[TheGupta2012]

Summary of changes

Adds Publish qBraid Lab environment (.github/workflows/publish-lab-env.yml), a workflow_dispatch workflow for a released pyqasm version. It replaces the manual Lab-terminal flow for publishing an environment.

Each workflow step is one call into bin/publish_lab_env.py. The smoke test is bin/lab_env_smoke_test.py.

Steps

1. preflight: checks the inputs and that the version is on PyPI. Then it checks the key, the logo, the group, and that no environment of the same name is visible.

2. create: qbraid envs create makes pyqasm <version> with kernel Python 3 [pyqasm <version>]. Then qbraid-core's pip_install adds:

   • pyqasm[<every extra the release declares on PyPI>]==<version>
   • ipykernel, which Lab needs to start the kernel
   • matplotlib

   Only pyqasm is pinned. Every package in the live 1.2.1 environment resolves from this set.

3. Smoke test with the environment's Python: check the version and import each extra. Then unroll, validate and draw a small program.

4. upload by env_id.

5. publish: approve, then add to the group as its latest. It approves directly, without a publish request. That skips the per-plan publish quota and the email a request sends every platform admin. Approving makes the environment public in the catalog.

6. summary writes the results to the job summary. On failure it prints the slug to resume from.

Inputs

Input	Purpose
target	staging or production
version	pyqasm release, x.y.z
stop_after	upload, approve or publish
set_latest	default on. Latest is also left alone when the group's latest is a newer pyqasm, so a backport never replaces it.
slug	resume a failed run. Skips create and upload. publish skips steps already done.
allow_existing	publish another copy under a name that already exists

Why the runner, not a qBraid compute instance

A venv links to the Python that created it. Prod Lab runs Ubuntu 24.04 x86_64 (glibc 2.39) with the system Python 3.12.3 at /usr/bin/python3.12. The ubuntu-24.04 runner ships the same Python at the same path. The job builds with it through a tool venv, so the environment's bin/python links to /usr/bin/python3.12 and works in Lab unchanged.

The upload also rewrites the venv paths for /home/jovyan. On install, Lab runs repair_venv as a fallback. In prod Lab, find_python('3.12') returns /usr/bin/python3.12, so the relink also works.

The first staging run still installs the environment in staging Lab and starts its kernel before any production run.

Configuration

GitHub Environment	Variables	Secret	Protection
env-publish-staging	QBRAID_API_URL (staging API), QBRAID_ENV_GROUP	QBRAID_API_KEY	required reviewers, main only
env-publish-production	QBRAID_API_URL (prod API), QBRAID_ENV_GROUP	QBRAID_API_KEY	required reviewer, main only

QBRAID_ENV_LOGO is optional and defaults to qbraid. The keys belong to Pro accounts with admin roles. Approving needs admin or global|labs|environments|review, and group edits need a platform admin.

Hardening

• qbraid-cli and qbraid-core are pinned. pip installs wheels only.
• The API key is set only on the steps that call qBraid. Installs and the smoke test never see it.
• The actions are pinned by commit SHA. No input is expanded inside a run: script.

Known limits

• A workflow_dispatch workflow must exist on main before it can run. So the first staging run happens after merge.

Testing

• actionlint passes on the workflow. black, isort and pylint (10.00) pass on both scripts.
• create and the smoke test ran for real with the pinned CLI and core, wheels only, in a throwaway HOME. All six extras installed. (That local run used macOS; the workflow now uses the runner's system Python.) The smoke test passed, and a wrong version fails it.
• Every dependency resolves as a manylinux wheel for Python 3.12.
• Mocked unit tests (32) cover:
  • input and slug checks, PyPI errors
  • preflight and resume
  • approve-only flow, idempotent re-runs
  • the backport and set_latest rules, the missing-group failure, pagination
  • upload output and the summary
• Not yet run against staging.

[argus-eye]

Argus review

Auto-review is off for this repo. Tick the box below to run a review on this PR.

• Trigger Argus review

Estimated cost

• Files changed: 3
• Diff lines (±): 412
• Historical avg: ~350.7k tokens · ~$1.38 · across last 13 review(s)

Tip: you can also comment @argus-eye review at any time.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Repository: qBraid/pyqasm/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: bdd959a8-a9c4-4988-beb4-4c787475929b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[TheGupta2012]

Merging so that tests can be performed in staging