Skip to content

Regenerate the workflow onto xmsconan job (xmsconan 2.30.0) - #203

Merged
wdolinar merged 2 commits into
masterfrom
task/verify-5-4
Sep 10, 2026
Merged

wdolinar merged 2 commits into
masterfrom
task/verify-5-4

Conversation

@wdolinar

@wdolinar wdolinar commented Sep 9, 2026

Copy link
Copy Markdown
Member

Regenerates .github/workflows/XmsGrid-CI.yaml from build.toml with xmsconan 2.30.0, which collapses each job's steps onto the xmsconan job commands. Generated file: the change belongs to xmsconan's templates, not to this repo, and nothing here was hand-edited.

What changed

  • Every leg installs xmsconan[ci]>=2.30.0,<3 and runs xmsconan job build, job package, job deploy and job lint instead of inline YAML. The matrix filter, the wheel and artifacts directories, the repair platform and the archive name are read from build.toml and the job environment.
  • The get-git-tag, set-env and branch-name action steps are gone. They computed a version and a channel that the tools now read from GITHUB_REF_NAME themselves. The separate conan cache save step folds into job deploy --cache-archive.
  • Secrets move from job-level env: onto the steps that use them, so the pinned third-party actions and the artifact uploads no longer run with the Conan and devpi credentials in their environment.

Verification

Branch pipeline on this commit: all 15 legs green — https://github.com/Aquaveo/xmsgrid/actions/runs/34404966126

Macos/Linux/Windows across Debug and Release and py3.10/3.13/3.14, plus Flake Project.

Not yet exercised: the tag-gated deploy steps (job deploy --wheels-only, job deploy --conan-only --from-cache). Tagging 9.1.2 after this merges is what covers them.

One settings-side change

AQUAPI_URL is now read from the repository or organization variable AQUAPI_URL_DEV, not from a secret of that name, and falls back to https://public.aquapi.aquaveo.com/aquaveo/dev/ when unset. This repo currently defines no Actions variables. If that URL lives in an org secret today, add it as a variable before the 9.1.2 tag, or the wheel upload will quietly target the default index instead.

Doc impact

None in this repo. The job commands are documented in xmsconan docs/USAGE.md section 10.4.

Every leg installs xmsconan[ci]>=2.30.0,<3 and calls `xmsconan job build`,
`job package`, `job deploy` and `job lint` instead of spelling the same
steps out in YAML. What the template used to interpolate -- the matrix
filter, the wheel and artifacts directories, the repair platform, the
archive name -- the tools now read from build.toml and this job's
environment.

Three action-driven steps go with it. get-git-tag, set-env and branch-name
existed to compute a version and a channel that the tools read from
GITHUB_REF_NAME themselves, and the `conan cache save` step folds into
`job deploy --cache-archive`.

Secrets move from job-level env onto the steps that use them, so the pinned
third-party actions and the artifact uploads no longer run with the Conan
and devpi credentials in their environment.

Note one settings-side change: AQUAPI_URL_DEV is read as a repository
*variable* now rather than a secret, and defaults to the public dev index
when unset.

Generated, not hand-written -- `xmsconan_ci build.toml`.
Supersedes the closing note on this branch's previous commit, which said
AQUAPI_URL_DEV is read as a repository *variable* now rather than a secret.
That was true of 2.30.0 and it is the half of this branch worth correcting
before it merges: the org secret this repository has always used would have
stopped being read, and nothing would have said so.

As of 2.30.1 the wheel upload reads both names, in this order -- the
*variable* AQUAPI_URL_DEV, then the *secret* of the same name, then the
built-in public dev index. The existing secret keeps working untouched. A
non-empty variable wins over it; an empty variable does not, and falls
through.

The step also sets AQUAPI_URL_SOURCE from the same operands in the same
order and echoes it before uploading. The URL itself cannot answer "which
of the three supplied this": the built-in default is byte-identical to the
org secret's value, and GitHub masks by value rather than by the name a
value was read under, so the upload target renders `***` whichever source
won. The source label matches no secret, so it is never masked and the
deploy log names the source directly.

Every install line moves to xmsconan[ci]>=2.30.1,<3 with it.

Generated, not hand-written -- `xmsconan_ci build.toml`.
@wdolinar
wdolinar merged commit ad625a6 into master Sep 10, 2026
30 checks passed
@wdolinar
wdolinar deleted the task/verify-5-4 branch September 10, 2026 04:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant