build(packaging): switch wheel build to maturin, ship Rust binary alongside Python source

Replaces hatchling with maturin so the Python wheel ships *both* the
existing `mergify_cli/` package and the new Rust binary as a
`bindings = "bin"` console-script. The two installs side-by-side in
the same venv layout pip already produces:

    <venv>/bin/mergify              # Rust binary (this commit's
                                    # entry point)
    <venv>/bin/python3              # interpreter pip set up
    <venv>/lib/.../site-packages/   # Python source + deps

The shim no longer has to embed the Python source or bootstrap a
Python interpreter — pip already installed both alongside the
binary. `mergify-py-shim` shrinks from ~250 lines (include_dir +
atomic file-locked extraction + cache management) to ~130 lines:
locate the sibling `python3`, exec `python3 -m mergify_cli`, return
the exit code. Drops `dirs`, `fs2`, `include_dir` deps.

A new `MERGIFY_PYTHON_EXE` env var lets `cargo build` developers
point at any Python interpreter that has the package on `sys.path`;
the no-sibling-python failure mode now produces a targeted
`PythonNotFound` with the exact path it tried.

This unlocks the "delete the Python copy when porting to Rust" rule:
each future port PR removes its Python implementation in the same
change, so there's never two parallel copies of the same command.
Drift goes from "watch for it" to "structurally impossible" — no
compat-test snapshot maintenance, no flag-by-flag mirroring.

Phase 6 (curl-installable static binary, no Python at all) drops
this crate entirely.

Trade-offs:
- Wheels are now platform-tagged (per maturin `bindings = "bin"`).
  The release workflow must build a per-platform matrix; the
  existing `uv build` single-platform path will need an update
  before the next PyPI publish (separate PR).
- Version handling: `dynamic = ["version"]` flows from
  `crates/mergify-cli/Cargo.toml`'s `[package] version` instead of
  hatch-vcs reading git tags. Release tooling must bump the Cargo
  version to match the tag (also addressed in the release-workflow
  follow-up).

Verified locally: `uvx maturin build --release` produces
`target/wheels/mergify_cli-*-macosx_*.whl`. Installing into a fresh
`uv venv` lands `mergify` at `<venv>/bin/mergify` (Mach-O arm64) and
the Python source under `site-packages/mergify_cli/`. Both
`mergify --help` (shimmed → Python click help) and `mergify config
validate` (native → Rust impl) work.

Change-Id: I8f6aa397e8736aa9313c033e19e5244c34038512

Author: jd

.github/workflows/ci.yaml

@@ -17,6 +17,14 @@ jobs:
         with:
           python-version: 3.14
 
+      # The maturin build-backend invokes cargo at sync time, so
+      # every Python-using job needs the Rust toolchain on PATH.
+      - name: Install Rust toolchain
+        run: |
+          rustup toolchain install stable --profile minimal
+          rustup default stable
+      - uses: Swatinem/rust-cache@v2
+
       - uses: astral-sh/setup-uv@v8.1.0
         with:
           enable-cache: true
@@ -35,6 +43,12 @@ jobs:
         with:
           python-version: 3.14
 
+      - name: Install Rust toolchain
+        run: |
+          rustup toolchain install stable --profile minimal
+          rustup default stable
+      - uses: Swatinem/rust-cache@v2
+
       - uses: astral-sh/setup-uv@v8.1.0
         with:
           enable-cache: true
@@ -71,7 +85,7 @@ jobs:
         run: cargo build --release
 
   test:
-    timeout-minutes: 10
+    timeout-minutes: 15
     strategy:
       matrix:
         os: [ubuntu-24.04, windows-2025, macos-15]
@@ -83,6 +97,17 @@ jobs:
         with:
           python-version: ${{ matrix.python }}
 
+      - name: Install Rust toolchain
+        run: |
+          rustup toolchain install stable --profile minimal
+          rustup default stable
+      - uses: Swatinem/rust-cache@v2
+        with:
+          # The matrix runs the same target six times. Keying the
+          # cache on (os, python) avoids cross-pollution while still
+          # letting cargo reuse fetched crates within each shard.
+          key: ${{ matrix.os }}-py${{ matrix.python }}
+
       - uses: astral-sh/setup-uv@v8.1.0
         with:
           enable-cache: true

.github/workflows/release.yml

@@ -1,17 +1,38 @@
 name: upload release to PyPI
+
+# Builds platform-tagged wheels (one per supported target) plus an
+# sdist, then publishes everything to PyPI in a single
+# Trusted-Publisher upload. The wheel version is stamped from the
+# git tag (`$GITHUB_REF`) so the existing tag-driven release UX
+# stays the same as the pre-port hatch-vcs flow.
+#
+# Targets: Linux x64/arm64 (manylinux), macOS x64/arm64,
+# Windows x64. Add new targets here when a new platform is on the
+# support matrix.
+
 on:
   release:
     types:
       - published
 
 jobs:
-  pypi-publish:
-    name: upload release to PyPI
-    runs-on: ubuntu-latest
-    environment: release
-    permissions:
-      id-token: write
-      contents: write
+  build-wheels:
+    name: build wheel (${{ matrix.target }})
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-24.04
+            target: x86_64-unknown-linux-gnu
+          - os: ubuntu-24.04
+            target: aarch64-unknown-linux-gnu
+          - os: macos-15
+            target: x86_64-apple-darwin
+          - os: macos-15
+            target: aarch64-apple-darwin
+          - os: windows-2025
+            target: x86_64-pc-windows-msvc
+    runs-on: ${{ matrix.os }}
     steps:
       - uses: actions/checkout@v6.0.2
         with:
@@ -22,13 +43,84 @@ jobs:
         with:
           python-version: 3.14
 
-      - uses: astral-sh/setup-uv@v8.1.0
+      - name: Stamp wheel version from git tag
+        shell: bash
+        run: |
+          set -eu
+          VERSION="${GITHUB_REF#refs/tags/}"
+          # `sed -i.bak`/rm form works on both BSD (macOS) and GNU
+          # (Linux) sed without divergent flag handling. On Windows
+          # the runner ships GNU sed via Git Bash, which honours the
+          # same syntax.
+          sed -i.bak -E "s/^version = \".*\"$/version = \"${VERSION}\"/" pyproject.toml
+          rm -f pyproject.toml.bak
+          echo "Stamped pyproject.toml:"
+          grep '^version = ' pyproject.toml
+
+      - name: Build wheel
+        uses: PyO3/maturin-action@v1
+        with:
+          target: ${{ matrix.target }}
+          # `manylinux: auto` picks the most-compatible glibc the
+          # target supports; `--strip` shaves debug symbols off the
+          # bundled binary.
+          args: --release --strip --out target/wheels
+          manylinux: auto
+          sccache: true
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: wheel-${{ matrix.target }}
+          path: target/wheels/*.whl
+
+  build-sdist:
+    name: build sdist
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v6.0.2
+        with:
+          fetch-depth: 0
+          fetch-tags: true
+
+      - name: Stamp wheel version from git tag
+        shell: bash
+        run: |
+          set -eu
+          VERSION="${GITHUB_REF#refs/tags/}"
+          sed -i.bak -E "s/^version = \".*\"$/version = \"${VERSION}\"/" pyproject.toml
+          rm -f pyproject.toml.bak
+
+      - uses: PyO3/maturin-action@v1
+        with:
+          command: sdist
+          args: --out target/wheels
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: wheel-sdist
+          path: target/wheels/*.tar.gz
+
+  publish:
+    name: publish to PyPI
+    runs-on: ubuntu-24.04
+    needs:
+      - build-wheels
+      - build-sdist
+    environment: release
+    permissions:
+      id-token: write
+      contents: write
+    steps:
+      - uses: actions/download-artifact@v4
         with:
-          enable-cache: true
-          version-file: requirements-uv.txt
+          pattern: wheel-*
+          merge-multiple: true
+          path: dist
 
-      - name: 
-        run: uv build
+      - name: Confirm collected artifacts
+        run: ls -la dist
 
       - name: Publish package distributions to PyPI
         uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          packages-dir: dist

Cargo.lock

@@ -10,13 +10,10 @@ description = "Embedded Python fallback for un-ported mergify-cli commands."
 publish = false
 
 [dependencies]
-dirs = "6.0"
-fs2 = "0.4"
-include_dir = "0.7"
 thiserror = "2.0"
 
 [dev-dependencies]
-tempfile = "3.14"
+temp-env = "0.3"
 
 [lints]
 workspace = true