From 5853493f87d2369fe1ffd005f750f549f42cd03e Mon Sep 17 00:00:00 2001
From: Cuiys <cuiyushuai.cys@alibaba-inc.com>
Date: Fri, 9 Jan 2026 10:37:48 +0800
Subject: [PATCH] chore(ci): fix ci serurity and add build wheels for test pypi
 (#16)

* fix(ci): add permissions for ci

* fix(ci): add build wheel for test pypi

* fix: remove unused  extra-index-url
---
 .github/workflows/build_test_wheel.yml    | 55 +++++++++++++++++++++++
 .github/workflows/build_wheel.yml         |  3 ++
 .github/workflows/linux_x64_docker_ci.yml |  3 ++
 .github/workflows/mac_arm64_ci.yml        |  3 ++
 .github/workflows/nightly_coverage.yml    |  3 ++
 5 files changed, 67 insertions(+)
 create mode 100644 .github/workflows/build_test_wheel.yml

diff --git a/.github/workflows/build_test_wheel.yml b/.github/workflows/build_test_wheel.yml
new file mode 100644
index 0000000..c639b41
--- /dev/null
+++ b/.github/workflows/build_test_wheel.yml
@@ -0,0 +1,55 @@
+name: Build Test PyPi Wheels
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  build_wheels:
+    name: Build wheels on self-hosted manylinux_2_28
+    runs-on: linux_x64
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          submodules: recursive
+
+      - name: Set up Python (for cibuildwheel controller)
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+
+      - name: Install cibuildwheel
+        run: |
+          pip install --upgrade pip
+          pip install cibuildwheel==2.17.0
+      - name: Build wheels using cibuildwheel
+        run: |
+          python -m cibuildwheel --output-dir wheelhouse
+          # Save list of built wheels for publishing
+          ls wheelhouse/*.whl | tee $GITHUB_STEP_SUMMARY
+          echo "wheels=$(ls wheelhouse/*.whl | tr '\n' ' ')" >> $GITHUB_ENV
+      - name: Publish to TestPyPI
+        if: success() && github.event_name == 'workflow_dispatch'
+        env:
+          TWINE_USERNAME: __token__
+          TWINE_PASSWORD: ${{ secrets.TEST_PYPI_API_TOKEN }}
+          TWINE_REPOSITORY_URL: https://test.pypi.org/legacy/
+        run: |
+          pip install twine
+          twine upload --skip-existing --verbose wheelhouse/*.whl
+      - name: (Optional) Install and test from TestPyPI
+        if: success() && github.event_name == 'workflow_dispatch'
+        run: |
+          # Create a clean venv
+          python -m venv test_env
+          source test_env/bin/activate
+          pip install --upgrade pip
+          # Install from TestPyPI (must allow pre-releases if version has dev/alpha)
+          pip install --index-url https://test.pypi.org/simple/ zvec
+          # Run a simple smoke test
+          python -c "import zvec; print('Import OK:', zvec.__version__)"
+        shell: bash
diff --git a/.github/workflows/build_wheel.yml b/.github/workflows/build_wheel.yml
index 6757d1c..db69d87 100644
--- a/.github/workflows/build_wheel.yml
+++ b/.github/workflows/build_wheel.yml
@@ -3,6 +3,9 @@ name: Build Wheels
 on:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   build_wheels:
     name: Build wheels on self-hosted manylinux_2_28
diff --git a/.github/workflows/linux_x64_docker_ci.yml b/.github/workflows/linux_x64_docker_ci.yml
index 7e42eeb..273c127 100644
--- a/.github/workflows/linux_x64_docker_ci.yml
+++ b/.github/workflows/linux_x64_docker_ci.yml
@@ -7,6 +7,9 @@ on:
     branches: [ "main" ]
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: linux_x64
diff --git a/.github/workflows/mac_arm64_ci.yml b/.github/workflows/mac_arm64_ci.yml
index 54bcd6b..346b148 100644
--- a/.github/workflows/mac_arm64_ci.yml
+++ b/.github/workflows/mac_arm64_ci.yml
@@ -7,6 +7,9 @@ on:
     branches: [ "main" ]
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: mac_m1_arm
diff --git a/.github/workflows/nightly_coverage.yml b/.github/workflows/nightly_coverage.yml
index 86ee2c8..17d8aec 100644
--- a/.github/workflows/nightly_coverage.yml
+++ b/.github/workflows/nightly_coverage.yml
@@ -7,6 +7,9 @@ on:
 
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   coverage:
     runs-on: linux_x64