This is an automated email from the ASF dual-hosted git repository.
tqchen pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tvm-ffi.git
The following commit(s) were added to refs/heads/main by this push:
new 2c55d9fb [CI] Update PyPI publishing action to ASF-approved v1.14.3
(#875)
2c55d9fb is described below
commit 2c55d9fb97c1c25382b7379b3677ef4e01634bf7
Author: Yaxing Cai <[email protected]>
AuthorDate: Sun Oct 25 21:30:43 2026 +0800
[CI] Update PyPI publishing action to ASF-approved v1.14.3 (#875)
The v0.1.15-post1 publish run [failed before starting any
jobs](https://github.com/apache/tvm-ffi/actions/runs/40177792078)
because ASF removed the pinned PyPI publishing action v1.13.0 from its
allowlist on October 25.
Update the three PyPI publishing workflows to v1.14.3
(`7245906fb61fa33a13554f9d5fb856fe61758086`), which is present in the
[current ASF
allowlist](https://github.com/apache/infrastructure-actions/blob/main/approved_patterns.yml).
OIDC publishing and attestations remain enabled.
Validation: all applicable repository pre-commit hooks passed for the
three changed workflows; `git diff --check` passed; verified the pin
against the signed upstream v1.14.3 tag.
After merging, dispatch `publish_wheel.yml` from `main` with
`tag=v0.1.15-post1` so the corrected workflow builds the existing
release tag.
AI assistance: this change was prepared and validated with OpenAI Codex.
---
.github/workflows/publish_orcjit_wheel.yml | 2 +-
.github/workflows/publish_wheel.yml | 2 +-
.github/workflows/torch_c_dlpack.yml | 2 +-
3 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/.github/workflows/publish_orcjit_wheel.yml
b/.github/workflows/publish_orcjit_wheel.yml
index af5a4b49..4d33d7f1 100644
--- a/.github/workflows/publish_orcjit_wheel.yml
+++ b/.github/workflows/publish_orcjit_wheel.yml
@@ -77,7 +77,7 @@ jobs:
subject-path: dist/*
- name: Publish package distributions to PyPI
- uses:
pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0
+ uses:
pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.3
with:
attestations: true
verbose: true
diff --git a/.github/workflows/publish_wheel.yml
b/.github/workflows/publish_wheel.yml
index 8b2085d3..50ba0c1d 100644
--- a/.github/workflows/publish_wheel.yml
+++ b/.github/workflows/publish_wheel.yml
@@ -85,7 +85,7 @@ jobs:
subject-path: dist/*
- name: Publish package distributions to PyPI
- uses:
pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0
+ uses:
pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.3
with:
attestations: true
verbose: true
diff --git a/.github/workflows/torch_c_dlpack.yml
b/.github/workflows/torch_c_dlpack.yml
index f9fb8413..c48687a8 100644
--- a/.github/workflows/torch_c_dlpack.yml
+++ b/.github/workflows/torch_c_dlpack.yml
@@ -157,7 +157,7 @@ jobs:
with:
subject-path: dist/*
- name: Publish package distributions to PyPI
- uses:
pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0
+ uses:
pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.3
with:
attestations: true
verbose: true
