Repository navigation
ci: aarch64 Linux wheels, protoc without Chocolatey, pinned actions and zizmor - #139
Merged
Merged
Conversation
Chocolatey's community feed was unreachable from the runner during the v0.8.1 release run, so build-windows failed before it started compiling. Download protoc 29.3 from the protobuf release instead and check it against a pinned SHA-256.
Deploying lance-csr with
|
| Latest commit: |
86386bb
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://87510e13.lance-csr.pages.dev |
| Branch Preview URL: | https://ci-windows-protoc.lance-csr.pages.dev |
- Build a manylinux_2_28 aarch64 wheel natively on ubuntu-24.04-arm and test it on Python 3.12 to 3.14, like the other wheels. pylance has aarch64 wheels, so it installs without compiling. No musl wheels: pylance publishes none, so they would still compile Lance. - Pin every action to a commit SHA with its exact version, and let Dependabot update the pins weekly with a 7-day cooldown. - Add a Workflow Audit job that runs zizmor, and fix what it found: pass the release tag through an env var instead of expanding it in the script, stop persisting checkout credentials, give every workflow read-only contents permission, and restore no caches (sccache, uv) in the wheel builds.
prrao87
changed the title
Explain what a CSR is, where it comes from and which graph databases use it, before the README relies on the term. Rename "Much wider Cypher" to "Broader openCypher support". Say that Windows installs the native wheel and doesn't need WSL2.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The v0.8.1 release run failed in
build-windowsafter 22 seconds, before compiling anything.choco install protoc --version=29.3couldn't reach Chocolatey's community feed (Unable to connect to source 'https://community.chocolatey.org/api/v2/'). The package itself is still there, and the same step passed on #127's runs. So the release depended on a third-party feed that fails now and then.While here, this PR adds the build items from #126 that make sense without Nix: Linux aarch64 wheels, actions pinned to commit SHAs, and a zizmor audit in CI.
What changed
protoc on Windows
protoc-29.3-win64.zipfrom the protobuf v29.3 release, checks it against a pinned SHA-256, and adds it toPATH. It's the same version and the same zip Chocolatey unpacked. The release publishes no checksum for this file, so the pinned hash comes from a download on 2026-11-07.Linux aarch64 wheel
build-linuxbecomes an x86-64/aarch64 matrix. The aarch64 wheel (manylinux_2_28) builds natively onubuntu-24.04-armwith the same zig command, andtestruns it on Python 3.12, 3.13 and 3.14 like the other wheels. It uses the default ARMv8 target features, the same as pylance's aarch64 wheels.uv add lance-csron ARM Linux, including Docker on Apple Silicon and Windows-on-ARM WSL2, won't compile anything.Pinned actions and zizmor
v1, but its pinned commit isv1.50.1..github/dependabot.ymlupdates the pins in one grouped PR a week, and only for releases at least 7 days old.zizmor@1.32.0(online audits included) on changes to.github/. These are the fixes for what it found:${{ github.event.release.tag_name }}straight into the shell script (template injection). It now goes through an env var.persist-credentials: false. No workflow pushes with git.permissions: contents: readat the top level. The publish jobs keep their ownid-token: write.python-publish.yml, so nothing a PR run left in the cache can end up in a release wheel. The Windows build already ran without sccache and is the slowest job by about 17 minutes, so this shouldn't make a release take longer. The Linux and macOS jobs on PR dry runs will be slower.Docs
docs/getting-started.mdanddocs/index.mdlist Linux aarch64.docs/index.mdalso gains Windows, which Build and test Windows x86-64 wheels #127 missed.RELEASE.mddescribes the Linux build matrix and why the builds use no caches. The aarch64 build time is still marked TBD and gets filled in from this PR's run.AGENTS.mdasks for SHA pins and a local zizmor run when editing workflows.Validation
uvx zizmor@1.32.0 .github, online: no findings (17 suppressed by its default persona).uvx typos@1.26.0 .anduv run --project docs --locked zensical build --strict: pass.python-publish.yml, so its dry run builds and tests all four wheels, including the new aarch64 one and the Windows protoc step. Pending.🤖 Generated with Claude Code