Build workflow (mirumee/ariadne)
The Build workflow from mirumee/ariadne, explained and optimized by Latchkey.
CI health: C - fair
Point runs-on at Latchkey and get caching, job timeouts, SHA-pinned actions, self-healing for flaky steps, and up to 58% lower cost, applied automatically.
What it does
This is the Build workflow from the mirumee/ariadne repository, a real project running GitHub Actions. It is shown here with attribution under its BSD-3-Clause license.
Below, Latchkey shows a faster, safer version produced by its optimization engine.
The workflow
name: Build
on:
workflow_call:
workflow_dispatch:
env:
PYTHONUNBUFFERED: "1"
FORCE_COLOR: "1"
jobs:
test:
uses: ./.github/workflows/test.yml
permissions:
contents: read
build:
name: Build distribution 📦
runs-on: ubuntu-latest
needs:
- test
steps:
- name: Checkout source code
uses: actions/checkout@v4
- name: Set up Python 3.10
uses: actions/setup-python@v5
with:
python-version-file: pyproject.toml
- name: Install Hatch
uses: pypa/hatch@257e27e51a6a5616ed08a39a408a21c35c9931bc
- name: Set package version from tag
run: hatch version $(git describe --tags --always)
- name: Build package
run: hatch build
- name: Store the distribution packages
uses: actions/upload-artifact@v4
with:
name: python-package-distributions
path: dist/
sign-release:
name: >-
Sign the Python 🐍 distribution 📦 with Sigstore
needs:
- build
runs-on: ubuntu-latest
permissions:
id-token: write # IMPORTANT: mandatory for sigstore
steps:
- name: Download all the dists
uses: actions/download-artifact@v4
with:
name: python-package-distributions
path: dist/
- name: Sign the dists with Sigstore
uses: sigstore/gh-action-sigstore-python@v3.0.0
with:
inputs: >-
./dist/*.tar.gz
./dist/*.whl
- name: Store the signature files
uses: actions/upload-artifact@v4
with:
name: python-package-distributions
path: dist/
overwrite: true
The same workflow, on Latchkey
Estimated ~20% faster on cache hits, plus fewer wasted runs and a safer supply chain. Added and changed lines are highlighted.
name: Build on: workflow_call: workflow_dispatch: env: PYTHONUNBUFFERED: "1" FORCE_COLOR: "1" jobs: test: timeout-minutes: 30 uses: ./.github/workflows/test.yml permissions: contents: read build: timeout-minutes: 30 name: Build distribution 📦 runs-on: latchkey-small needs: - test steps: - name: Checkout source code uses: actions/checkout@v4 - name: Set up Python 3.10 uses: actions/setup-python@v5 with: cache: 'pip' python-version-file: pyproject.toml - name: Install Hatch uses: pypa/hatch@257e27e51a6a5616ed08a39a408a21c35c9931bc - name: Set package version from tag run: hatch version $(git describe --tags --always) - name: Build package run: hatch build - name: Store the distribution packages uses: actions/upload-artifact@v4 with: name: python-package-distributions path: dist/ sign-release: timeout-minutes: 30 name: >- Sign the Python 🐍 distribution 📦 with Sigstore needs: - build runs-on: latchkey-small permissions: id-token: write # IMPORTANT: mandatory for sigstore steps: - name: Download all the dists uses: actions/download-artifact@v4 with: name: python-package-distributions path: dist/ - name: Sign the dists with Sigstore uses: sigstore/gh-action-sigstore-python@v3.0.0 with: inputs: >- ./dist/*.tar.gz ./dist/*.whl - name: Store the signature files uses: actions/upload-artifact@v4 with: name: python-package-distributions path: dist/ overwrite: true
What changed
- Run on Latchkey managed runners with one line (
runs-on), which apply the fixes below automatically and self-heal transient failures. This example useslatchkey-small; pick the runner size that fits the job. - Cache dependency installs on the setup step so they are served from cache.
- Add a job timeout so a hung step cannot burn hours of runner time.
1 third-party action is referenced by a movable tag. Pin it to the commit SHA (Latchkey resolves and applies this automatically) so a repointed tag cannot change what runs.
This workflow runs 3 jobs per trigger. On Latchkey the same minutes cost up to 58% less than GitHub-hosted, with zero queue time.