mirror of
https://github.com/linkedin/Liger-Kernel.git
synced 2026-10-12 02:17:47 +00:00
3899871085
## Summary - publish `liger-cute-kernels` with dedicated `PYPI_LCK_USERNAME` and `PYPI_LCK_PASSWORD` repository secrets - add an explicit `workflow_dispatch` `publish` input, defaulting to `false` - allow a manual publish retry after credentials are configured, while preserving non-publishing nightly and default manual builds - validate that both credentials exist before invoking Twine - run Twine in verbose mode so future PyPI authorization errors include the server response ## Background The v0.8.3 release built and packaged the dual-architecture wheel successfully, but public PyPI upload failed with HTTP 403. The existing credentials can publish `liger-kernel` but are not authorized for the separate `liger-cute-kernels` project. Failed release run: https://github.com/linkedin/Liger-Kernel/actions/runs/35137571890 ## Required repository configuration Create and verify the separate PyPI account, enable 2FA, and create an **entire-account API token** for its first project upload. Add these secrets to the main repository: ```text PYPI_LCK_USERNAME=__token__ PYPI_LCK_PASSWORD=pypi-... ``` Do not include either value in source, PR comments, or workflow inputs. After the first upload creates `liger-cute-kernels`, `PYPI_LCK_PASSWORD` can be replaced with a project-scoped token from that account while retaining the same username secret. ## Publishing 0.8.3 after merge Run **Build and Publish Liger Cute Kernels** manually on `main` with `publish=true`. The workflow rebuilds and validates both architecture cores before the dedicated publish job runs. ## Validation - workflow YAML parses successfully - manual `publish` input is boolean and defaults to `false` - release events still publish automatically - main pushes and default manual dispatches still skip publication - both dedicated credentials are checked before upload --------- Co-authored-by: jkolehma <[email protected]> Co-authored-by: Copilot <[email protected]>