[python] PR-13: Add Nightly PyPI Publish Workflow

[FindHao]

Summary

Add GitHub Actions workflow for automated nightly PyPI publishing of the cutracer Python package.

Changes

New Files

• .github/workflows/nightly-pypi.yml (82 lines)

Features

1. Scheduled Nightly Builds: Daily at 07:18 UTC
2. Tag-based Releases: Publish on v* or *.*.* tags
3. Trusted Publishing: Uses OIDC for secure PyPI uploads (no API tokens)
4. Smart Commit Detection: Only publishes when there are new commits in python/ directory
5. Script Reuse: Downloads check_new_commits.sh from tritonparse repo instead of maintaining local copy

Key Design Decisions

Using tritonparse's check_new_commits.sh

Instead of maintaining a local copy of the commit check script, this workflow downloads it directly from tritonparse:

env:
  PACKAGE_NAME: cutracer
  PACKAGE_PATH: python/
run: |
  curl -fsSL https://github.com/meta-pytorch/tritonparse/raw/refs/heads/main/.github/scripts/check_new_commits.sh | bash

Benefits:

• No duplicate code to maintain
• Automatic updates when tritonparse improves the script
• Consistent behavior across projects

Subdirectory Support

CUTracer's Python package is in python/ subdirectory, so:

• Build commands use cd python before python -m build
• packages-dir: python/dist/ for PyPI publish action
• PACKAGE_PATH: python/ to filter commits

Test Plan

1. Workflow syntax validated by GitHub Actions
2. Manual trigger via workflow_dispatch for testing (won't publish)
3. Full publish flow tested via git tag push

Dependencies

• Requires tritonparse PR (PACKAGE_PATH support) to be merged first
• PyPI Trusted Publishing must be configured for cutracer package

[meta-codesync]

@FindHao has imported this pull request. If you are a Meta employee, you can view this in D89495224.

[Copilot]

Pull request overview

This PR adds automated nightly PyPI publishing for the CUTracer Python package using GitHub Actions. The workflow enables scheduled nightly builds, tag-based releases, and uses OIDC-based trusted publishing for secure uploads.

Key Changes

• Implements scheduled nightly publishing at 07:18 UTC daily
• Configures tag-based releases triggered by version tags (v* or ..*)
• Uses external script from tritonparse repository for commit detection
• Implements dynamic version generation for nightly builds based on next patch version plus timestamp

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The step name and comment don't clarify what output variable this step produces (should_publish). Consider adding a comment that documents the expected output variable and its possible values ('true' or 'false') to improve maintainability and make the workflow logic clearer.

Suggested change

	run: |
	run: |
	# This script sets the `should_publish` step output to either 'true' or 'false'.

[Copilot]

Using a here-document for IFS read is unnecessarily complex. Consider simplifying this to use parameter expansion directly: IFS='.' read -r MAJ MIN PAT <<< "$BASE" which is more concise and doesn't require the EOF markers.

Suggested change

	IFS='.' read -r MAJ MIN PAT <<EOF
	$BASE
	EOF
	IFS='.' read -r MAJ MIN PAT <<< "$BASE"

[Copilot]

The regex pattern doesn't properly handle tags with only one or two version components. If a tag is "v1.2" without a patch version, the capture group will only match "1.2" and the subsequent IFS read expecting three components (MAJ MIN PAT) will fail or produce incorrect results. Consider adding validation to ensure the tag matches the expected X.Y.Z format, or handle cases where fewer components are present.

Suggested change

	BASE=${TAG#v}
	BASE=${TAG#v}
	# Require a semantic version X.Y.Z (optionally with a suffix) before proceeding
	if ! printf "%s\n" "$BASE" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+'; then
	echo "::error title=Invalid git tag::Latest tag '$TAG' is not a semantic version like v0.1.0"
	exit 1
	fi

[Copilot]

The shell comparison uses double quotes around the GitHub expression which can be fragile. Consider using the native GitHub Actions expression syntax in the if condition instead: if: github.ref_type != 'tag'. This would be more maintainable and less error-prone than embedding the comparison in a shell script.

Suggested change

	- name: Build sdist/wheel
	if: github.ref_type == 'tag' || steps.check.outputs.should_publish != 'false'
	run: |
	python -m pip install --upgrade pip
	pip install build setuptools-scm
	if [ "${{ github.ref_type }}" != "tag" ]; then
	export SETUPTOOLS_SCM_PRETEND_VERSION=${{ steps.ver.outputs.NVER }}
	fi
	cd python
	python -m build
	- name: Build sdist/wheel (nightly)
	if: github.ref_type != 'tag' && steps.check.outputs.should_publish != 'false'
	run: |
	python -m pip install --upgrade pip
	pip install build setuptools-scm
	export SETUPTOOLS_SCM_PRETEND_VERSION=${{ steps.ver.outputs.NVER }}
	cd python
	python -m build
	- name: Build sdist/wheel (tag)
	if: github.ref_type == 'tag'
	run: |
	python -m pip install --upgrade pip
	pip install build setuptools-scm
	cd python
	python -m build

[Copilot]

Downloading and executing an external script from the main branch without integrity verification poses a security risk. If the tritonparse repository is compromised or the script is modified maliciously, this workflow will automatically execute that code. Consider either: (1) pinning to a specific commit hash instead of 'main', (2) adding checksum verification, or (3) vendoring the script locally with a note about its origin.

Suggested change

	curl -fsSL https://github.com/meta-pytorch/tritonparse/raw/refs/heads/main/.github/scripts/check_new_commits.sh | bash
	# Pin to a specific, reviewed commit of meta-pytorch/tritonparse to avoid executing mutable code from "main".
	# Update <COMMIT_SHA> intentionally when upgrading the script.
	curl -fsSL https://raw.githubusercontent.com/meta-pytorch/tritonparse/<COMMIT_SHA>/.github/scripts/check_new_commits.sh | bash

[Copilot]

The PyPI publish action is using a floating version tag 'release/v1' which could introduce breaking changes without notice. Consider pinning to a specific version hash or full version tag (e.g., 'v1.8.14' with its commit SHA) for better reproducibility and stability.

Suggested change

	uses: pypa/gh-action-pypi-publish@release/v1
	uses: pypa/gh-action-pypi-publish@v1.10.3

[meta-codesync]

@FindHao merged this pull request in 889395e.