Cycle build publishes itself - #2098

Two commits: the workflow change below, and 2026-04 b1 update carrying the 2026-04 b1 lockfile refresh (including the new 3.15 slim pair, which is what takes the cycle to nine buildable legs).

The cycle workflow built one Python version per dispatch and stopped at upload-artifact, so a cycle cost five dispatches, five artifact downloads (~2 GB) and a release upload done by hand. This makes one dispatch build the whole cycle and hands the build its own publishing.

One dispatch per cycle

cycle_config.py hangs the version, tarball and paths off each matrix leg rather than the job, so a leg names its own Python and the matrix can be (Python × flavor) instead of flavor alone. python_versionf gains all, which takes every Python the cycle has lockfiles for and quietly skips the ones whose lockfiles are not committed yet. A single version still dispatches exactly as before, through the same code path.

The build publishes its own output

A new publish input (default on) makes one job open a draft release, so the legs cannot race to create it, and each leg then uploads its own files with --clobber. Re-running a missing flavor lands on the release the others are already on. With publish off, everything stays artifacts as it does today.

The tag comes from the cycle file: <cycle name with dashes><release_level>, so 2026_04 at b1 publishes as 2026-04b1, and a respin is a release_level bump rather than a tag to invent. A release_tag key overrides it. There is deliberately no date in the tag — a date would fix it to a run rather than a release, so re-running one flavor tomorrow would open a second release, and the download URLs the site publishes outlive the run. A tag git would refuse as a ref is rejected in the 5-second config job rather than an hour into a build.

Smaller things that came with it

• With publish on, the artifact keeps only the metadata the changelog commit needs, so a 670 MB slim.7z is no longer re-zipped by upload-artifact for nothing.
• fail-fast goes off: a cycle is nine legs, and one bad flavor should not bin the eight that built.
• permissions: {} at the top with least privilege per job, persist-credentials: false on the build checkout, and the dispatch inputs passed through env: rather than interpolated into the shell.

Testing

Not yet run on Actions — it needs a dispatch. Checked statically against what the script emits: every matrix.leg.* and needs.config.outputs.* the workflow reads exists on every leg in all six dispatch choices, no stale matrix.flavor references, the artifact steps are mutually exclusive, and dotwheelhouse keeps its exact value. cycles/2026_04.toml yields 9 legs and cycles/2026_03.toml the 10 that cycle shipped. The tag derivation was checked over four cases and five malformed tags, and the upload shell logic ran against a mock publish_output, including a slash-bearing tag and the guard that fails a leg producing no binary.

Worth a trial dispatch on a fork with publish off, then one with it on, before this drives a real cycle.

The per-cycle copies (github_workflows_build-*.yml) are left in place: only 2026_03 has a matching TOML today, and this path has not had a green run yet. They can go once it has.

🤖 Generated with Claude Code

https://claude.ai/code/session_01MBk5k7WdpPvx4SUFyEk3U3