The Publish to PyPI workflow from jrialland/python-astar, explained and optimized by Latchkey.

What it does

This is the Publish to PyPI workflow from the jrialland/python-astar repository, a real project running GitHub Actions. It is shown here with attribution under its BSD-3-Clause license.

Below, Latchkey shows a faster, safer version produced by its optimization engine.

The workflow

name: Publish to PyPI

on:
  workflow_dispatch:
    inputs:
      tag:
        description: 'Git tag to release (for example: v1.2.3)'
        required: true
        type: string

jobs:
  publish:
    name: Build and publish distribution
    runs-on: ubuntu-22.04
    environment: pypi_release

    permissions:
      contents: read

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          ref: ${{ inputs.tag }}

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.13'

      - name: Install Poetry
        run: pipx install poetry

      - name: Build distributions
        run: poetry build

      - name: Check PyPI token is configured
        env:
          PYPI_TOKEN: ${{ secrets.PYPI_TOKEN }}
        run: |
          if [ -z "$PYPI_TOKEN" ]; then
            echo "PYPI_TOKEN secret is empty or unavailable in the pypi_release environment." >&2
            exit 1
          fi

      - name: Publish to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          user: __token__
          password: ${{ secrets.PYPI_TOKEN }}

The same workflow, on Latchkey

Estimated ~20% faster on cache hits, plus fewer wasted runs and a safer supply chain. Added and changed lines are highlighted.

name: Publish to PyPI
 
on:
  workflow_dispatch:
    inputs:
      tag:
        description: 'Git tag to release (for example: v1.2.3)'
        required: true
        type: string
 
jobs:
  publish:
    timeout-minutes: 30
    name: Build and publish distribution
    runs-on: latchkey-small
    environment: pypi_release
 
    permissions:
      contents: read
 
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          ref: ${{ inputs.tag }}
 
      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          cache: 'pip'
          python-version: '3.13'
 
      - name: Install Poetry
        run: pipx install poetry
 
      - name: Build distributions
        run: poetry build
 
      - name: Check PyPI token is configured
        env:
          PYPI_TOKEN: ${{ secrets.PYPI_TOKEN }}
        run: |
          if [ -z "$PYPI_TOKEN" ]; then
            echo "PYPI_TOKEN secret is empty or unavailable in the pypi_release environment." >&2
            exit 1
          fi
 
      - name: Publish to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          user: __token__
          password: ${{ secrets.PYPI_TOKEN }}
 

What changed

• Run on Latchkey managed runners with one line (runs-on), which apply the fixes below automatically and self-heal transient failures. This example uses latchkey-small; pick the runner size that fits the job.
• Cache dependency installs on the setup step so they are served from cache.
• Add a job timeout so a hung step cannot burn hours of runner time.

1 third-party action is referenced by a movable tag. Pin it to the commit SHA (Latchkey resolves and applies this automatically) so a repointed tag cannot change what runs.

This workflow runs 1 job per trigger. On Latchkey the same minutes cost up to 58% less than GitHub-hosted, with zero queue time.

Actions used in this workflow