From e34990315bbf6900886b8f4bd6282b4c299e5046 Mon Sep 17 00:00:00 2001 From: Jose Jimenez-Luna Date: Fri, 12 Jun 2026 00:27:55 -0700 Subject: [PATCH 1/4] hardening changes --- .github/workflows/conda.yml | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/.github/workflows/conda.yml b/.github/workflows/conda.yml index 8eabb3d..3f84b14 100644 --- a/.github/workflows/conda.yml +++ b/.github/workflows/conda.yml @@ -5,8 +5,13 @@ on: types: - published +permissions: + contents: read + jobs: linux: + if: ${{ contains(fromJSON(vars.RELEASE_WORKFLOW_ALLOWED_ACTORS || '[]'), github.actor) }} + environment: conda-release runs-on: "ubuntu-latest" defaults: run: @@ -20,7 +25,13 @@ jobs: condarc-file: conda-recipe/.condarc python-version: 3.9 auto-activate-base: false - - run: | + - name: Build and upload conda package + env: + ANACONDA_API_TOKEN: ${{ secrets.ANACONDA_API_TOKEN }} + run: | conda info conda install conda-build anaconda-client boa --yes - pkgs=$(boa build molskill/conda-recipe/ | grep 'TEST START' | sed 's/TEST START://g') && for pkg in ${pkgs};do anaconda -t ${{ secrets.CONDA_TOKEN }} upload -u msr-ai4science ${pkg}; done \ No newline at end of file + pkgs=$(boa build conda-recipe/ | grep 'TEST START' | sed 's/TEST START://g') + for pkg in ${pkgs}; do + anaconda -t "${ANACONDA_API_TOKEN}" upload -u msr-ai4science "${pkg}" + done \ No newline at end of file From 78a876533e67f78fb900811c453ca0a1dad150c6 Mon Sep 17 00:00:00 2001 From: Jose Jimenez-Luna Date: Fri, 12 Jun 2026 01:03:01 -0700 Subject: [PATCH 2/4] remove workflow allowed actors --- .github/workflows/conda.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/.github/workflows/conda.yml b/.github/workflows/conda.yml index 3f84b14..fe641b4 100644 --- a/.github/workflows/conda.yml +++ b/.github/workflows/conda.yml @@ -10,7 +10,6 @@ permissions: jobs: linux: - if: ${{ contains(fromJSON(vars.RELEASE_WORKFLOW_ALLOWED_ACTORS || '[]'), github.actor) }} environment: conda-release runs-on: "ubuntu-latest" defaults: From 0b07a919f18a9b3bacba0636217c005692ed04e4 Mon Sep 17 00:00:00 2001 From: Jose Jimenez-Luna Date: Fri, 12 Jun 2026 01:09:17 -0700 Subject: [PATCH 3/4] separate build and upload stages --- .github/workflows/conda.yml | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/.github/workflows/conda.yml b/.github/workflows/conda.yml index fe641b4..d16da07 100644 --- a/.github/workflows/conda.yml +++ b/.github/workflows/conda.yml @@ -24,13 +24,16 @@ jobs: condarc-file: conda-recipe/.condarc python-version: 3.9 auto-activate-base: false - - name: Build and upload conda package - env: - ANACONDA_API_TOKEN: ${{ secrets.ANACONDA_API_TOKEN }} + - name: Build conda package run: | conda info conda install conda-build anaconda-client boa --yes pkgs=$(boa build conda-recipe/ | grep 'TEST START' | sed 's/TEST START://g') - for pkg in ${pkgs}; do + echo "BUILT_CONDA_PACKAGES=${pkgs}" >> "$GITHUB_ENV" + - name: Publish to Anaconda + env: + ANACONDA_API_TOKEN: ${{ secrets.ANACONDA_API_TOKEN }} + run: | + for pkg in ${BUILT_CONDA_PACKAGES}; do anaconda -t "${ANACONDA_API_TOKEN}" upload -u msr-ai4science "${pkg}" done \ No newline at end of file From 039a48a8e9c3d5c5b9bd312f6ba2e4887b187e24 Mon Sep 17 00:00:00 2001 From: Jose Jimenez-Luna Date: Fri, 12 Jun 2026 01:14:43 -0700 Subject: [PATCH 4/4] hannes changes --- .github/workflows/conda.yml | 49 +++++++++++++++++++++++++++++++------ 1 file changed, 41 insertions(+), 8 deletions(-) diff --git a/.github/workflows/conda.yml b/.github/workflows/conda.yml index d16da07..d349238 100644 --- a/.github/workflows/conda.yml +++ b/.github/workflows/conda.yml @@ -9,31 +9,64 @@ permissions: contents: read jobs: - linux: - environment: conda-release - runs-on: "ubuntu-latest" + build-linux: + runs-on: ubuntu-latest defaults: run: shell: bash -l {0} steps: - - uses: actions/checkout@v2 - - uses: conda-incubator/setup-miniconda@v2 + - uses: actions/checkout@v4 + + - uses: conda-incubator/setup-miniconda@v3 with: activate-environment: molskill environment-file: environment.yml condarc-file: conda-recipe/.condarc python-version: 3.9 auto-activate-base: false + - name: Build conda package run: | conda info conda install conda-build anaconda-client boa --yes - pkgs=$(boa build conda-recipe/ | grep 'TEST START' | sed 's/TEST START://g') - echo "BUILT_CONDA_PACKAGES=${pkgs}" >> "$GITHUB_ENV" + boa build conda-recipe/ + + - name: Collect packages + run: | + mkdir -p dist-conda + find "$CONDA_PREFIX/../conda-bld" \ + \( -name '*.conda' -o -name '*.tar.bz2' \) \ + -type f \ + -print \ + -exec cp {} dist-conda/ \; + + - uses: actions/upload-artifact@v4 + with: + name: conda-packages-linux + path: dist-conda/* + + publish: + needs: build-linux + environment: conda-release + runs-on: ubuntu-latest + steps: + - uses: actions/download-artifact@v4 + with: + name: conda-packages-linux + path: dist-conda + + - uses: conda-incubator/setup-miniconda@v3 + with: + auto-activate-base: true + + - name: Install uploader + run: conda install anaconda-client --yes + - name: Publish to Anaconda env: ANACONDA_API_TOKEN: ${{ secrets.ANACONDA_API_TOKEN }} run: | - for pkg in ${BUILT_CONDA_PACKAGES}; do + shopt -s nullglob + for pkg in dist-conda/*.conda dist-conda/*.tar.bz2; do anaconda -t "${ANACONDA_API_TOKEN}" upload -u msr-ai4science "${pkg}" done \ No newline at end of file