From bcd0a2033822f639d1f8016fc9e6178506b9f1bf Mon Sep 17 00:00:00 2001
From: Piotr Mlocek <pmlocek@nvidia.com>
Date: Tue, 17 Mar 2026 17:30:27 -0700
Subject: [PATCH] fix(ci): pass wheel filenames as job output instead of
 re-downloading
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The trigger-wheel-publish job was downloading the wheel artifact onto a
persistent self-hosted runner just to glob the filenames. Since
download-artifact does not clean the destination directory, stale .whl
files from every previous run accumulated in release/ and were all sent
to GitLab as WHEEL_FILENAMES.

Confirmed on the runner: /home/ubuntu/actions-runner/_work/OpenShell/
OpenShell/release/ contained 120+ wheels spanning versions 0.0.5
through 0.0.10.

Fix: capture wheel filenames as a job output in build-python-wheels and
pass them directly to trigger-wheel-publish. The trigger job no longer
downloads the artifact at all — it only needs the filenames to construct
GitHub release asset URLs for GitLab/Kitmaker.
---
 .github/workflows/release-dev.yml | 24 ++++++++++++------------
 .github/workflows/release-tag.yml | 24 ++++++++++++------------
 2 files changed, 24 insertions(+), 24 deletions(-)

diff --git a/.github/workflows/release-dev.yml b/.github/workflows/release-dev.yml
index 488ec101..b38787f6 100644
--- a/.github/workflows/release-dev.yml
+++ b/.github/workflows/release-dev.yml
@@ -96,6 +96,7 @@ jobs:
     timeout-minutes: 120
     outputs:
       wheel_version: ${{ needs.compute-versions.outputs.python_version }}
+      wheel_filenames: ${{ steps.filenames.outputs.wheel_filenames }}
     container:
       image: ghcr.io/nvidia/openshell/ci:latest
       credentials:
@@ -132,6 +133,13 @@ jobs:
           OPENSHELL_CARGO_VERSION="${{ needs.compute-versions.outputs.cargo_version }}" mise run python:build:macos
           ls -la target/wheels/*.whl
 
+      - name: Capture wheel filenames
+        id: filenames
+        run: |
+          set -euo pipefail
+          WHEEL_FILENAMES=$(ls target/wheels/*.whl | xargs -n1 basename | paste -sd, -)
+          echo "wheel_filenames=${WHEEL_FILENAMES}" >> "$GITHUB_OUTPUT"
+
       - name: Upload wheel artifacts
         uses: actions/upload-artifact@v4
         with:
@@ -428,31 +436,23 @@ jobs:
 
   trigger-wheel-publish:
     name: Trigger Wheel Publish
-    needs: [compute-versions, release-devel]
+    needs: [compute-versions, build-python-wheels, release-devel]
     runs-on: [self-hosted, nv]
     timeout-minutes: 10
     steps:
-      - name: Download wheel artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: python-wheels
-          path: release/
-
       - name: Trigger GitLab CI
         env:
           GITLAB_CI_TRIGGER_TOKEN: ${{ secrets.GITLAB_CI_TRIGGER_TOKEN }}
           GITLAB_CI_TRIGGER_URL: ${{ secrets.GITLAB_CI_TRIGGER_URL }}
           RELEASE_VERSION: ${{ needs.compute-versions.outputs.python_version }}
+          WHEEL_FILENAMES: ${{ needs.build-python-wheels.outputs.wheel_filenames }}
         run: |
           set -euo pipefail
-          shopt -s nullglob
-          wheel_files=(release/*.whl)
-          if (( ${#wheel_files[@]} == 0 )); then
-            echo "No wheel artifacts found in release/" >&2
+          if [ -z "${WHEEL_FILENAMES}" ]; then
+            echo "No wheel filenames provided by build job" >&2
             exit 1
           fi
 
-          WHEEL_FILENAMES=$(printf '%s\n' "${wheel_files[@]##*/}" | paste -sd, -)
           response=$(curl -X POST \
             --fail \
             --silent \
diff --git a/.github/workflows/release-tag.yml b/.github/workflows/release-tag.yml
index e36de607..0e292531 100644
--- a/.github/workflows/release-tag.yml
+++ b/.github/workflows/release-tag.yml
@@ -116,6 +116,7 @@ jobs:
     timeout-minutes: 120
     outputs:
       wheel_version: ${{ needs.compute-versions.outputs.python_version }}
+      wheel_filenames: ${{ steps.filenames.outputs.wheel_filenames }}
     container:
       image: ghcr.io/nvidia/openshell/ci:latest
       credentials:
@@ -153,6 +154,13 @@ jobs:
           OPENSHELL_CARGO_VERSION="${{ needs.compute-versions.outputs.cargo_version }}" mise run python:build:macos
           ls -la target/wheels/*.whl
 
+      - name: Capture wheel filenames
+        id: filenames
+        run: |
+          set -euo pipefail
+          WHEEL_FILENAMES=$(ls target/wheels/*.whl | xargs -n1 basename | paste -sd, -)
+          echo "wheel_filenames=${WHEEL_FILENAMES}" >> "$GITHUB_OUTPUT"
+
       - name: Upload wheel artifacts
         uses: actions/upload-artifact@v4
         with:
@@ -404,32 +412,24 @@ jobs:
 
   trigger-wheel-publish:
     name: Trigger Wheel Publish
-    needs: [compute-versions, release]
+    needs: [compute-versions, build-python-wheels, release]
     runs-on: [self-hosted, nv]
     timeout-minutes: 10
     steps:
-      - name: Download wheel artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: python-wheels
-          path: release/
-
       - name: Trigger GitLab CI
         env:
           GITLAB_CI_TRIGGER_TOKEN: ${{ secrets.GITLAB_CI_TRIGGER_TOKEN }}
           GITLAB_CI_TRIGGER_URL: ${{ secrets.GITLAB_CI_TRIGGER_URL }}
           RELEASE_VERSION: ${{ needs.compute-versions.outputs.python_version }}
           RELEASE_TAG: ${{ env.RELEASE_TAG }}
+          WHEEL_FILENAMES: ${{ needs.build-python-wheels.outputs.wheel_filenames }}
         run: |
           set -euo pipefail
-          shopt -s nullglob
-          wheel_files=(release/*.whl)
-          if (( ${#wheel_files[@]} == 0 )); then
-            echo "No wheel artifacts found in release/" >&2
+          if [ -z "${WHEEL_FILENAMES}" ]; then
+            echo "No wheel filenames provided by build job" >&2
             exit 1
           fi
 
-          WHEEL_FILENAMES=$(printf '%s\n' "${wheel_files[@]##*/}" | paste -sd, -)
           response=$(curl -X POST \
             --fail \
             --silent \