Publish package workflow (Tlaloc-Es/killpy)

The Publish package workflow from Tlaloc-Es/killpy, explained and optimized by Latchkey.

What it does

This is the Publish package workflow from the Tlaloc-Es/killpy repository, a real project running GitHub Actions. It is shown here with attribution under its MIT license.

Below, Latchkey shows a faster, safer version produced by its optimization engine.

The workflow

name: Publish package

on:
  workflow_run:
    workflows: ["Bump version"]
    types:
      - completed
  workflow_dispatch:

jobs:
  publish-service-client-package:
    if: >-
      github.event_name == 'workflow_dispatch' ||
      (github.event.workflow_run.conclusion == 'success' &&
      github.event.workflow_run.head_branch == 'master')
    runs-on: ubuntu-latest
    name: "Publish package at PyPi"
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v5
        with:
          submodules: recursive
          token: ${{ secrets.GITHUB_TOKEN }}
      - name: Install uv
        uses: astral-sh/setup-uv@v7.3.0
      - name: "build"
        env:
          UV_PUBLISH_TOKEN: ${{ secrets.PYPI_API_TOKEN }}
        id: build
        run: |
          uv build
          uv publish

The same workflow, on Latchkey

Removes redundant runs and caps runaway jobs. Added and changed lines are highlighted.

name: Publish package
 
on:
  workflow_run:
    workflows: ["Bump version"]
    types:
      - completed
  workflow_dispatch:
 
jobs:
  publish-service-client-package:
    timeout-minutes: 30
    if: >-
      github.event_name == 'workflow_dispatch' ||
      (github.event.workflow_run.conclusion == 'success' &&
      github.event.workflow_run.head_branch == 'master')
    runs-on: latchkey-small
    name: "Publish package at PyPi"
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v5
        with:
          submodules: recursive
          token: ${{ secrets.GITHUB_TOKEN }}
      - name: Install uv
        uses: astral-sh/setup-uv@v7.3.0
      - name: "build"
        env:
          UV_PUBLISH_TOKEN: ${{ secrets.PYPI_API_TOKEN }}
        id: build
        run: |
          uv build
          uv publish
 

What changed

• Run on Latchkey managed runners with one line (runs-on), which apply the fixes below automatically and self-heal transient failures. This example uses latchkey-small; pick the runner size that fits the job.
• Add a job timeout so a hung step cannot burn hours of runner time.

1 third-party action is referenced by a movable tag. Pin it to the commit SHA (Latchkey resolves and applies this automatically) so a repointed tag cannot change what runs.

This workflow runs 1 job per trigger. On Latchkey the same minutes cost up to 58% less than GitHub-hosted, with zero queue time.

Actions used in this workflow