actions: separate workflow for nightly wheels upload

Author: oscarbenjamin

.github/workflows/buildwheel.yml

@@ -427,38 +427,6 @@ jobs:
       - run: pip install git+https://github.com/sympy/sympy.git@master
       - run: python -c 'import sympy; sympy.test(parallel=True)'
 
-  # Push nightly wheels to Anaconda scientific-python nightly channel
-  # https://scientific-python.org/specs/spec-0004/
-  # https://anaconda.org/scientific-python-nightly-wheels/python-flint
-  # https://github.com/scientific-python/upload-nightly-action/issues/111
-
-  nightly-wheels-upload:
-    name: Upload Anaconda Scientific Python nightly wheels
-    needs: [build_wheels]
-    # Run on push/merge to main
-    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
-    runs-on: ubuntu-latest
-    permissions: {}
-
-    steps:
-        # Downloads all artifacts
-      - name: Download release artifacts
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          path: wheelhouse
-          merge-multiple: true
-
-      - name: Copy the wheels into dist
-        run: mkdir dist && cp wheelhouse/*.whl dist
-
-      - name: Upload wheels
-        uses: scientific-python/upload-nightly-action@5748273c71e2d8d3a61f3a11a16421c8954f9ecf # 0.6.3
-        with:
-          artifacts_path: dist
-          # This token is generated from anaconda.org
-          # https://github.com/scientific-python/upload-nightly-action/issues/111
-          anaconda_nightly_upload_token: ${{ secrets.ANACONDA_ORG_UPLOAD_TOKEN }} # zizmor: ignore[secrets-outside-env]
-
   # Deploy wheels and sdist to PyPI
 
   pypi_release:

.github/workflows/nightly-wheels-upload.yml

@@ -0,0 +1,48 @@
+name: Upload Nightly Wheels
+
+on:
+  # XXX: zizmor says that workflow_run is insecure but this is restricted to
+  # a push to main only.
+  workflow_run: # zizmor: ignore[dangerous-triggers]
+    workflows: [Build]
+    types: [completed]
+    branches: [main]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions: {}
+
+jobs:
+  nightly-wheels-upload:
+    name: Upload Anaconda Scientific Python nightly wheels
+    if: >
+      github.event.workflow_run.conclusion == 'success' &&
+      github.event.workflow_run.event == 'push'
+    runs-on: ubuntu-latest
+    environment:
+      name: anaconda_nightly
+    permissions:
+      actions: read # Required to download artifacts from the triggering workflow run.
+
+    steps:
+      - name: Download release artifacts
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          github-token: ${{ github.token }}
+          repository: ${{ github.repository }}
+          run-id: ${{ github.event.workflow_run.id }}
+          path: wheelhouse
+          merge-multiple: true
+
+      - name: Copy the wheels into dist
+        run: mkdir dist && cp wheelhouse/*.whl dist
+
+      - name: Upload wheels
+        uses: scientific-python/upload-nightly-action@5748273c71e2d8d3a61f3a11a16421c8954f9ecf # 0.6.3
+        with:
+          artifacts_path: dist
+          # This token is generated from anaconda.org
+          # https://github.com/scientific-python/upload-nightly-action/issues/111
+          anaconda_nightly_upload_token: ${{ secrets.ANACONDA_ORG_UPLOAD_TOKEN_V2 }}