kevin/deepseek-harness
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Prepare Python SDK public PyPI publication

Browse Source
This commit is contained in:
Yichen Jiang
2026-08-11 17:16:35 +08:00
parent 1d12ae62e7
commit 4445de9921
36 changed files with 874 additions and 127 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/build-exe-for-python-sdk.yml
+90 -13
View File
@@ -4,10 +4,22 @@ name: Build single-exe
# .agents/notes/implemented/architecture/2026-07-10-single-file-executable-sdk-runtime-distribution.md.
# A full target run retains one SDK wheel and three runtime wheels; subset
# dispatch retains the SDK wheel and selected runtime wheels. Bare executables
# and source closures are test inputs. Run manually or label a PR
# `build-exe` (remove and reapply to rerun). Checkout uses the triggering ref,
# so dispatch needs no separate ref input.
# and source closures are test inputs. Run manually, label a PR `build-exe`
# (remove and reapply to rerun), or call it from the Python release workflow.
# Checkout uses the triggering ref, so dispatch needs no separate ref input.
on:
workflow_call:
inputs:
targets:
description: Comma-separated pkg targets to build; empty builds all three.
type: string
required: false
default: ''
release:
description: Run as the native builder for the Python release workflow.
type: boolean
required: false
default: false
workflow_dispatch:
inputs:
targets:
@@ -22,7 +34,9 @@ on:
types: [labeled]
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
# Keep the called workflow distinct from its caller's concurrency group;
# github.workflow identifies the caller inside a reusable workflow.
group: build-single-exe-${{ github.ref }}
cancel-in-progress: true
permissions:
@@ -38,12 +52,13 @@ jobs:
# construct the matrix before the dependent jobs.
plan:
name: plan targets
if: github.event_name == 'workflow_dispatch' || github.event.label.name == 'build-exe'
if: inputs.release || github.event_name == 'workflow_dispatch' || github.event.label.name == 'build-exe'
runs-on: ubuntu-latest
timeout-minutes: 5
outputs:
matrix: ${{ steps.plan.outputs.matrix }}
version: ${{ steps.version.outputs.version }}
repository-version: ${{ steps.version.outputs.repository-version }}
steps:
- uses: actions/checkout@v6
@@ -51,12 +66,15 @@ jobs:
id: version
run: |
set -euo pipefail
version="$(jq -r '.version // empty' package.json)"
[[ "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]] || {
echo "::error::package.json version must be stable X.Y.Z, got '$version'"
exit 1
}
echo "version=$version" >> "$GITHUB_OUTPUT"
python3 - <<'PY' >> "$GITHUB_OUTPUT"
import runpy
release = runpy.run_path("scripts/build-python-release.py")
repository_version = release["repository_version"]()
wheel_version = release["pep440_version"](repository_version)
print(f"repository-version={repository_version}")
print(f"version={wheel_version}")
PY
- name: Compute matrix from targets input
id: plan
@@ -116,6 +134,7 @@ jobs:
name: deepseek_harness_sdk-${{ needs.plan.outputs.version }}-py3-none-any.whl
path: dist-python/deepseek_harness_sdk-${{ needs.plan.outputs.version }}-py3-none-any.whl
if-no-files-found: error
retention-days: 7
build:
needs: [plan, sdk-wheel]
@@ -157,6 +176,41 @@ jobs:
- name: Install (immutable)
run: pnpm install --frozen-lockfile
- name: Rebuild Linux node-pty against manylinux 2.28
if: runner.os == 'Linux'
env:
RUNNER_ARCH: ${{ runner.arch }}
run: |
set -euo pipefail
case "$RUNNER_ARCH" in
X64) image=quay.io/pypa/manylinux_2_28_x86_64 ;;
ARM64) image=quay.io/pypa/manylinux_2_28_aarch64 ;;
*) echo "::error::Unsupported Linux runner architecture $RUNNER_ARCH"; exit 1 ;;
esac
addon_dir="$(realpath packages/subprocess/subprocess-local/node_modules/node-pty)"
addon="$addon_dir/build/Release/pty.node"
[ -f "$addon_dir/build/Makefile" ] || {
echo "::error::node-pty install did not generate $addon_dir/build/Makefile"
exit 1
}
docker run --rm \
--user "$(id -u):$(id -g)" \
-v "$PWD:$PWD" \
-v "$HOME/.cache/node-gyp:$HOME/.cache/node-gyp:ro" \
-v "$HOME/setup-pnpm:$HOME/setup-pnpm:ro" \
-w "$addon_dir" \
"$image" \
bash -euxo pipefail -c \
'rm -rf build/Release && make -C build -j2 BUILDTYPE=Release'
[ -f "$addon" ] || { echo "::error::$addon missing after manylinux rebuild"; exit 1; }
readelf --version-info "$addon" | tee node-pty-glibc-versions.txt
maximum="$(sed -n 's/.*Name: GLIBC_\([0-9.]*\).*/\1/p' node-pty-glibc-versions.txt | sort -V | tail -1)"
[ -n "$maximum" ] || { echo "::error::No GLIBC requirements found in $addon"; exit 1; }
dpkg --compare-versions "$maximum" le 2.28 || {
echo "::error::node-pty addon requires GLIBC_$maximum but wheel claims manylinux_2_28"
exit 1
}
- name: Build single-exe
run: pnpm exec tsx scripts/build-exe-for-python-sdk.ts --targets=${{ matrix.target }}
@@ -173,7 +227,7 @@ jobs:
case "$platform" in
linux-x64) wheel=deepseek_harness_runtime_bin-$VERSION-py3-none-manylinux_2_28_x86_64.whl ;;
linux-arm64) wheel=deepseek_harness_runtime_bin-$VERSION-py3-none-manylinux_2_28_aarch64.whl ;;
macos-arm64) wheel=deepseek_harness_runtime_bin-$VERSION-py3-none-macosx_11_0_arm64.whl ;;
macos-arm64) wheel=deepseek_harness_runtime_bin-$VERSION-py3-none-macosx_14_0_arm64.whl ;;
*) echo "::error::Unsupported runtime platform $platform"; exit 1 ;;
esac
echo "platform=$platform" >> "$GITHUB_OUTPUT"
@@ -224,6 +278,28 @@ jobs:
exit 1
}
- name: Check macOS deployment target
if: runner.os == 'macOS'
env:
EXE: ${{ steps.runtime.outputs.exe }}
run: |
set -euo pipefail
minos="$(otool -l "$EXE" | awk '/LC_BUILD_VERSION/{seen=1; next} seen && /minos/{print $2; exit}')"
[ -n "$minos" ] || { echo "::error::No macOS deployment target found in $EXE"; exit 1; }
python3 - "$minos" <<'PY'
import sys
actual = tuple(int(part) for part in sys.argv[1].split("."))
claimed = (14, 0)
width = max(len(actual), len(claimed))
actual += (0,) * (width - len(actual))
claimed += (0,) * (width - len(claimed))
if actual > claimed:
raise SystemExit(
f"::error::Executable requires macOS {sys.argv[1]} but the wheel claims macosx_14_0"
)
PY
- name: Run wheel in a manylinux 2.28 container
if: runner.os == 'Linux'
env:
@@ -236,7 +312,7 @@ jobs:
ARM64) image=quay.io/pypa/manylinux_2_28_aarch64 ;;
*) echo "::error::Unsupported Linux runner architecture $RUNNER_ARCH"; exit 1 ;;
esac
docker run --rm -e VERSION -v "$PWD:/work" -w /work "$image" bash -euxo pipefail -c '
docker run --rm -e VERSION -e DSH_TELEMETRY_DISABLED -v "$PWD:/work" -w /work "$image" bash -euxo pipefail -c '
/opt/python/cp310-cp310/bin/python -m venv /tmp/dsh-sdk
/tmp/dsh-sdk/bin/python -m pip install --find-links /work/dist-python deepseek-harness-sdk=="$VERSION"
/tmp/dsh-sdk/bin/python /work/scripts/smoke-python-runtime.py --scenario sdk-default
@@ -247,3 +323,4 @@ jobs:
name: ${{ steps.runtime.outputs.wheel }}
path: dist-python/${{ steps.runtime.outputs.wheel }}
if-no-files-found: error
retention-days: 7
.github/workflows/python-release.yml
+238
View File
@@ -0,0 +1,238 @@
name: Release (Python)
# A PR labeled python-release-dry-run or a manual run with publish=false builds
# and validates the complete release without registry credentials. Publication
# is accepted only from a manual run on the matching python-v* tag when the
# private publisher-repository identity and public-PyPI switch are configured.
on:
workflow_dispatch:
inputs:
publish:
description: Publish the validated wheels to public PyPI. Must run from a python-v* tag.
required: true
type: boolean
default: false
pull_request:
types: [labeled]
permissions:
contents: read
concurrency:
# Public runs stay globally serialized across tags. Dry runs remain isolated
# by ref so they do not block an intentional publication.
group: ${{ github.event_name == 'workflow_dispatch' && inputs.publish && 'python-publication' || format('{0}-{1}', github.workflow, github.ref) }}
cancel-in-progress: false
jobs:
build:
name: Build four wheels
if: github.event_name == 'workflow_dispatch' || github.event.label.name == 'python-release-dry-run'
uses: ./.github/workflows/build-exe-for-python-sdk.yml
with:
targets: node24-linux-x64,node24-linux-arm64,node24-macos-arm64
release: true
python-compat:
name: Python ${{ matrix.python }} / installed SDK
needs: build
runs-on: ubuntu-latest
timeout-minutes: 10
strategy:
fail-fast: false
matrix:
python: ['3.10', '3.14']
steps:
- uses: actions/checkout@v6
with:
persist-credentials: false
- uses: actions/setup-python@v6.3.0
with:
python-version: ${{ matrix.python }}
- uses: actions/download-artifact@v8
with:
pattern: deepseek_harness_*
path: dist
merge-multiple: true
- name: Resolve installed wheel version
id: compatibility-version
run: |
python - <<'PY' >> "$GITHUB_OUTPUT"
import runpy
release = runpy.run_path("scripts/build-python-release.py")
repository_version = release["repository_version"]()
print(f"version={release['pep440_version'](repository_version)}")
PY
- name: Install and run the published entry path
run: |
python -m pip install --find-links dist "deepseek-harness-sdk==${{ steps.compatibility-version.outputs.version }}"
python scripts/smoke-python-runtime.py --scenario sdk-default
validate:
name: Validate release candidate
needs: [build, python-compat]
runs-on: ubuntu-latest
timeout-minutes: 10
outputs:
version: ${{ steps.version.outputs.version }}
steps:
- uses: actions/checkout@v6
with:
persist-credentials: false
- uses: actions/setup-python@v6.3.0
with:
python-version: '3.10'
- name: Resolve release version
id: version
run: |
python3 - <<'PY' >> "$GITHUB_OUTPUT"
import runpy
release = runpy.run_path("scripts/build-python-release.py")
repository_version = release["repository_version"]()
wheel_version = release["pep440_version"](repository_version)
print(f"repository-version={repository_version}")
print(f"version={wheel_version}")
PY
- name: Authorize publication request
env:
PUBLISH: ${{ github.event_name == 'workflow_dispatch' && inputs.publish }}
PUBLIC_PYPI_RELEASE_ENABLED: ${{ vars.PUBLIC_PYPI_RELEASE_ENABLED }}
PYPI_PUBLISHER_REPOSITORY: ${{ vars.PYPI_PUBLISHER_REPOSITORY }}
REPOSITORY: ${{ github.repository }}
REF_NAME: ${{ github.ref_name }}
REF_TYPE: ${{ github.ref_type }}
REPOSITORY_VERSION: ${{ steps.version.outputs.repository-version }}
run: |
set -euo pipefail
if [ "$PUBLISH" = true ]; then
[ -n "$PYPI_PUBLISHER_REPOSITORY" ] || {
echo "::error::Set the repository variable PYPI_PUBLISHER_REPOSITORY before publication."
exit 1
}
[ "$REPOSITORY" = "$PYPI_PUBLISHER_REPOSITORY" ] || {
echo "::error::This repository is not the configured PyPI publisher repository."
exit 1
}
[ "$PUBLIC_PYPI_RELEASE_ENABLED" = true ] || {
echo "::error::Set PUBLIC_PYPI_RELEASE_ENABLED=true before public publication."
exit 1
}
[ "$REF_TYPE" = tag ] && [ "$REF_NAME" = "python-v$REPOSITORY_VERSION" ] || {
echo "::error::Publication must run from tag python-v$REPOSITORY_VERSION."
exit 1
}
fi
- uses: actions/download-artifact@v8
with:
pattern: deepseek_harness_*
path: dist
merge-multiple: true
- name: Check release contents
env:
VERSION: ${{ steps.version.outputs.version }}
run: |
set -euo pipefail
expected="$(mktemp)"
actual="$(mktemp)"
printf '%s\n' \
"deepseek_harness_runtime_bin-$VERSION-py3-none-macosx_14_0_arm64.whl" \
"deepseek_harness_runtime_bin-$VERSION-py3-none-manylinux_2_28_aarch64.whl" \
"deepseek_harness_runtime_bin-$VERSION-py3-none-manylinux_2_28_x86_64.whl" \
"deepseek_harness_sdk-$VERSION-py3-none-any.whl" > "$expected"
find dist -maxdepth 1 -type f -name '*.whl' -exec basename {} \; | sort > "$actual"
diff -u "$expected" "$actual"
while IFS= read -r wheel; do
size="$(stat -c '%s' "dist/$wheel")"
[ "$size" -lt 100000000 ] || {
echo "::error::$wheel is $size bytes; public PyPI accepts at most 100000000 bytes by default."
exit 1
}
done < "$actual"
- name: Validate package metadata
run: |
python -m pip install twine==6.2.0
python -m twine check dist/*.whl
- name: Record artifact hashes
run: |
cd dist
sha256sum *.whl | sort -k2 > SHA256SUMS
cat SHA256SUMS
- uses: actions/upload-artifact@v7
with:
name: python-release-${{ steps.version.outputs.version }}
path: dist/*
if-no-files-found: error
retention-days: 7
publish-runtime:
name: Publish runtime wheels to public PyPI
if: github.event_name == 'workflow_dispatch' && inputs.publish
needs: validate
runs-on: ubuntu-latest
timeout-minutes: 10
environment: pypi-runtime
permissions:
contents: read
id-token: write
steps:
- uses: actions/download-artifact@v8
with:
name: python-release-${{ needs.validate.outputs.version }}
path: dist
- name: Select runtime wheels
run: |
mkdir -p dist/runtime
mv dist/deepseek_harness_runtime_bin-*.whl dist/runtime/
- name: Publish runtime wheels
uses: pypa/gh-action-pypi-publish@release/v1
with:
packages-dir: dist/runtime/
# Public attestations reveal the private publisher repository. OIDC
# authentication remains enabled without uploading that provenance.
attestations: false
# Keep the SDK in a dependent job. If its upload fails after the immutable
# runtime files arrive, "re-run failed jobs" resumes here without attempting
# to overwrite the runtime release.
publish-sdk:
name: Publish SDK wheel to public PyPI
if: github.event_name == 'workflow_dispatch' && inputs.publish
needs: [validate, publish-runtime]
runs-on: ubuntu-latest
timeout-minutes: 10
environment: pypi
permissions:
contents: read
id-token: write
steps:
- uses: actions/download-artifact@v8
with:
name: python-release-${{ needs.validate.outputs.version }}
path: dist
- name: Select SDK wheel
run: |
mkdir -p dist/sdk
mv dist/deepseek_harness_sdk-*.whl dist/sdk/
- name: Publish SDK wheel
uses: pypa/gh-action-pypi-publish@release/v1
with:
packages-dir: dist/sdk/
attestations: false