Release workflow (simplistix/testfixtures)

The Release workflow from simplistix/testfixtures, explained and optimized by Latchkey.

CI health: B - good

Point runs-on at Latchkey and get job timeouts, SHA-pinned actions, self-healing for flaky steps, and up to 58% lower cost, applied automatically.

Grade your own workflow free or run it on Latchkey →

Source: simplistix/testfixtures.github/workflows/release.ymlLicense MITView source

What it does

This is the Release workflow from the simplistix/testfixtures repository, a real project running GitHub Actions. It is shown here with attribution under its MIT license.

Below, Latchkey shows a faster, safer version produced by its optimization engine.

The workflow

workflow (.yml)

name: "Release"

on:
  workflow_run:
    workflows: [Continuous Integration]
    types: [completed]
    branches: [main]

jobs:
  check:
    runs-on: ubuntu-latest
    if: ${{ github.repository == 'simplistix/testfixtures' && github.event.workflow_run.conclusion == 'success' }}
    outputs:
      tag: ${{ steps.carthorse.outputs.tag }}
    steps:
      - uses: cjw296/python-action/carthorse@v1
        id: carthorse
        with:
          tag-format: '{version}'
          check: "true"

  release:
    runs-on: ubuntu-latest
    needs: check
    if: ${{ needs.check.outputs.tag != '' }}
    permissions:
      contents: write
      id-token: write
    steps:
      - name: Show tag
        run: echo "${{ toJson(needs.check.outputs) }}"
        shell: bash

      - name: Download packages from CI run
        uses: dawidd6/action-download-artifact@v9
        with:
          run_id: ${{ github.event.workflow_run.id }}
          name: Packages
          path: dist

      - name: Publish package distributions to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1

      - uses: cjw296/python-action/carthorse@v1
        with:
          tag-format: '{version}'

The same workflow, on Latchkey

Removes redundant runs and caps runaway jobs. Added and changed lines are highlighted.

name: "Release"
 
on:
  workflow_run:
    workflows: [Continuous Integration]
    types: [completed]
    branches: [main]
 
jobs:
  check:
    timeout-minutes: 30
    runs-on: latchkey-small
    if: ${{ github.repository == 'simplistix/testfixtures' && github.event.workflow_run.conclusion == 'success' }}
    outputs:
      tag: ${{ steps.carthorse.outputs.tag }}
    steps:
      - uses: cjw296/python-action/carthorse@v1
        id: carthorse
        with:
          tag-format: '{version}'
          check: "true"
 
  release:
    timeout-minutes: 30
    runs-on: latchkey-small
    needs: check
    if: ${{ needs.check.outputs.tag != '' }}
    permissions:
      contents: write
      id-token: write
    steps:
      - name: Show tag
        run: echo "${{ toJson(needs.check.outputs) }}"
        shell: bash
 
      - name: Download packages from CI run
        uses: dawidd6/action-download-artifact@v9
        with:
          run_id: ${{ github.event.workflow_run.id }}
          name: Packages
          path: dist
 
      - name: Publish package distributions to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1
 
      - uses: cjw296/python-action/carthorse@v1
        with:
          tag-format: '{version}'

What changed

Run on Latchkey managed runners with one line (runs-on), which apply the fixes below automatically and self-heal transient failures. This example uses latchkey-small; pick the runner size that fits the job.
Add a job timeout so a hung step cannot burn hours of runner time.

3 third-party actions are referenced by a movable tag. Pin them to the commit SHA (Latchkey resolves and applies this automatically) so a repointed tag cannot change what runs.

This workflow runs 2 jobs per trigger. On Latchkey the same minutes cost up to 58% less than GitHub-hosted, with zero queue time.