Publish workflow (mirumee/ariadne)

The Publish workflow from mirumee/ariadne, explained and optimized by Latchkey.

What it does

This is the Publish workflow from the mirumee/ariadne repository, a real project running GitHub Actions. It is shown here with attribution under its BSD-3-Clause license.

Below, Latchkey shows a faster, safer version produced by its optimization engine.

The workflow

name: Publish

on:
  release:
    types:
      - published
  workflow_call:
  workflow_dispatch:

env:
  PYTHONUNBUFFERED: "1"
  FORCE_COLOR: "1"

jobs:
  publish-to-pypi:
    name: >-
      Publish Python 🐍 distribution 📦 to PyPI
    if: startsWith(github.ref, 'refs/tags/') # only publish to PyPI on tag pushes
    runs-on: ubuntu-latest
    environment:
      name: pypi
      url: https://pypi.org/p/ariadne
    permissions:
      # IMPORTANT: this permission is mandatory for trusted publishing
      id-token: write
      contents: read

    steps:
      - name: Download all the dists from the release
        env:
          GITHUB_TOKEN: ${{ github.token }}
        run: >-
          gh release download
          '${{ github.ref_name }}' 
          -p '*.whl' 
          -p '*.tar.gz'
          --dir dist/
          --repo '${{ github.repository }}'
      - name: Publish package distributions to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          skip-existing: true

The same workflow, on Latchkey

Removes redundant runs and caps runaway jobs. Added and changed lines are highlighted.

name: Publish
 
on:
  release:
    types:
      - published
  workflow_call:
  workflow_dispatch:
 
env:
  PYTHONUNBUFFERED: "1"
  FORCE_COLOR: "1"
 
jobs:
  publish-to-pypi:
    timeout-minutes: 30
    name: >-
      Publish Python 🐍 distribution 📦 to PyPI
    if: startsWith(github.ref, 'refs/tags/') # only publish to PyPI on tag pushes
    runs-on: latchkey-small
    environment:
      name: pypi
      url: https://pypi.org/p/ariadne
    permissions:
      # IMPORTANT: this permission is mandatory for trusted publishing
      id-token: write
      contents: read
 
    steps:
      - name: Download all the dists from the release
        env:
          GITHUB_TOKEN: ${{ github.token }}
        run: >-
          gh release download
          '${{ github.ref_name }}' 
          -p '*.whl' 
          -p '*.tar.gz'
          --dir dist/
          --repo '${{ github.repository }}'
      - name: Publish package distributions to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          skip-existing: true
 

What changed

• Run on Latchkey managed runners with one line (runs-on), which apply the fixes below automatically and self-heal transient failures. This example uses latchkey-small; pick the runner size that fits the job.
• Add a job timeout so a hung step cannot burn hours of runner time.

1 third-party action is referenced by a movable tag. Pin it to the commit SHA (Latchkey resolves and applies this automatically) so a repointed tag cannot change what runs.

This workflow runs 1 job per trigger. On Latchkey the same minutes cost up to 58% less than GitHub-hosted, with zero queue time.