python_release.yml

# Originally generated by `maturin generate-ci github` (maturin v1.4.0), then
# corrected by hand. Do not regenerate over it without re-applying the fixes
# recorded below.
name: python-release

on:
  workflow_dispatch:
    inputs:
      sha:
        description: "The full sha of the commit to be released. If omitted, the latest commit on the default branch will be used."
        default: ""
        type: string
      release:
        description: 'Set to true to run the release on pypi, dry run otherwise'
        required: true
        default: 'false'
  pull_request:
    paths:
      # This said `python_release.yaml` while the file is `python_release.yml`.
      # A path filter matches literal repository paths, so it matched nothing
      # and this trigger could never fire. Editing the release workflow was
      # therefore never validated by a pull request.
      - .github/workflows/python_release.yml

permissions:
  contents: read

# pyo3 0.29 sets MINIMUM_SUPPORTED_VERSION = 3.8, so the previous "3.7" entry
# could only ever fail. 3.8 and 3.9 are both past end of life, and the crate
# targets 3.14, so the supported floor is 3.10. Keep this list, the
# `requires-python` key in crates/python/pyproject.toml, and the abi3 note in
# crates/python/Cargo.toml in agreement.
env:
  MATURIN_ARGS_COMMON: --release --out dist --manifest-path crates/python/Cargo.toml

jobs:
  linux:
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]
        target: [x86_64]
    steps:
      - uses: actions/checkout@v7
        with:
          ref: ${{ inputs.sha }}
      - name: Set up Python ${{ matrix.python-version }}
        uses: actions/setup-python@v7
        with:
          python-version: ${{ matrix.python-version }}
      - name: Build wheels
        uses: PyO3/maturin-action@v1
        with:
          target: ${{ matrix.target }}
          args: ${{ env.MATURIN_ARGS_COMMON }} --interpreter python${{ matrix.python-version }}
          sccache: 'true'
          manylinux: auto
      - name: Upload wheels
        uses: actions/upload-artifact@v7
        with:
          # upload-artifact v4 rejects a second upload to a name that already
          # exists, where v3 silently merged them. Every job here used the one
          # name `wheels`, so a plain v3 -> v4 bump would fail the whole
          # matrix. Each job now writes a distinct name and the release job
          # merges them back on download.
          name: wheels-linux-${{ matrix.target }}-py${{ matrix.python-version }}
          path: dist

  windows:
    runs-on: windows-latest
    strategy:
      fail-fast: false
      matrix:
        python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]
        target: [x64]
    steps:
      - uses: actions/checkout@v7
        with:
          ref: ${{ inputs.sha }}
      - name: Set up Python ${{ matrix.python-version }}
        uses: actions/setup-python@v7
        with:
          python-version: ${{ matrix.python-version }}
          architecture: ${{ matrix.target }}
      - name: Build wheels
        uses: PyO3/maturin-action@v1
        with:
          target: ${{ matrix.target }}
          args: ${{ env.MATURIN_ARGS_COMMON }} --interpreter python${{ matrix.python-version }}
          sccache: 'true'
      - name: Upload wheels
        uses: actions/upload-artifact@v7
        with:
          name: wheels-windows-${{ matrix.target }}-py${{ matrix.python-version }}
          path: dist

  macos:
    runs-on: ${{ matrix.runner }}
    strategy:
      fail-fast: false
      matrix:
        python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]
        target: [x86_64, aarch64]
        # `macos-latest` is Apple silicon now. Building the x86_64 wheel there
        # while `setup-python` installs an arm64 interpreter gives maturin a
        # host interpreter that does not match the requested target. Pin each
        # architecture to a runner whose native arch matches it.
        #
        # `target` must stay in the matrix above, not only here. An `include`
        # entry whose keys are all NEW is applied to every combination, so two
        # such entries would leave only the last one standing and every job
        # would build aarch64. Repeating the `target` key restricts each entry
        # to the combinations it matches, and adds `runner` to just those.
        #
        # `macos-13` was the Intel image here until GitHub retired it, and a
        # job on a retired label never starts. `macos-15-intel` replaces it.
        include:
          - target: x86_64
            runner: macos-15-intel
          - target: aarch64
            runner: macos-14
    steps:
      - uses: actions/checkout@v7
        with:
          ref: ${{ inputs.sha }}
      - name: Set up Python ${{ matrix.python-version }}
        uses: actions/setup-python@v7
        with:
          python-version: ${{ matrix.python-version }}
      - name: Build wheels
        uses: PyO3/maturin-action@v1
        with:
          target: ${{ matrix.target }}
          args: ${{ env.MATURIN_ARGS_COMMON }} --interpreter python${{ matrix.python-version }}
          sccache: 'true'
      - name: Upload wheels
        uses: actions/upload-artifact@v7
        with:
          name: wheels-macos-${{ matrix.target }}-py${{ matrix.python-version }}
          path: dist

  sdist:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with:
          ref: ${{ inputs.sha }}
      - name: Build sdist
        uses: PyO3/maturin-action@v1
        with:
          command: sdist
          args: --out dist --manifest-path crates/python/Cargo.toml
      - name: Upload sdist
        uses: actions/upload-artifact@v7
        with:
          name: wheels-sdist
          path: dist

  release:
    name: Release
    runs-on: ubuntu-latest
    if: "github.event.inputs.release == 'true'"
    needs:
      - linux
      - windows
      - macos
      - sdist
    environment:
      name: pypi
      url: https://pypi.org/p/triodion
    permissions:
      id-token: write
    steps:
      - uses: actions/download-artifact@v8
        with:
          # Collect every per-job artifact back into one directory. This pair
          # of keys replaces what v3 did implicitly with a shared name.
          pattern: wheels-*
          merge-multiple: true
          path: dist
      - name: Publish package distributions to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          skip-existing: true
          packages-dir: dist