Deploy C++ workflow (scikit-hep/awkward)

The Deploy C++ workflow from scikit-hep/awkward, explained and optimized by Latchkey.

CI health: A - excellent

Point runs-on at Latchkey and get job timeouts, self-healing for flaky steps, and up to 58% lower cost, applied automatically.

Grade your own workflow free or run it on Latchkey →

Source: scikit-hep/awkward.github/workflows/deploy-cpp.ymlLicense BSD-3-ClauseView source

What it does

This is the Deploy C++ workflow from the scikit-hep/awkward repository, a real project running GitHub Actions. It is shown here with attribution under its BSD-3-Clause license.

Below, Latchkey shows a faster, safer version produced by its optimization engine.

The workflow

workflow (.yml)

name: Deploy C++

on:
  workflow_dispatch:
    inputs:
        publish-pypi:
            type: boolean
            description: Publish to PyPI

permissions:
  contents: read

concurrency:
  group: deploy-cpp-${{ github.ref }}
  cancel-in-progress: true

jobs:
  build-wheels:
    uses: ./.github/workflows/reusable-build-wheels.yml

  upload-awkward-cpp:
    name: Upload awkward-cpp
    needs: [build-wheels]
    runs-on: ubuntu-latest
    if: inputs.publish-pypi
    permissions:
      id-token: write # Required for trusted publishing to PyPI.
      attestations: write # Required to sign release artifacts before publishing.
      contents: read
    environment:
      name: "pypi"
      url: "https://pypi.org/project/awkward-cpp/"
    steps:

    - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
      with:
        pattern: "awkward-cpp*"
        path: dist
        merge-multiple: true

    - name: List distributions to be deployed
      run: ls -l dist/

    - name: Generate artifact attestation for sdist and wheel
      uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
      with:
        subject-path: "dist/awkward*cpp-*"

    - uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0

The same workflow, on Latchkey

Removes redundant runs and caps runaway jobs. Added and changed lines are highlighted.

name: Deploy C++
 
on:
  workflow_dispatch:
    inputs:
        publish-pypi:
            type: boolean
            description: Publish to PyPI
 
permissions:
  contents: read
 
concurrency:
  group: deploy-cpp-${{ github.ref }}
  cancel-in-progress: true
 
jobs:
  build-wheels:
    timeout-minutes: 30
    uses: ./.github/workflows/reusable-build-wheels.yml
 
  upload-awkward-cpp:
    timeout-minutes: 30
    name: Upload awkward-cpp
    needs: [build-wheels]
    runs-on: latchkey-small
    if: inputs.publish-pypi
    permissions:
      id-token: write # Required for trusted publishing to PyPI.
      attestations: write # Required to sign release artifacts before publishing.
      contents: read
    environment:
      name: "pypi"
      url: "https://pypi.org/project/awkward-cpp/"
    steps:
 
    - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
      with:
        pattern: "awkward-cpp*"
        path: dist
        merge-multiple: true
 
    - name: List distributions to be deployed
      run: ls -l dist/
 
    - name: Generate artifact attestation for sdist and wheel
      uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
      with:
        subject-path: "dist/awkward*cpp-*"
 
    - uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0

What changed

Run on Latchkey managed runners with one line (runs-on), which apply the fixes below automatically and self-heal transient failures. This example uses latchkey-small; pick the runner size that fits the job.
Add a job timeout so a hung step cannot burn hours of runner time.

This workflow runs 2 jobs per trigger. On Latchkey the same minutes cost up to 58% less than GitHub-hosted, with zero queue time.

Actions used in this workflow

actions/download-artifact