Publishing workflow (xing5/mcp-google-sheets)
The Publishing workflow from xing5/mcp-google-sheets, explained and optimized by Latchkey.
B
CI health: B - good
Point runs-on at Latchkey and get job timeouts, SHA-pinned actions, self-healing for flaky steps, and up to 58% lower cost, applied automatically.
What it does
This is the Publishing workflow from the xing5/mcp-google-sheets repository, a real project running GitHub Actions. It is shown here with attribution under its MIT license.
Below, Latchkey shows a faster, safer version produced by its optimization engine.
The workflow
workflow (.yml)
name: Publishing
on:
release:
types: [published]
jobs:
release-build:
name: Build distribution
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with:
fetch-depth: 0
- name: Install uv
uses: astral-sh/setup-uv@v5
- name: Set up Python 3.12
run: uv python install 3.12
- name: Install dependencies
run: uv sync --frozen --all-extras --dev --python 3.12
- name: Build package
run: uv build
- name: Upload distribution
uses: actions/upload-artifact@v4
with:
name: release-dists
path: dist/
live-google-integration:
name: Live Google integration tests
runs-on: ubuntu-latest
needs: release-build
env:
RUN_GOOGLE_INTEGRATION: "1"
DRIVE_FOLDER_ID: ${{ secrets.GOOGLE_DRIVE_FOLDER_ID }}
CREDENTIALS_CONFIG: ${{ secrets.GOOGLE_CREDENTIALS_CONFIG }}
GOOGLE_SERVICE_ACCOUNT_JSON: ${{ secrets.GOOGLE_SERVICE_ACCOUNT_JSON }}
GOOGLE_TEST_SHARE_EMAIL: ${{ secrets.GOOGLE_TEST_SHARE_EMAIL }}
steps:
- uses: actions/checkout@v4
with:
fetch-depth: 0
- name: Install uv
uses: astral-sh/setup-uv@v5
- name: Set up Python 3.12
run: uv python install 3.12
- name: Install dependencies
run: uv sync --frozen --python 3.12
- name: Prepare Google credentials
run: |
if [ -n "$GOOGLE_SERVICE_ACCOUNT_JSON" ]; then
service_account_path="$RUNNER_TEMP/google-service-account.json"
printf '%s' "$GOOGLE_SERVICE_ACCOUNT_JSON" > "$service_account_path"
echo "SERVICE_ACCOUNT_PATH=$service_account_path" >> "$GITHUB_ENV"
fi
if [ -z "$DRIVE_FOLDER_ID" ]; then
echo "GOOGLE_DRIVE_FOLDER_ID secret is required." >&2
exit 1
fi
if [ -z "$GOOGLE_SERVICE_ACCOUNT_JSON" ] && [ -z "$CREDENTIALS_CONFIG" ]; then
echo "Set either GOOGLE_SERVICE_ACCOUNT_JSON or GOOGLE_CREDENTIALS_CONFIG." >&2
exit 1
fi
- name: Run live Google integration tests
run: uv run --python 3.12 python -m unittest tests.test_google_integration
pypi-publish:
name: Upload release to PyPI
runs-on: ubuntu-latest
needs:
- release-build
- live-google-integration
permissions:
id-token: write # For trusted publishing
steps:
- name: Download release dists
uses: actions/download-artifact@v4
with:
name: release-dists
path: dist/
- name: Publish to PyPI
uses: pypa/gh-action-pypi-publish@release/v1
The same workflow, on Latchkey
Removes redundant runs and caps runaway jobs. Added and changed lines are highlighted.
name: Publishing on: release: types: [published] jobs: release-build: timeout-minutes: 30 name: Build distribution runs-on: latchkey-small steps: - uses: actions/checkout@v4 with: fetch-depth: 0 - name: Install uv uses: astral-sh/setup-uv@v5 - name: Set up Python 3.12 run: uv python install 3.12 - name: Install dependencies run: uv sync --frozen --all-extras --dev --python 3.12 - name: Build package run: uv build - name: Upload distribution uses: actions/upload-artifact@v4 with: name: release-dists path: dist/ live-google-integration: timeout-minutes: 30 name: Live Google integration tests runs-on: latchkey-small needs: release-build env: RUN_GOOGLE_INTEGRATION: "1" DRIVE_FOLDER_ID: ${{ secrets.GOOGLE_DRIVE_FOLDER_ID }} CREDENTIALS_CONFIG: ${{ secrets.GOOGLE_CREDENTIALS_CONFIG }} GOOGLE_SERVICE_ACCOUNT_JSON: ${{ secrets.GOOGLE_SERVICE_ACCOUNT_JSON }} GOOGLE_TEST_SHARE_EMAIL: ${{ secrets.GOOGLE_TEST_SHARE_EMAIL }} steps: - uses: actions/checkout@v4 with: fetch-depth: 0 - name: Install uv uses: astral-sh/setup-uv@v5 - name: Set up Python 3.12 run: uv python install 3.12 - name: Install dependencies run: uv sync --frozen --python 3.12 - name: Prepare Google credentials run: | if [ -n "$GOOGLE_SERVICE_ACCOUNT_JSON" ]; then service_account_path="$RUNNER_TEMP/google-service-account.json" printf '%s' "$GOOGLE_SERVICE_ACCOUNT_JSON" > "$service_account_path" echo "SERVICE_ACCOUNT_PATH=$service_account_path" >> "$GITHUB_ENV" fi if [ -z "$DRIVE_FOLDER_ID" ]; then echo "GOOGLE_DRIVE_FOLDER_ID secret is required." >&2 exit 1 fi if [ -z "$GOOGLE_SERVICE_ACCOUNT_JSON" ] && [ -z "$CREDENTIALS_CONFIG" ]; then echo "Set either GOOGLE_SERVICE_ACCOUNT_JSON or GOOGLE_CREDENTIALS_CONFIG." >&2 exit 1 fi - name: Run live Google integration tests run: uv run --python 3.12 python -m unittest tests.test_google_integration pypi-publish: timeout-minutes: 30 name: Upload release to PyPI runs-on: latchkey-small needs: - release-build - live-google-integration permissions: id-token: write # For trusted publishing steps: - name: Download release dists uses: actions/download-artifact@v4 with: name: release-dists path: dist/ - name: Publish to PyPI uses: pypa/gh-action-pypi-publish@release/v1
What changed
- Run on Latchkey managed runners with one line (
runs-on), which apply the fixes below automatically and self-heal transient failures. This example useslatchkey-small; pick the runner size that fits the job. - Add a job timeout so a hung step cannot burn hours of runner time.
2 third-party actions are referenced by a movable tag. Pin them to the commit SHA (Latchkey resolves and applies this automatically) so a repointed tag cannot change what runs.
This workflow runs 3 jobs per trigger. On Latchkey the same minutes cost up to 58% less than GitHub-hosted, with zero queue time.