CI.yml

name: CI

on:
  push:
    tags:
      - "v*"
  pull_request:
  workflow_dispatch:

permissions:
  contents: read

env:
  CARGO_TERM_COLOR: always

jobs:
  quality:
    name: Quality Checks
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: recursive
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
      - uses: astral-sh/setup-uv@v5
      - name: Install dev dependencies
        run: uv sync --group dev --no-install-project
      - name: Ruff lint
        run: uv run --no-project --with ruff==0.11.4 ruff check .
      - name: Ruff format check
        run: uv run --no-project --with ruff==0.11.4 ruff format --check .
      - name: Validate stub parity
        run: uv run python scripts/check_stub_parity.py

  # linux:
  #   name: Linux manylinux wheels
  #   needs: quality
  #   runs-on: ${{ matrix.platform.runner }}
  #   strategy:
  #     fail-fast: false
  #     matrix:
  #       platform:
  #         - runner: ubuntu-22.04
  #           target: x86_64
  #         - runner: ubuntu-22.04
  #           target: x86
  #         - runner: ubuntu-22.04
  #           target: aarch64
  #         - runner: ubuntu-22.04
  #           target: armv7
  #   steps:
  #     - uses: actions/checkout@v4
  #       with:
  #         submodules: recursive
  #     - uses: actions/setup-python@v5
  #       with:
  #         python-version: "3.12"
  #     - name: Workaround ring ARM asm macro in cross builds
  #       if: matrix.platform.target == 'aarch64' || matrix.platform.target == 'armv7'
  #       run: |
  #         if [ "${{ matrix.platform.target }}" = "aarch64" ]; then
  #           echo "CFLAGS_aarch64_unknown_linux_gnu=-D__ARM_ARCH=8" >> "$GITHUB_ENV"
  #         else
  #           echo "CFLAGS_armv7_unknown_linux_gnueabihf=-D__ARM_ARCH=7" >> "$GITHUB_ENV"
  #         fi
  #     - name: Build wheels
  #       uses: PyO3/maturin-action@v1
  #       with:
  #         target: ${{ matrix.platform.target }}
  #         args: --release --out dist --find-interpreter
  #         sccache: ${{ !startsWith(github.ref, 'refs/tags/') && matrix.platform.target != 'aarch64' && matrix.platform.target != 'armv7' }}
  #         manylinux: auto
  #     - name: Upload wheels
  #       uses: actions/upload-artifact@v4
  #       with:
  #         name: wheels-linux-${{ matrix.platform.target }}
  #         path: dist

  musllinux:
    name: Linux musllinux wheels
    needs: quality
    runs-on: ${{ matrix.platform.runner }}
    strategy:
      fail-fast: false
      matrix:
        platform:
          - runner: ubuntu-22.04
            target: x86_64
          # - runner: ubuntu-22.04
          #   target: x86
          # - runner: ubuntu-22.04
          #   target: aarch64
          # - runner: ubuntu-22.04
          #   target: armv7
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: recursive
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
      - name: Workaround ring ARM asm macro in cross builds
        if: matrix.platform.target == 'aarch64' || matrix.platform.target == 'armv7'
        run: |
          if [ "${{ matrix.platform.target }}" = "aarch64" ]; then
            echo "CFLAGS_aarch64_unknown_linux_musl=-D__ARM_ARCH=8" >> "$GITHUB_ENV"
          else
            echo "CFLAGS_armv7_unknown_linux_musleabihf=-D__ARM_ARCH=7" >> "$GITHUB_ENV"
          fi
      - name: Build wheels
        uses: PyO3/maturin-action@v1
        with:
          target: ${{ matrix.platform.target }}
          args: --release --out dist --find-interpreter
          sccache: ${{ !startsWith(github.ref, 'refs/tags/') && matrix.platform.target != 'aarch64' && matrix.platform.target != 'armv7' }}
          manylinux: musllinux_1_2
      - name: Upload wheels
        uses: actions/upload-artifact@v4
        with:
          name: wheels-musllinux-${{ matrix.platform.target }}
          path: dist

  # windows:
  #   name: Windows wheels
  #   needs: quality
  #   runs-on: ${{ matrix.platform.runner }}
  #   strategy:
  #     fail-fast: false
  #     matrix:
  #       platform:
  #         - runner: windows-latest
  #           target: x64
  #           python_arch: x64
  #         - runner: windows-latest
  #           target: x86
  #           python_arch: x86
  #         - runner: windows-11-arm
  #           target: aarch64
  #           python_arch: arm64
  #   steps:
  #     - uses: actions/checkout@v4
  #       with:
  #         submodules: recursive
  #     - uses: actions/setup-python@v5
  #       with:
  #         python-version: "3.12"
  #         architecture: ${{ matrix.platform.python_arch }}
  #     - name: Build wheels
  #       uses: PyO3/maturin-action@v1
  #       with:
  #         target: ${{ matrix.platform.target }}
  #         args: --release --out dist --find-interpreter
  #         sccache: ${{ !startsWith(github.ref, 'refs/tags/') }}
  #     - name: Upload wheels
  #       uses: actions/upload-artifact@v4
  #       with:
  #         name: wheels-windows-${{ matrix.platform.target }}
  #         path: dist

  # macos:
  #   name: macOS wheels
  #   needs: quality
  #   runs-on: ${{ matrix.platform.runner }}
  #   strategy:
  #     fail-fast: false
  #     matrix:
  #       platform:
  #         - runner: macos-15-intel
  #           target: x86_64
  #         - runner: macos-latest
  #           target: aarch64
  #   steps:
  #     - uses: actions/checkout@v4
  #       with:
  #         submodules: recursive
  #     - uses: actions/setup-python@v5
  #       with:
  #         python-version: "3.12"
  #     - name: Build wheels
  #       uses: PyO3/maturin-action@v1
  #       with:
  #         target: ${{ matrix.platform.target }}
  #         args: --release --out dist --find-interpreter
  #         sccache: ${{ !startsWith(github.ref, 'refs/tags/') }}
  #     - name: Upload wheels
  #       uses: actions/upload-artifact@v4
  #       with:
  #         name: wheels-macos-${{ matrix.platform.target }}
  #         path: dist

  sdist:
    name: Source distribution
    needs: quality
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: recursive
      - name: Build sdist
        uses: PyO3/maturin-action@v1
        with:
          command: sdist
          args: --out dist
      - name: Upload sdist
        uses: actions/upload-artifact@v4
        with:
          name: wheels-sdist
          path: dist

  release:
    name: Publish to PyPI
    if: ${{ startsWith(github.ref, 'refs/tags/v') }}
    needs: [musllinux, sdist]
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
    steps:
      - name: Log release context
        run: |
          echo "event=${GITHUB_EVENT_NAME}"
          echo "ref=${GITHUB_REF}"
          echo "sha=${GITHUB_SHA}"

      - name: Download wheel artifacts
        uses: actions/download-artifact@v4
        with:
          pattern: wheels-*
          merge-multiple: true
          path: dist

      - name: Ensure PyPI token exists
        env:
          UV_PUBLISH_TOKEN: ${{ secrets.PYPI_API_TOKEN }}
        run: |
          if [ -z "${UV_PUBLISH_TOKEN}" ]; then
            echo "::error::Missing PYPI_API_TOKEN secret."
            exit 1
          fi

      - name: Validate release artifacts
        run: |
          set -euo pipefail
          shopt -s nullglob
          files=(dist/*)
          if [ ${#files[@]} -eq 0 ]; then
            echo "::error::No artifacts found in dist/."
            exit 1
          fi
          printf '%s\n' "${files[@]}"

      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - uses: astral-sh/setup-uv@v5

      - name: Publish artifacts
        run: uv publish dist/*
        env:
          UV_PUBLISH_TOKEN: ${{ secrets.PYPI_API_TOKEN }}