From a81de2a3f8a9979499d7288a359302f028caccf1 Mon Sep 17 00:00:00 2001 From: bruno <97033386+bruno-at-orange@users.noreply.github.com> Date: Mon, 29 Jun 2026 16:55:49 +0200 Subject: [PATCH 1/3] Sign the binary for windows --- .github/workflows/pack-pip.yaml | 56 ++++++++++++++++++++++++++++++++- 1 file changed, 55 insertions(+), 1 deletion(-) diff --git a/.github/workflows/pack-pip.yaml b/.github/workflows/pack-pip.yaml index 08cb257..c2392c0 100644 --- a/.github/workflows/pack-pip.yaml +++ b/.github/workflows/pack-pip.yaml @@ -8,6 +8,11 @@ on: type: choice default: None # no publishing to any Package Index by default options: [None, testpypi, pypi] + signature-activation: + type: boolean + required: true + default: false + description: Sign khisto binary push: tags: ['*'] pull_request: @@ -23,6 +28,8 @@ concurrency: defaults: run: shell: bash +env: + KEYPAIR: KP_Khiops_HSM jobs: build-wheel: @@ -31,6 +38,8 @@ jobs: strategy: matrix: os: [ubuntu-24.04, ubuntu-24.04-arm, windows-2025-vs2026, windows-11-vs2026-arm, macos-15-intel, macos-15] + env: + SIGN_WINDOWS_WHEELS: ${{ github.event_name == 'workflow_dispatch' && inputs.signature-activation }} steps: - uses: actions/checkout@v6 @@ -59,7 +68,52 @@ jobs: uv sync --python .test-env --group dev --no-install-project uv run --python .test-env pytest tests/ --no-cov - - uses: actions/upload-artifact@v6 + # Non-Windows wheels uploaded directly (no signing) + - uses: actions/upload-artifact@v7 + if: runner.os != 'Windows' + with: + name: pkg-wheel-${{ matrix.os }} + path: wheelhouse/*.whl + if-no-files-found: error + + # Windows wheels are unpackad, signed and repacked before uploading + - name: Set SIGN_X64_WHEEL flag + if: runner.os == 'Windows' && runner.arch == 'X64' + run: echo "SIGN_X64_WHEEL=${{ env.SIGN_WINDOWS_WHEELS }}" >> "$GITHUB_ENV" + - name: Warn smctl does not support ARM64 yet + if: runner.os == 'Windows' && runner.arch == 'ARM64' && env.SIGN_WINDOWS_WHEELS == 'true' + run: echo "::warning::smctl does not support ARM64 yet; the ARM64 wheel will not be signed" + - name: Install wheel package for signing + if: env.SIGN_X64_WHEEL == 'true' + run: python -m pip install wheel + - name: Unpack khisto wheel + if: env.SIGN_X64_WHEEL == 'true' + run: | + mkdir -p wheelhouse/unpacked + python -m wheel unpack wheelhouse/khisto-*.whl --dest wheelhouse/unpacked + - name: Setup SM_CLIENT_CERT_FILE from base64 secret data + if: env.SIGN_X64_WHEEL == 'true' + run: | + echo "SM_CLIENT_CERT_FILE=D:\\Certificate_pkcs12.p12" >> "$GITHUB_ENV" + echo "${{ secrets.SM_CLIENT_CERT_FILE_B64 }}" | base64 --decode > /d/Certificate_pkcs12.p12 + - name: Sign unpacked wheel binaries + if: env.SIGN_X64_WHEEL == 'true' + uses: digicert/code-signing-software-trust-action@v1.2.1 + with: + input: wheelhouse/unpacked/ + keypair-alias: ${{ env.KEYPAIR }} + simple-signing-mode: true + env: + SM_HOST: ${{ secrets.SM_HOST }} + SM_API_KEY: ${{ secrets.SM_API_KEY }} + SM_CLIENT_CERT_PASSWORD: ${{ secrets.SM_CLIENT_CERT_PASSWORD }} + - name: Repack signed wheels + if: env.SIGN_X64_WHEEL == 'true' + run: | + rm wheelhouse/khisto-*.whl + python -m wheel pack wheelhouse/unpacked/khisto-* --dest-dir wheelhouse + - uses: actions/upload-artifact@v7 + if: runner.os == 'Windows' with: name: pkg-wheel-${{ matrix.os }} path: wheelhouse/*.whl From 753249dc7b13a7da34e87a89d5ab2f7d437b9b2e Mon Sep 17 00:00:00 2001 From: bruno <97033386+bruno-at-orange@users.noreply.github.com> Date: Mon, 29 Jun 2026 17:26:01 +0200 Subject: [PATCH 2/3] fix potential issues - Fix PR paths trigger: pack-pip.yml -> pack-pip.yaml - Add python-version: '3.13' to setup-python step - Move Set up Python and Set up UV before Build wheels - Fix download-artifact v6 --- .github/workflows/pack-pip.yaml | 28 +++++++++++++++------------- 1 file changed, 15 insertions(+), 13 deletions(-) diff --git a/.github/workflows/pack-pip.yaml b/.github/workflows/pack-pip.yaml index c2392c0..0c1c774 100644 --- a/.github/workflows/pack-pip.yaml +++ b/.github/workflows/pack-pip.yaml @@ -17,7 +17,7 @@ on: tags: ['*'] pull_request: paths: - - .github/workflows/pack-pip.yml + - .github/workflows/pack-pip.yaml - pyproject.toml - CMakeLists.txt @@ -42,25 +42,27 @@ jobs: SIGN_WINDOWS_WHEELS: ${{ github.event_name == 'workflow_dispatch' && inputs.signature-activation }} steps: - uses: actions/checkout@v6 - - - name: Load Visual C++ Environment Variables (Windows) - if: runner.os == 'Windows' - shell: cmd - run: | - call "C:\\Program Files\\Microsoft Visual Studio\\18\\Enterprise\\VC\\Auxiliary\\Build\\vcvars64.bat" - set >> %GITHUB_ENV% - - - name: Build wheels - uses: pypa/cibuildwheel@v3.3.1 - name: Set up Python uses: actions/setup-python@v5 + with: + python-version: '3.13' - name: Set up UV uses: astral-sh/setup-uv@v6 with: enable-cache: true + - name: Load Visual C++ Environment Variables (Windows) + if: runner.os == 'Windows' + shell: cmd + run: | + call "C:\\Program Files\\Microsoft Visual Studio\\18\\Enterprise\\VC\\Auxiliary\\Build\\vcvars64.bat" + set >> %GITHUB_ENV% + + - name: Build wheels + uses: pypa/cibuildwheel@v3.3.1 + - name: Test built wheel run: | uv venv .test-env @@ -130,7 +132,7 @@ jobs: environment: name: testpypi steps: - - uses: actions/download-artifact@v6 + - uses: actions/download-artifact@v7 with: pattern: pkg-* path: dist @@ -151,7 +153,7 @@ jobs: environment: name: pypi steps: - - uses: actions/download-artifact@v6 + - uses: actions/download-artifact@v7 with: pattern: pkg-* path: dist From 3c552a793e44007af234fc5e276314544c55e90c Mon Sep 17 00:00:00 2001 From: bruno <97033386+bruno-at-orange@users.noreply.github.com> Date: Tue, 7 Jul 2026 09:43:03 +0200 Subject: [PATCH 3/3] adter review --- .github/workflows/pack-pip.yaml | 10 ---------- 1 file changed, 10 deletions(-) diff --git a/.github/workflows/pack-pip.yaml b/.github/workflows/pack-pip.yaml index 0c1c774..d5ab46b 100644 --- a/.github/workflows/pack-pip.yaml +++ b/.github/workflows/pack-pip.yaml @@ -10,7 +10,6 @@ on: options: [None, testpypi, pypi] signature-activation: type: boolean - required: true default: false description: Sign khisto binary push: @@ -70,14 +69,6 @@ jobs: uv sync --python .test-env --group dev --no-install-project uv run --python .test-env pytest tests/ --no-cov - # Non-Windows wheels uploaded directly (no signing) - - uses: actions/upload-artifact@v7 - if: runner.os != 'Windows' - with: - name: pkg-wheel-${{ matrix.os }} - path: wheelhouse/*.whl - if-no-files-found: error - # Windows wheels are unpackad, signed and repacked before uploading - name: Set SIGN_X64_WHEEL flag if: runner.os == 'Windows' && runner.arch == 'X64' @@ -115,7 +106,6 @@ jobs: rm wheelhouse/khisto-*.whl python -m wheel pack wheelhouse/unpacked/khisto-* --dest-dir wheelhouse - uses: actions/upload-artifact@v7 - if: runner.os == 'Windows' with: name: pkg-wheel-${{ matrix.os }} path: wheelhouse/*.whl