workflows/release-lit: Update workflow and enable trusted publishing with pypi (#174907)

tstellar · web-flow · commit bc3066bb2232 · 2026-01-19T17:11:17.000-08:00
This makes some small improvements to the workflow including using some
more modern python packaging modules and also enables the trusted
publishing for pypi. This will allow us to publish lit packages to pypi
without needing to use an access token.

This action also now uses the pypi environment which will only publish
files when triggered by an llvm-* tag.
diff --git a/.github/workflows/release-tasks.yml b/.github/workflows/release-tasks.yml
@@ -73,6 +73,63 @@ jobs:
     secrets:
       RELEASE_TASKS_USER_TOKEN: ${{ secrets.RELEASE_TASKS_USER_TOKEN }}
 
+  # The pypi trusted publishing does not support called workflows, so we
+  # can't use them here.
+  release-lit:
+    name: Release Lit
+    runs-on: ubuntu-24.04
+    permissions:
+      id-token: write # Requred for pypi publishing
+    environment: pypi
+    steps:
+      - name: Checkout LLVM
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          ref: "llvmorg-${{ needs.validate-tag.outputs.release-version }}"
+
+      - name: Install dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y python3-build python3-psutil python3-github
+
+      - name: Check Permissions
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+          USER_TOKEN: ${{ secrets.RELEASE_TASKS_USER_TOKEN }}
+        run: |
+          ./llvm/utils/release/./github-upload-release.py --token "$GITHUB_TOKEN" --user ${{ github.actor }} --user-token "$USER_TOKEN" check-permissions
+
+      - name: Test lit
+        run: |
+          mkdir build && cd build
+          export FILECHECK_OPTS='-dump-input-filter=all -vv -color'
+          cmake ../llvm -DCMAKE_BUILD_TYPE=Release -G Ninja
+          ninja -v -j $(nproc) check-lit
+
+      - name: Package lit
+        run: |
+          cd llvm/utils/lit
+          # Remove 'dev' suffix from lit version.
+          sed -i 's/ + "dev"//g' lit/__init__.py
+          python3 -m build
+
+      - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        with:
+          name: lit-${{ inputs.release-version }}-release-binary
+          path: |
+            llvm/utils/lit/dist
+
+      - name: Upload lit to test.pypi.org
+        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0
+        with:
+          repository-url: https://test.pypi.org/legacy/
+          packages-dir: llvm/utils/lit/dist/
+
+      - name: Upload lit to pypi.org
+        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0
+        with:
+          packages-dir: llvm/utils/lit/dist/
+
   release-binaries:
     name: Build Release Binaries
     permissions:
