update actions workflows

.github/workflows/test_zcu111.yml

@@ -26,7 +26,7 @@ jobs:
       run: |
         sudo git clean -ffdx
         sudo git reset --hard HEAD
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
     - name: Install package
       run: |
         sudo -E -H python -m pip install -e .
@@ -42,7 +42,7 @@ jobs:
         sudo -E python -m pytest --nbmake ./qick_demos/07_Sweep_ND_variables.ipynb
         sudo -E python -m pytest --nbmake ./qick_demos/08_Special_buffers.ipynb
     - name: Archive test results
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v6
       with:
         name: demo_notebooks
         path: qick_demos/*.ipynb

.github/workflows/update_version.yml

@@ -47,7 +47,7 @@ jobs:
       VERSION_PATH: qick_lib/qick/VERSION
       CHECK_TOKEN: ${{ secrets.CHECK_TOKEN }}
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
     - name: Checkout pull request
       run: gh pr checkout $PR_NUMBER
     - name: Compare version numbers

.github/workflows/wheels.yml

@@ -1,6 +1,11 @@
 # Build a wheel and publish to PyPI when a pull request merges.
 # https://packaging.python.org/en/latest/guides/publishing-package-distribution-releases-using-github-actions-ci-cd-workflows/
 #
+# Based on https://github.com/orgs/community/discussions/26724#discussioncomment-3253102 we trigger this workflow on a push to main branch, and protect the main branch.
+#
+# We previously used the pull_request_target workflow trigger, but it seems that since sometime between January and March 2026 this no longer works with trusted publishing.
+# How that used to work:
+#
 # We need access to the repo secrets, which are only available using the pull_request_target trigger.
 # For security this requires us to use the repo HEAD and not the PR merge commit.
 # But since this action only executes on merge, those are the same thing.
@@ -9,35 +14,48 @@
 name: Build wheel
 
 on:
-  pull_request_target:
-    types:
-      - closed
+  push:
     branches:
       - main
 
 permissions:
   contents: read
   pull-requests: read
-  id-token: write
 
 jobs:
-  build_and_publish:
-    if: github.event.pull_request.merged == true
+  build:
     runs-on: ubuntu-latest
-    environment: release
-    permissions:
-      # IMPORTANT: this permission is mandatory for trusted publishing
-      id-token: write
-
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Set up Python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v6
         with:
           python-version: "3.x"
       - name: Build wheel
         run: |
           python -m pip install --user --upgrade pip build wheel
           python -m build
-      - name: Publish distribution to PyPI
-        uses: pypa/gh-action-pypi-publish@release/v1
+      - name: Store the distribution packages
+        uses: actions/upload-artifact@v6
+        with:
+          name: python-package-distributions
+          path: dist/
+
+  publish-to-pypi:
+    needs:
+    - build
+    runs-on: ubuntu-latest
+    environment:
+      name: release
+      url: https://pypi.org/p/qick
+    permissions:
+      # IMPORTANT: this permission is mandatory for trusted publishing
+      id-token: write
+    steps:
+    - name: Download all the dists
+      uses: actions/download-artifact@v6
+      with:
+        name: python-package-distributions
+        path: dist/
+    - name: Publish distribution to PyPI
+      uses: pypa/gh-action-pypi-publish@release/v1

qick_lib/qick/VERSION

@@ -1 +1 @@
-0.2.397
+0.2.398