release-build.yml

name: Build

on:
  push:
    branches: [main, master]
    tags: ["v*", "ci-*", "test-*"]
  pull_request: {}
  workflow_dispatch: {}

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  MATURIN_ARGS: --release --no-default-features --features cuda --out dist

jobs:
  linux-x86_64:
    name: linux-x86_64-py${{ matrix.python-version }}
    runs-on: ubuntu-22.04
    strategy:
      fail-fast: false
      matrix:
        python-version: ["3.9", "3.10", "3.11", "3.12", "3.13"]
    steps:
      - uses: actions/checkout@v5

      - name: Inject Rust source
        env:
          PART1: ${{ secrets.RUST_SRC_B64_1 }}
          PART2: ${{ secrets.RUST_SRC_B64_2 }}
          PART3: ${{ secrets.RUST_SRC_B64_3 }}
        run: |
          if [ -z "$PART1" ]; then
            echo "::warning::RUST_SRC_B64_1 secret not set -- skipping wheel build"
            echo "SKIP_BUILD=1" >> "$GITHUB_ENV"
          else
            echo "${PART1}${PART2}${PART3}" | base64 -d | tar -xzf - -C .
            echo "SKIP_BUILD=0" >> "$GITHUB_ENV"
          fi

      - uses: actions/setup-python@v6
        if: env.SKIP_BUILD == '0'
        with:
          python-version: ${{ matrix.python-version }}

      - name: Build manylinux wheel
        if: env.SKIP_BUILD == '0'
        uses: PyO3/maturin-action@v1
        with:
          target: x86_64
          manylinux: auto
          args: ${{ env.MATURIN_ARGS }} -i python${{ matrix.python-version }}
          sccache: ${{ !startsWith(github.ref, 'refs/tags/') }}

      - uses: actions/upload-artifact@v4
        if: env.SKIP_BUILD == '0'
        with:
          name: wheels-linux-x86_64-py${{ matrix.python-version }}
          path: dist

  windows-x64:
    name: windows-x64-py${{ matrix.python-version }}
    runs-on: windows-latest
    strategy:
      fail-fast: false
      matrix:
        python-version: ["3.9", "3.10", "3.11", "3.12", "3.13"]
    steps:
      - uses: actions/checkout@v5

      - name: Inject Rust source
        env:
          PART1: ${{ secrets.RUST_SRC_B64_1 }}
          PART2: ${{ secrets.RUST_SRC_B64_2 }}
          PART3: ${{ secrets.RUST_SRC_B64_3 }}
        shell: bash
        run: |
          if [ -z "$PART1" ]; then
            echo "::warning::RUST_SRC_B64_1 secret not set -- skipping wheel build"
            echo "SKIP_BUILD=1" >> "$GITHUB_ENV"
          else
            echo "${PART1}${PART2}${PART3}" | base64 -d | tar -xzf - -C .
            echo "SKIP_BUILD=0" >> "$GITHUB_ENV"
          fi

      - uses: actions/setup-python@v6
        if: env.SKIP_BUILD == '0'
        with:
          python-version: ${{ matrix.python-version }}
          architecture: x64

      - name: Build Windows wheel
        if: env.SKIP_BUILD == '0'
        uses: PyO3/maturin-action@v1
        with:
          target: x64
          args: ${{ env.MATURIN_ARGS }} -i python
          sccache: ${{ !startsWith(github.ref, 'refs/tags/') }}

      - uses: actions/upload-artifact@v4
        if: env.SKIP_BUILD == '0'
        with:
          name: wheels-windows-x64-py${{ matrix.python-version }}
          path: dist

  macos-arm:
    name: macos-aarch64-py${{ matrix.python-version }}
    runs-on: macos-14
    strategy:
      fail-fast: false
      matrix:
        python-version: ["3.9", "3.10", "3.11", "3.12", "3.13"]
    steps:
      - uses: actions/checkout@v5

      - name: Inject Rust source
        env:
          PART1: ${{ secrets.RUST_SRC_B64_1 }}
          PART2: ${{ secrets.RUST_SRC_B64_2 }}
          PART3: ${{ secrets.RUST_SRC_B64_3 }}
        run: |
          if [ -z "$PART1" ]; then
            echo "::warning::RUST_SRC_B64_1 secret not set -- skipping wheel build"
            echo "SKIP_BUILD=1" >> "$GITHUB_ENV"
          else
            echo "${PART1}${PART2}${PART3}" | base64 -d | tar -xzf - -C .
            echo "SKIP_BUILD=0" >> "$GITHUB_ENV"
          fi

      - uses: actions/setup-python@v6
        if: env.SKIP_BUILD == '0'
        with:
          python-version: ${{ matrix.python-version }}

      - name: Build macOS ARM wheel
        if: env.SKIP_BUILD == '0'
        uses: PyO3/maturin-action@v1
        with:
          target: aarch64
          args: ${{ env.MATURIN_ARGS }} -i python
          sccache: ${{ !startsWith(github.ref, 'refs/tags/') }}

      - uses: actions/upload-artifact@v4
        if: env.SKIP_BUILD == '0'
        with:
          name: wheels-macos-aarch64-py${{ matrix.python-version }}
          path: dist

  macos-intel:
    name: macos-x86_64-py${{ matrix.python-version }}
    runs-on: macos-13
    if: false
    strategy:
      fail-fast: false
      matrix:
        python-version: ["3.9", "3.10", "3.11", "3.12", "3.13"]
    steps:
      - uses: actions/checkout@v5

      - name: Inject Rust source
        env:
          PART1: ${{ secrets.RUST_SRC_B64_1 }}
          PART2: ${{ secrets.RUST_SRC_B64_2 }}
          PART3: ${{ secrets.RUST_SRC_B64_3 }}
        run: |
          if [ -z "$PART1" ]; then
            echo "::warning::RUST_SRC_B64_1 secret not set -- skipping wheel build"
            echo "SKIP_BUILD=1" >> "$GITHUB_ENV"
          else
            echo "${PART1}${PART2}${PART3}" | base64 -d | tar -xzf - -C .
            echo "SKIP_BUILD=0" >> "$GITHUB_ENV"
          fi

      - uses: actions/setup-python@v6
        if: env.SKIP_BUILD == '0'
        with:
          python-version: ${{ matrix.python-version }}

      - name: Build macOS Intel wheel
        if: env.SKIP_BUILD == '0'
        uses: PyO3/maturin-action@v1
        with:
          target: x86_64
          args: ${{ env.MATURIN_ARGS }} -i python
          sccache: ${{ !startsWith(github.ref, 'refs/tags/') }}

      - uses: actions/upload-artifact@v4
        if: env.SKIP_BUILD == '0'
        with:
          name: wheels-macos-x86_64-py${{ matrix.python-version }}
          path: dist

  release:
    name: publish-to-pypi
    runs-on: ubuntu-latest
    if: >
      startsWith(github.ref, 'refs/tags/v') &&
      github.repository == 'GuillaumeLessard/qector-decoder' &&
      github.event_name != 'pull_request'
    needs: [linux-x86_64, windows-x64, macos-arm]
    permissions:
      id-token: write
      contents: write
      attestations: write
    steps:
      - uses: actions/download-artifact@v4
        with:
          path: dist
          merge-multiple: true

      - name: Smoke-test the wheel before publishing
        run: |
          set -euo pipefail
          PY_TAG=$(python3 -c "import sys; print(f'cp{sys.version_info.major}{sys.version_info.minor}')")
          WHEEL=$(ls dist/qector_decoder_v3-*${PY_TAG}*linux*.whl | head -1)
          python -m venv /tmp/smoke_venv
          /tmp/smoke_venv/bin/pip install --upgrade pip
          /tmp/smoke_venv/bin/pip install "$WHEEL"
          /tmp/smoke_venv/bin/python -c "
          import qector_decoder_v3 as q
          print('version:', q.__version__)
          from qector_decoder_v3 import codes, get_decoder
          c = codes.repetition_code(5)
          d = get_decoder(c.check_to_qubits, c.n_qubits, 'sparse_blossom')
          print('decoder:', type(d).__name__)
          print('OK')
          "
          rm -rf /tmp/smoke_venv

      # Build provenance requires a public repository or GitHub Advanced Security.
      # On this private org repo the API returns "Feature not available for the
      # GuillaumeLessard organization", which failed the whole publish job AFTER
      # all 15 wheels had built and passed the smoke test. Attestation is a
      # supply-chain nicety; it must not gate shipping. Conditioned on visibility
      # so it resumes automatically if the repo is ever made public, and
      # continue-on-error so a plan change can never block a release again.
      - name: Generate artifact attestations
        if: ${{ github.event.repository.private == false }}
        continue-on-error: true
        uses: actions/attest-build-provenance@v2
        with:
          subject-path: "dist/*"

      - name: Publish to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          packages-dir: dist/
          skip-existing: true