khisto-python/.github/workflows/pack-pip.yaml at main · KhiopsML/khisto-python · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
name: pip packaging

on:
  workflow_dispatch:
    inputs:
      python_repository:
        description: python repository
        type: choice
        default: None  # no publishing to any Package Index by default
        options: [None, testpypi, pypi]
      signature-activation:
        type: boolean
        default: false
        description: Sign khisto binary
  push:
    tags: ['*']
  pull_request:
    paths:
      - .github/workflows/pack-pip.yaml
      - pyproject.toml
      - CMakeLists.txt

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

defaults:
  run:
    shell: bash
env:
  KEYPAIR: KP_Khiops_HSM

jobs:
  build-wheel:
    name: Build wheel
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        os: [ubuntu-24.04, ubuntu-24.04-arm, windows-2025-vs2026, windows-11-vs2026-arm, macos-15-intel, macos-15]
    env:
      SIGN_WINDOWS_WHEELS: ${{ github.event_name == 'workflow_dispatch' && inputs.signature-activation }}
    steps:
      - uses: actions/checkout@v6

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.13'

      - name: Set up UV
        uses: astral-sh/setup-uv@v6
        with:
          enable-cache: true

      - name: Load Visual C++ Environment Variables (Windows)
        if: runner.os == 'Windows'
        shell: cmd
        run: |
          call "C:\\Program Files\\Microsoft Visual Studio\\18\\Enterprise\\VC\\Auxiliary\\Build\\vcvars64.bat"
          set >> %GITHUB_ENV%

      - name: Build wheels
        uses: pypa/cibuildwheel@v3.3.1

      - name: Test built wheel
        run: |
          uv venv .test-env
          uv pip install --python .test-env --find-links=wheelhouse "khisto[all]"
          uv sync --python .test-env --group dev --no-install-project
          uv run --python .test-env pytest tests/ --no-cov

      # Windows wheels are unpackad, signed and repacked before uploading
      - name: Set SIGN_X64_WHEEL flag
        if: runner.os == 'Windows' && runner.arch == 'X64'
        run: echo "SIGN_X64_WHEEL=${{ env.SIGN_WINDOWS_WHEELS }}" >> "$GITHUB_ENV"
      - name: Warn smctl does not support ARM64 yet
        if: runner.os == 'Windows' && runner.arch == 'ARM64' && env.SIGN_WINDOWS_WHEELS == 'true'
        run: echo "::warning::smctl does not support ARM64 yet; the ARM64 wheel will not be signed"
      - name: Install wheel package for signing
        if: env.SIGN_X64_WHEEL == 'true'
        run: python -m pip install wheel
      - name: Unpack khisto wheel
        if: env.SIGN_X64_WHEEL == 'true'
        run: |
          mkdir -p wheelhouse/unpacked
          python -m wheel unpack wheelhouse/khisto-*.whl --dest wheelhouse/unpacked
      - name: Setup SM_CLIENT_CERT_FILE from base64 secret data
        if: env.SIGN_X64_WHEEL == 'true'
        run: |
          echo "SM_CLIENT_CERT_FILE=D:\\Certificate_pkcs12.p12" >> "$GITHUB_ENV"
          echo "${{ secrets.SM_CLIENT_CERT_FILE_B64 }}" | base64 --decode > /d/Certificate_pkcs12.p12
      - name: Sign unpacked wheel binaries
        if: env.SIGN_X64_WHEEL == 'true'
        uses: digicert/code-signing-software-trust-action@v1.2.1
        with:
          input: wheelhouse/unpacked/
          keypair-alias: ${{ env.KEYPAIR }}
          simple-signing-mode: true
        env:
          SM_HOST: ${{ secrets.SM_HOST }}
          SM_API_KEY: ${{ secrets.SM_API_KEY }}
          SM_CLIENT_CERT_PASSWORD: ${{ secrets.SM_CLIENT_CERT_PASSWORD }}
      - name: Repack signed wheels
        if: env.SIGN_X64_WHEEL == 'true'
        run: |
          rm wheelhouse/khisto-*.whl
          python -m wheel pack wheelhouse/unpacked/khisto-* --dest-dir wheelhouse
      - uses: actions/upload-artifact@v7
        with:
          name: pkg-wheel-${{ matrix.os }}
          path: wheelhouse/*.whl
          if-no-files-found: error

  release-testpypi:
    # Publish only on tag pushes in the KhiopsML repository
    if: github.ref_type == 'tag' && github.repository_owner == 'KhiopsML' && inputs.python_repository == 'testpypi'
    name: Publish to Test.PyPI.org
    needs: [build-wheel]
    runs-on: ubuntu-latest
    permissions:
      id-token: write
    environment:
      name: testpypi
    steps:
      - uses: actions/download-artifact@v7
        with:
          pattern: pkg-*
          path: dist
          merge-multiple: true
      - uses: pypa/gh-action-pypi-publish@release/v1
        with:
          verbose: true
          repository-url: https://test.pypi.org/legacy/

  release-pypi:
    # Publish only on tag pushes in the KhiopsML repository
    name: Publish to PyPI.org
    if: github.ref_type == 'tag' && github.repository_owner == 'KhiopsML' && inputs.python_repository == 'pypi'
    needs: [build-wheel]
    runs-on: ubuntu-latest
    permissions:
      id-token: write
    environment:
      name: pypi
    steps:
      - uses: actions/download-artifact@v7
        with:
          pattern: pkg-*
          path: dist
          merge-multiple: true
      - uses: pypa/gh-action-pypi-publish@release/v1
        with:
          verbose: true