From acbc3a55583039e415388e5664d9e96c368345f1 Mon Sep 17 00:00:00 2001 From: Ruben Vorderman Date: Tue, 3 Nov 2026 12:01:47 +0100 Subject: [PATCH 1/3] Publish to PyPI according to PyPA recommended method --- .github/workflows/ci.yml | 66 +++++++++++++++++++++++++++++++--------- 1 file changed, 52 insertions(+), 14 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index abb29d4..6ce4b05 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -156,7 +156,31 @@ jobs: env: PYTHON_ZLIB_NG_LINK_DYNAMIC: True - deploy: + make_sdist: + if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags') + needs: + - lint + - package-checks + - test-static + - test-dynamic + - test-arch + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v6 + with: + fetch-depth: 0 # Optional, use if you use setuptools_scm + submodules: true # Optional, use if you have submodules + persist-credentials: false # Highly recommended as a good security practice to not store credentials in disk, unless you need this for your specific use case + + - name: Build SDist + run: pipx run build --sdist + + - uses: actions/upload-artifact@v4 + with: + name: cibw-sdist + path: dist/*.tar.gz + + build_wheels: if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags') runs-on: ${{ matrix.os }} needs: @@ -239,19 +263,33 @@ jobs: python -m build --sdist - uses: actions/upload-artifact@v7 with: - name: "dist-${{ runner.os }}-${{ runner.arch }}-${{ matrix.cibw_archs_linux }}" + name: "cibw-${{ runner.os }}-${{ runner.arch }}-${{ matrix.cibw_archs_linux }}" path: "dist/" - - name: Publish package to TestPyPI - # pypa/gh-action-pypi-publish@master does not work on OSX + + upload_to_pypi: + needs: [ build_wheels, make_sdist ] + environment: pypi + permissions: + id-token: write + runs-on: ubuntu-latest + if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags') + steps: + - uses: actions/download-artifact@v5 + with: + pattern: cibw-* + path: dist + merge-multiple: true + + - name: Publish to test PyPI # Alpha, Beta and dev releases contain a - in the tag. - if: contains(github.ref, '-') && startsWith(github.ref, 'refs/tags') - run: twine upload --skip-existing -r testpypi dist/* - env: - TWINE_USERNAME: __token__ - TWINE_PASSWORD: ${{ secrets.TEST_PYPI_API_TOKEN }} - - name: Publish package to PyPI + if: "contains(github.ref, '-') && startsWith(github.ref, 'refs/tags')" + uses: pypa/gh-action-pypi-publish@release/v1 + with: + repository-url: https://test.pypi.org/legacy/ + skip-existing: true + + - name: Publish to PyPI if: "!contains(github.ref, '-') && startsWith(github.ref, 'refs/tags')" - run: twine upload --skip-existing dist/* - env: - TWINE_USERNAME: __token__ - TWINE_PASSWORD: ${{ secrets.PYPI_API_TOKEN }} + uses: pypa/gh-action-pypi-publish@release/v1 + with: + skip-existing: true From c1ca45cff61d2d87d917bccf9f5b791d14c8f56b Mon Sep 17 00:00:00 2001 From: Ruben Vorderman Date: Tue, 3 Nov 2026 12:03:11 +0100 Subject: [PATCH 2/3] Add sanitizer testing --- .github/workflows/ci.yml | 45 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 45 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 6ce4b05..275fc72 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -156,6 +156,49 @@ jobs: env: PYTHON_ZLIB_NG_LINK_DYNAMIC: True + # Run the tests on CPython builds with AddressSanitizer and ThreadSanitizer + # from https://github.com/nascheme/cpython_sanity. + test-sanitizers: + runs-on: ubuntu-latest + # A crash under ThreadSanitizer can hang instead of exiting. + timeout-minutes: 30 + strategy: + fail-fast: false + matrix: + include: + - sanitizer: address + image: ghcr.io/nascheme/cpython-asan:3.14 + # The free-threaded build runs Python threads in parallel. + - sanitizer: thread + image: ghcr.io/nascheme/cpython-tsan:3.14t + container: + image: ${{ matrix.image }} + steps: + - uses: actions/checkout@v4 + with: + submodules: recursive + - name: Install build dependencies + run: apt-get update && apt-get install -y nasm + - name: Install python-isal with ${{ matrix.sanitizer }} sanitizer + # setuptools-scm needs git, and the container user does not own the + # repository. + run: | + git config --global --add safe.directory "$GITHUB_WORKSPACE" + python -m pip install . pytest pytest-timeout + env: + # The extension modules get -fsanitize from CPython. CFLAGS adds it + # to the C code of ISA-L. + CFLAGS: -fsanitize=${{ matrix.sanitizer }} -fno-omit-frame-pointer -g + - name: Run tests + # Do not set PYTHONDEVMODE. Its debug allocator pads each allocation, + # so AddressSanitizer misses small overflows. --capture=sys prints + # sanitizer reports from C code even when they end the process, and + # -v prints the name of the test before its report. + run: python -m pytest -v tests --capture=sys + env: + # Exit at the first data race. A crash after a race can hang. + TSAN_OPTIONS: halt_on_error=1 + make_sdist: if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags') needs: @@ -164,6 +207,7 @@ jobs: - test-static - test-dynamic - test-arch + - test-sanitizers runs-on: ubuntu-latest steps: - uses: actions/checkout@v6 @@ -189,6 +233,7 @@ jobs: - test-static - test-dynamic - test-arch + - test-sanitizers strategy: matrix: os: From 1e9f1626dc5c7a393e891999d07b19abda9dc2b4 Mon Sep 17 00:00:00 2001 From: Ruben Vorderman Date: Tue, 3 Nov 2026 12:53:09 +0100 Subject: [PATCH 3/3] Ensure cmake is installed on sanitizer --- .github/workflows/ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 275fc72..ec279fb 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -178,7 +178,7 @@ jobs: with: submodules: recursive - name: Install build dependencies - run: apt-get update && apt-get install -y nasm + run: apt-get update && apt-get install -y cmake - name: Install python-isal with ${{ matrix.sanitizer }} sanitizer # setuptools-scm needs git, and the container user does not own the # repository.