From e0ffc7ee0b34bc31728d93285c105dab886473b3 Mon Sep 17 00:00:00 2001 From: alonsopf89 Date: Mon, 2 Nov 2026 03:51:42 +0000 Subject: [PATCH 1/5] ci(release): migrate PyPI publishing to OSS Exit Gate --- .github/workflows/nightly.yml | 30 ++++++++++++++++++++++-------- 1 file changed, 22 insertions(+), 8 deletions(-) diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml index 045c380..585c9ff 100644 --- a/.github/workflows/nightly.yml +++ b/.github/workflows/nightly.yml @@ -35,11 +35,25 @@ jobs: grep "__version__" torchax/__init__.py - name: Build Wheel and Sdist - run: python -m build --wheel - - - name: Publish to PyPI - uses: pypa/gh-action-pypi-publish@release/v1 - # Note: We are NOT providing a password here because we will use Trusted Publishing. - # If you must use a token, uncomment the lines below: - # with: - # password: ${{ secrets.PYPI_API_TOKEN }} + run: | + pip install twine + python -m build --wheel + + - name: Authenticate to Google Cloud (OSS Exit Gate) + uses: google-github-actions/auth@c200f3691d83b41bf9bbd8638997a462592937ed + with: + workload_identity_provider: 'projects/305452601764/locations/global/workloadIdentityPools/builders/providers/github' + + - name: Set up Cloud SDK + uses: google-github-actions/setup-gcloud@e427ad8a34f8676edf47cf7d7925499adf3eb74f + + - name: Stage to OSS Exit Gate and upload manifest + run: | + python -m twine upload \ + --repository-url "https://us-python.pkg.dev/oss-exit-gate-prod/torchax--pypi/" \ + -u oauth2accesstoken \ + -p "$(gcloud auth print-access-token)" \ + dist/* + echo '{"publish_all": true}' > manifest.json + gcloud storage cp manifest.json \ + "gs://oss-exit-gate-prod-projects-bucket/torchax/pypi/manifests/manifest-${{ github.run_id }}-${{ github.run_attempt }}.json" From 619c9ee16823af79993f6eb356a1fce2d7630260 Mon Sep 17 00:00:00 2001 From: Fernando Alonso Pecina Date: Mon, 2 Nov 2026 17:09:50 +0000 Subject: [PATCH 2/5] ci(release): pin GitHub Actions SHAs and scope permissions for zizmor --- .github/workflows/nightly.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml index 585c9ff..3e09d5c 100644 --- a/.github/workflows/nightly.yml +++ b/.github/workflows/nightly.yml @@ -17,10 +17,10 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v6 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - name: Set up Python - uses: actions/setup-python@v6 + uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 with: python-version: '3.11' From 1c90845ffe803e0509df499d172f83a32026aa14 Mon Sep 17 00:00:00 2001 From: alonsopf89 Date: Wed, 4 Nov 2026 11:34:10 -0800 Subject: [PATCH 3/5] ci: clean up stale releases from staging repo before publishing --- .github/workflows/nightly.yml | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml index 3e09d5c..945e61c 100644 --- a/.github/workflows/nightly.yml +++ b/.github/workflows/nightly.yml @@ -47,6 +47,25 @@ jobs: - name: Set up Cloud SDK uses: google-github-actions/setup-gcloud@e427ad8a34f8676edf47cf7d7925499adf3eb74f + - name: Clean up stale releases from staging repo + run: | + # clean up stale releases from staging repo + packages=$(gcloud artifacts packages list \ + --project="oss-exit-gate-prod" \ + --location="us" \ + --repository="torchax--pypi" \ + --format="value(name)" 2>/dev/null) + + echo "${packages}" | xargs -r -I {} sh -c ' + package_name=$(basename "{}") + echo "Deleting package: $package_name..." + gcloud artifacts packages delete "{}" \ + --project="\'"oss-exit-gate-prod"\'" \ + --location="\'"us"\'" \ + --repository="\'torchax--pypi\'" \ + --quiet + ' + - name: Stage to OSS Exit Gate and upload manifest run: | python -m twine upload \ From 3710402d60798c207b5b0b604007722ae4a0a154 Mon Sep 17 00:00:00 2001 From: alonsopf89 Date: Wed, 4 Nov 2026 21:40:02 +0000 Subject: [PATCH 4/5] ci(release): fix quote syntax in stale release cleanup step --- .github/workflows/nightly.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml index 945e61c..3b5831a 100644 --- a/.github/workflows/nightly.yml +++ b/.github/workflows/nightly.yml @@ -60,9 +60,9 @@ jobs: package_name=$(basename "{}") echo "Deleting package: $package_name..." gcloud artifacts packages delete "{}" \ - --project="\'"oss-exit-gate-prod"\'" \ - --location="\'"us"\'" \ - --repository="\'torchax--pypi\'" \ + --project=""oss-exit-gate-prod"" \ + --location=""us"" \ + --repository="torchax--pypi" \ --quiet ' From 0c8f40aaa7d5b1f88c867cc6dfbce3c79dbc7496 Mon Sep 17 00:00:00 2001 From: alonsopf89 Date: Wed, 4 Nov 2026 19:57:10 -0800 Subject: [PATCH 5/5] ci: fix quote syntax in staging repo cleanup step --- .github/workflows/nightly.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml index 3b5831a..f78cae4 100644 --- a/.github/workflows/nightly.yml +++ b/.github/workflows/nightly.yml @@ -60,8 +60,8 @@ jobs: package_name=$(basename "{}") echo "Deleting package: $package_name..." gcloud artifacts packages delete "{}" \ - --project=""oss-exit-gate-prod"" \ - --location=""us"" \ + --project="oss-exit-gate-prod" \ + --location="us" \ --repository="torchax--pypi" \ --quiet '