Refactor GitHub workflows

.github/workflows/isobench.yml → .github/workflows/bench-iso.yml

@@ -8,7 +8,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v4
         with:
           # tags needed for dynamic versioning
           fetch-depth: 0
@@ -39,7 +39,7 @@ jobs:
         run: |
           poe bench-iso
       - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@v2
+        uses: codecov/codecov-action@v4
         with:
           files: ./coverage.xml
           flags: isobench

.github/workflows/lha_bot_rust.yml → .github/workflows/bench-lha-rust.yml

@@ -24,7 +24,7 @@ jobs:
       fail-fast: false
 
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v4
       - name: Set up Python ${{ matrix.python-version }} 🐍
         id: setup-python
         uses: actions/setup-python@v5

.github/workflows/lha_bot.yml → .github/workflows/bench-lha.yml

@@ -19,7 +19,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v4
         with:
           # tags needed for dynamic versioning
           fetch-depth: 0

.github/workflows/python-poetry-pypi-with-data.yml

@@ -24,15 +24,13 @@ on:
         required: false
         description: >
           Extras to be installed, in poetry format (e.g. "-E extra1 extra2")
-    secrets:
-      PYPI_TOKEN:
-        required: true
-        description: "Token used to deploy package on PyPI"
 
 jobs:
   publish:
     name: 📦 PyPI (🐍 ${{ inputs.python-version }})
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
 
     steps:
       - uses: actions/checkout@v4
@@ -89,5 +87,3 @@ jobs:
           poetry build
       - name: Publish distribution 📦 to PyPI
         uses: pypa/gh-action-pypi-publish@release/v1
-        with:
-          password: ${{ secrets.PYPI_TOKEN }}

.github/workflows/release-capi.yml

@@ -3,8 +3,15 @@ name: Deploy C-API
 on:
   push:
     tags:
-      - "*"
+      - 'v[0-9]*.[0-9]*.[0-9]*'
+      - 'v[0-9]*.[0-9]*.[0-9]*-*'
   workflow_dispatch:
+    inputs:
+      tag:
+        description: >-
+          Existing release tag to (re)publish. Use this to complete a release
+          whose tag-triggered run failed partway.
+        required: false
 
 permissions:
   contents: write
@@ -14,12 +21,22 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - name: Install tomlkit
-        if: startsWith(github.ref, 'refs/tags/')
-        run: pip install tomlkit
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ vars.PYTHON_VERSION_WORKFLOWS }}
+      - name: Install and configure Poetry
+        if: startsWith(github.ref, 'refs/tags/') || github.event.inputs.tag != ''
+        uses: snok/install-poetry@v1
+      - name: Install task runner
+        if: startsWith(github.ref, 'refs/tags/') || github.event.inputs.tag != ''
+        run: pip install poethepoet
       - name: Bump versions
-        if: startsWith(github.ref, 'refs/tags/')
-        run: python crates/bump-versions.py ${{ github.ref_name }}
+        if: startsWith(github.ref, 'refs/tags/') || github.event.inputs.tag != ''
+        env:
+          TAG: ${{ github.event.inputs.tag || github.ref_name }}
+        run: |
+          poetry install --only version
+          poe bump-version
       - name: Upload patched Cargo files
         uses: actions/upload-artifact@v4
         with:
@@ -41,7 +58,7 @@ jobs:
           - name: linux-aarch64
             runner: ubuntu-24.04-arm
           - name: macos-x86_64
-            runner: macos-13
+            runner: macos-latest
           - name: macos-aarch64
             runner: macos-14
     steps:
@@ -64,8 +81,10 @@ jobs:
         run: ./crates/ekore_capi/tests/run_tests.sh
       - name: Package dist
         id: package
+        env:
+          TAG: ${{ github.event.inputs.tag || github.ref_name }}
         run: |
-          archive="ekore_capi-${{ github.ref_name }}-${{ matrix.platform.name }}.tar.gz"
+          archive="ekore_capi-${TAG}-${{ matrix.platform.name }}.tar.gz"
           tar -C crates/ekore_capi/dist -czf "$archive" .
           echo "archive=$archive" >> "$GITHUB_OUTPUT"
       - name: Upload archive
@@ -78,7 +97,7 @@ jobs:
     name: Publish release
     runs-on: ubuntu-latest
     needs: [build]
-    if: startsWith(github.ref, 'refs/tags/')
+    if: startsWith(github.ref, 'refs/tags/') || github.event.inputs.tag != ''
     steps:
       - name: Download archives
         uses: actions/download-artifact@v4
@@ -92,6 +111,7 @@ jobs:
       - name: Publish to GitHub Releases
         uses: softprops/action-gh-release@v2
         with:
+          tag_name: ${{ github.event.inputs.tag || github.ref_name }}
           files: |
             dist-artifacts/*.tar.gz
             dist-artifacts/SHA256SUMS.txt

.github/workflows/crates.yml → .github/workflows/release-crates.yml

@@ -3,12 +3,20 @@ name: Deploy Crates
 on:
   push:
     tags:
-      - "*"
+      - 'v[0-9]*.[0-9]*.[0-9]*'
+      - 'v[0-9]*.[0-9]*.[0-9]*-*'
   workflow_dispatch:
+    inputs:
+      tag:
+        description: >-
+          Existing release tag to (re)publish. Use this to complete a release
+          whose tag-triggered run failed partway.
+        required: false
 
 jobs:
   deploy:
     runs-on: ubuntu-latest
+    if: startsWith(github.ref, 'refs/tags/') || github.event.inputs.tag != ''
 
     steps:
       - uses: actions/checkout@v4
@@ -18,6 +26,8 @@ jobs:
       - name: Install task runner
         run: pip install poethepoet
       - name: Bump versions
+        env:
+          TAG: ${{ github.event.inputs.tag || github.ref_name }}
         run: |
           poetry install --only version
           poe bump-version

.github/workflows/maturin.yml → .github/workflows/release-ekors.yml

@@ -3,23 +3,41 @@ name: Deploy Maturin wheels
 on:
   push:
     tags:
-      - "*"
+      - 'v[0-9]*.[0-9]*.[0-9]*'
+      - 'v[0-9]*.[0-9]*.[0-9]*-*'
   workflow_dispatch:
+    inputs:
+      tag:
+        description: >-
+          Existing release tag to (re)publish. Use this to complete a release
+          whose tag-triggered run failed partway.
+        required: false
 
 permissions:
   contents: read
+  id-token: write
 
 jobs:
   set-version:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - name: Install tomlkit
-        if: startsWith(github.ref, 'refs/tags/')
-        run: pip install tomlkit
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ vars.PYTHON_VERSION_WORKFLOWS }}
+      - name: Install and configure Poetry
+        if: startsWith(github.ref, 'refs/tags/') || github.event.inputs.tag != ''
+        uses: snok/install-poetry@v1
+      - name: Install task runner
+        if: startsWith(github.ref, 'refs/tags/') || github.event.inputs.tag != ''
+        run: pip install poethepoet
       - name: Bump versions
-        if: startsWith(github.ref, 'refs/tags/')
-        run: python crates/bump-versions.py ${{ github.ref_name }}
+        if: startsWith(github.ref, 'refs/tags/') || github.event.inputs.tag != ''
+        env:
+          TAG: ${{ github.event.inputs.tag || github.ref_name }}
+        run: |
+          poetry install --only version
+          poe bump-version
       - name: Upload patched Cargo files
         uses: actions/upload-artifact@v4
         with:
@@ -157,7 +175,7 @@ jobs:
   release:
     name: Release
     runs-on: ubuntu-latest
-    if: "startsWith(github.ref, 'refs/tags/')"
+    if: startsWith(github.ref, 'refs/tags/') || github.event.inputs.tag != ''
     needs: [linux, windows, macos, sdist]
     steps:
       - uses: actions/download-artifact@v4
@@ -168,5 +186,4 @@ jobs:
       - name: Publish to PyPI
         uses: pypa/gh-action-pypi-publish@release/v1
         with:
-          password: ${{ secrets.PYPI_TOKEN }}
           skip-existing: true

.github/workflows/release-pyapi.yml

@@ -3,11 +3,19 @@ name: Deploy Maturin wheels
 on:
   push:
     tags:
-      - "*"
+      - 'v[0-9]*.[0-9]*.[0-9]*'
+      - 'v[0-9]*.[0-9]*.[0-9]*-*'
   workflow_dispatch:
+    inputs:
+      tag:
+        description: >-
+          Existing release tag to (re)publish. Use this to complete a release
+          whose tag-triggered run failed partway.
+        required: false
 
 permissions:
   contents: read
+  id-token: write
 
 jobs:
   set-version:
@@ -17,10 +25,19 @@ jobs:
       - uses: actions/setup-python@v5
         with:
           python-version: ${{ vars.PYTHON_VERSION_WORKFLOWS }}
-      - name: Install tomlkit
-        run: pip install tomlkit
+      - name: Install and configure Poetry
+        if: startsWith(github.ref, 'refs/tags/') || github.event.inputs.tag != ''
+        uses: snok/install-poetry@v1
+      - name: Install task runner
+        if: startsWith(github.ref, 'refs/tags/') || github.event.inputs.tag != ''
+        run: pip install poethepoet
       - name: Bump versions
-        run: python crates/bump-versions.py ${{ github.ref_name }}
+        if: startsWith(github.ref, 'refs/tags/') || github.event.inputs.tag != ''
+        env:
+          TAG: ${{ github.event.inputs.tag || github.ref_name }}
+        run: |
+          poetry install --only version
+          poe bump-version
       - name: Upload patched Cargo files
         uses: actions/upload-artifact@v4
         with:
@@ -164,7 +181,7 @@ jobs:
   release:
     name: Release
     runs-on: ubuntu-latest
-    if: "startsWith(github.ref, 'refs/tags/')"
+    if: startsWith(github.ref, 'refs/tags/') || github.event.inputs.tag != ''
     needs: [linux, windows, macos, sdist]
     steps:
       - uses: actions/download-artifact@v4
@@ -175,5 +192,4 @@ jobs:
       - name: Publish to PyPI
         uses: pypa/gh-action-pypi-publish@release/v1
         with:
-          password: ${{ secrets.PYPI_TOKEN }}
           skip-existing: true

.github/workflows/release-python.yml

@@ -0,0 +1,27 @@
+name: deploy
+
+on:
+  push:
+    tags:
+      - 'v[0-9]*.[0-9]*.[0-9]*'
+      - 'v[0-9]*.[0-9]*.[0-9]*-*'
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: >-
+          Existing release tag to (re)publish. Use this to complete a release
+          whose tag-triggered run failed partway.
+        required: false
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  publish:
+    if: startsWith(github.ref, 'refs/tags/') || github.event.inputs.tag != ''
+    uses: ./.github/workflows/python-poetry-pypi-with-data.yml
+    with:
+      poetry-extras: "-E mark -E box"
+      data-version: "v2"
+      data-download: "./tests/data/assets.sh"

Cargo.toml

@@ -19,12 +19,12 @@ keywords = ["physics"]
 license = "GPL-3.0-or-later"
 repository = "https://github.com/NNPDF/eko"
 rust-version = "1.85.0"
-version = "0.0.1"
+version = "0.0.0"
 
 # all dependencies should be collected here in the workspace
 [workspace.dependencies]
 # Internal crates
-ekore = { path = "crates/ekore", version = "0.0.1" }
+ekore = { path = "crates/ekore", version = "0.0.0" }
 
 # External dependencies
 lz4_flex = "0.11.6"

README.md

@@ -2,7 +2,7 @@
   <a href="https://eko.readthedocs.io/"><img alt="EKO" src="https://raw.githubusercontent.com/N3PDF/eko/master/doc/source/img/Logo.png" width=300></a>
 </p>
 <p align="center">
-  <a href="https://github.com/N3PDF/eko/actions/workflows/unittests.yml"><img alt="Tests" src="https://github.com/N3PDF/eko/actions/workflows/unittests.yml/badge.svg" /></a>
+  <a href="https://github.com/N3PDF/eko/actions/workflows/unittests-python.yml"><img alt="Tests" src="https://github.com/N3PDF/eko/actions/workflows/unittests-python.yml/badge.svg" /></a>
   <a href="https://github.com/N3PDF/eko/actions/workflows/unittests-rust.yml"><img alt="Rust tests" src="https://github.com/N3PDF/eko/actions/workflows/unittests-rust.yml/badge.svg" /></a>
   <a href="https://eko.readthedocs.io/en/latest/?badge=latest"><img alt="Docs" src="https://readthedocs.org/projects/eko/badge/?version=latest"></a>
   <a href="https://codecov.io/gh/NNPDF/eko"><img src="https://codecov.io/gh/NNPDF/eko/branch/master/graph/badge.svg" /></a>

extras/architecture.md

@@ -358,7 +358,7 @@ files = ["src/eko/version.py", "src/ekomark/version.py", "src/ekobox/version.py"
 The Rust workspace version and internal cross-dependencies in `Cargo.toml` are bumped using:
 
 ```bash
-poe bump-version   # runs: python crates/bump-versions.py $(git describe --tags)
+poe bump-version   # runs: python crates/bump-versions.py ${TAG:-$(git describe --tags)}
 ```
 
 `bump-versions.py` updates `workspace.package.version` and internal dependency versions, stripping the leading `v` from the git tag.
@@ -367,5 +367,5 @@ poe bump-version   # runs: python crates/bump-versions.py $(git describe --tags)
 
 Cargo requires concrete versions in `Cargo.toml`. To avoid manual version bump commits in git, CI dynamically patches `Cargo.toml` on tag push:
 
-- **`crates.yml`**: Runs `poe bump-version` and publishes using `cargo publish --allow-dirty`.
-- **`maturin.yml` & `release-capi.yml`**: A `set-version` job patches `Cargo.toml` and uploads it as an artifact (`patched-cargo`), which matrix build jobs download before compiling.
+- **`release-crates.yml`**: Runs `poe bump-version` and publishes using `cargo publish --allow-dirty`.
+- **`release-ekors.yml`, `release-capi.yml` & `release-pyapi.yml`**: A `set-version` job patches `Cargo.toml` and uploads it as an artifact (`patched-cargo`), which matrix build jobs download before compiling.

pyproject.toml

@@ -144,7 +144,7 @@ docs-server = { "shell" = "cd doc; make server" }
 docs-clean = { "shell" = "cd doc; make clean" }
 docs-cleanall = { "shell" = "cd doc; make cleanall" }
 docs-install-nb = { "shell" = "python -m ipykernel install --user --name=$(basename $(poetry env info -p))" }
-bump-version = { "shell" = "python crates/bump-versions.py $(git describe --tags)" }
+bump-version = { "shell" = "python crates/bump-versions.py ${TAG:-$(git describe --tags)}" }
 compile = "maturin develop --release --manifest-path crates/eko/Cargo.toml"
 rdocs.cmd = "cargo doc --workspace --no-deps"
 rdocs.env = { RUSTDOCFLAGS = "--html-in-header crates/doc-header.html" }