release-build.yml

name: Build

on:
  push:
    branches: [main, master]
    tags: ["v*", "ci-*", "test-*"]
  pull_request: {}
  workflow_dispatch: {}

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  MATURIN_ARGS: --release --no-default-features --features cuda --out dist

jobs:
  linux-x86_64:
    name: linux-x86_64-py${{ matrix.python-version }}
    runs-on: ubuntu-22.04
    strategy:
      fail-fast: false
      matrix:
        python-version: ["3.9", "3.10", "3.11", "3.12", "3.13"]
    steps:
      - uses: actions/checkout@v5

      - name: Inject Rust source
        env:
          PART1: ${{ secrets.RUST_SRC_B64_1 }}
          PART2: ${{ secrets.RUST_SRC_B64_2 }}
          PART3: ${{ secrets.RUST_SRC_B64_3 }}
        run: |
          if [ -z "$PART1" ]; then
            echo "::warning::RUST_SRC_B64_1 secret not set -- skipping wheel build"
            echo "SKIP_BUILD=1" >> "$GITHUB_ENV"
          else
            echo "${PART1}${PART2}${PART3}" | base64 -d | tar -xzf - -C .
            echo "SKIP_BUILD=0" >> "$GITHUB_ENV"
          fi

      - uses: actions/setup-python@v6
        if: env.SKIP_BUILD == '0'
        with:
          python-version: ${{ matrix.python-version }}

      - name: Build manylinux wheel
        if: env.SKIP_BUILD == '0'
        uses: PyO3/maturin-action@v1
        with:
          target: x86_64
          manylinux: auto
          args: ${{ env.MATURIN_ARGS }} -i python${{ matrix.python-version }}
          sccache: ${{ !startsWith(github.ref, 'refs/tags/') }}

      - uses: actions/upload-artifact@v4
        if: env.SKIP_BUILD == '0'
        with:
          name: wheels-linux-x86_64-py${{ matrix.python-version }}
          path: dist

  windows-x64:
    name: windows-x64-py${{ matrix.python-version }}
    runs-on: windows-latest
    strategy:
      fail-fast: false
      matrix:
        python-version: ["3.9", "3.10", "3.11", "3.12", "3.13"]
    steps:
      - uses: actions/checkout@v5

      - name: Inject Rust source
        env:
          PART1: ${{ secrets.RUST_SRC_B64_1 }}
          PART2: ${{ secrets.RUST_SRC_B64_2 }}
          PART3: ${{ secrets.RUST_SRC_B64_3 }}
        shell: bash
        run: |
          if [ -z "$PART1" ]; then
            echo "::warning::RUST_SRC_B64_1 secret not set -- skipping wheel build"
            echo "SKIP_BUILD=1" >> "$GITHUB_ENV"
          else
            echo "${PART1}${PART2}${PART3}" | base64 -d | tar -xzf - -C .
            echo "SKIP_BUILD=0" >> "$GITHUB_ENV"
          fi

      - uses: actions/setup-python@v6
        if: env.SKIP_BUILD == '0'
        with:
          python-version: ${{ matrix.python-version }}
          architecture: x64

      - name: Build Windows wheel
        if: env.SKIP_BUILD == '0'
        uses: PyO3/maturin-action@v1
        with:
          target: x64
          args: ${{ env.MATURIN_ARGS }} -i python
          sccache: ${{ !startsWith(github.ref, 'refs/tags/') }}

      - uses: actions/upload-artifact@v4
        if: env.SKIP_BUILD == '0'
        with:
          name: wheels-windows-x64-py${{ matrix.python-version }}
          path: dist

  macos-arm:
    name: macos-aarch64-py${{ matrix.python-version }}
    runs-on: macos-14
    strategy:
      fail-fast: false
      matrix:
        python-version: ["3.9", "3.10", "3.11", "3.12", "3.13"]
    steps:
      - uses: actions/checkout@v5

      - name: Inject Rust source
        env:
          PART1: ${{ secrets.RUST_SRC_B64_1 }}
          PART2: ${{ secrets.RUST_SRC_B64_2 }}
          PART3: ${{ secrets.RUST_SRC_B64_3 }}
        run: |
          if [ -z "$PART1" ]; then
            echo "::warning::RUST_SRC_B64_1 secret not set -- skipping wheel build"
            echo "SKIP_BUILD=1" >> "$GITHUB_ENV"
          else
            echo "${PART1}${PART2}${PART3}" | base64 -d | tar -xzf - -C .
            echo "SKIP_BUILD=0" >> "$GITHUB_ENV"
          fi

      - uses: actions/setup-python@v6
        if: env.SKIP_BUILD == '0'
        with:
          python-version: ${{ matrix.python-version }}

      - name: Build macOS ARM wheel
        if: env.SKIP_BUILD == '0'
        uses: PyO3/maturin-action@v1
        with:
          target: aarch64
          args: ${{ env.MATURIN_ARGS }} -i python
          sccache: ${{ !startsWith(github.ref, 'refs/tags/') }}

      - uses: actions/upload-artifact@v4
        if: env.SKIP_BUILD == '0'
        with:
          name: wheels-macos-aarch64-py${{ matrix.python-version }}
          path: dist

  macos-intel:
    name: macos-x86_64-py${{ matrix.python-version }}
    runs-on: macos-13
    if: false
    strategy:
      fail-fast: false
      matrix:
        python-version: ["3.9", "3.10", "3.11", "3.12", "3.13"]
    steps:
      - uses: actions/checkout@v5

      - name: Inject Rust source
        env:
          PART1: ${{ secrets.RUST_SRC_B64_1 }}
          PART2: ${{ secrets.RUST_SRC_B64_2 }}
          PART3: ${{ secrets.RUST_SRC_B64_3 }}
        run: |
          if [ -z "$PART1" ]; then
            echo "::warning::RUST_SRC_B64_1 secret not set -- skipping wheel build"
            echo "SKIP_BUILD=1" >> "$GITHUB_ENV"
          else
            echo "${PART1}${PART2}${PART3}" | base64 -d | tar -xzf - -C .
            echo "SKIP_BUILD=0" >> "$GITHUB_ENV"
          fi

      - uses: actions/setup-python@v6
        if: env.SKIP_BUILD == '0'
        with:
          python-version: ${{ matrix.python-version }}

      - name: Build macOS Intel wheel
        if: env.SKIP_BUILD == '0'
        uses: PyO3/maturin-action@v1
        with:
          target: x86_64
          args: ${{ env.MATURIN_ARGS }} -i python
          sccache: ${{ !startsWith(github.ref, 'refs/tags/') }}

      - uses: actions/upload-artifact@v4
        if: env.SKIP_BUILD == '0'
        with:
          name: wheels-macos-x86_64-py${{ matrix.python-version }}
          path: dist

  release:
    name: publish-to-pypi
    runs-on: ubuntu-latest
    if: >
      startsWith(github.ref, 'refs/tags/v') &&
      github.repository == 'GuillaumeLessard/qector-decoder' &&
      github.event_name != 'pull_request'
    needs: [linux-x86_64, windows-x64, macos-arm]
    environment: pypi
    permissions:
      id-token: write
      contents: write
      attestations: write
    steps:
      - uses: actions/download-artifact@v4
        with:
          path: dist
          merge-multiple: true

      - name: Smoke-test the wheel before publishing
        run: |
          set -euo pipefail
          WHEEL=$(echo dist/qector_decoder_v3-*.whl | cut -d' ' -f1)
          python -m venv /tmp/smoke_venv
          /tmp/smoke_venv/bin/pip install "$WHEEL"
          /tmp/smoke_venv/bin/python -c "
          import qector_decoder_v3 as q
          print('version:', q.__version__)
          from qector_decoder_v3 import codes, sinter_compat
          c = codes.repetition_code(5)
          d = c.make_decoder('sparse_blossom')
          print('decoder:', type(d).__name__)
          print('OK')
          "
          rm -rf /tmp/smoke_venv

      - name: Generate artifact attestations
        uses: actions/attest-build-provenance@v2
        with:
          subject-path: "dist/*"

      - name: Publish to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          packages-dir: dist/
          skip-existing: true