CI.yml

name: CI

on:
  push:
    tags:
      - "v*"
  workflow_dispatch:

permissions:
  contents: read

env:
  CARGO_TERM_COLOR: always

jobs:
  quality:
    name: Quality Checks
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: recursive
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
      - uses: astral-sh/setup-uv@v5
      - uses: dtolnay/rust-toolchain@stable
      - name: Install dev dependencies
        run: uv sync --group dev --no-install-project
      - name: Ruff lint
        run: uv run --no-project --with ruff==0.11.4 ruff check .
      - name: Ruff format check
        run: uv run --no-project --with ruff==0.11.4 ruff format --check .
      - name: Validate stub parity
        run: uv run python scripts/check_stub_parity.py

  linux:
    name: Linux manylinux wheels
    needs: quality
    runs-on: ${{ matrix.platform.runner }}
    strategy:
      fail-fast: false
      matrix:
        platform:
          - runner: ubuntu-22.04
            target: x86_64
          - runner: ubuntu-22.04
            target: aarch64
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: recursive
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
      - name: Workaround ring ARM asm macro in cross builds
        if: matrix.platform.target == 'aarch64'
        run: echo "CFLAGS_aarch64_unknown_linux_gnu=-D__ARM_ARCH=8" >> "$GITHUB_ENV"
      - uses: dtolnay/rust-toolchain@stable
      - name: Build wheels
        uses: PyO3/maturin-action@v1
        with:
          target: ${{ matrix.platform.target }}
          args: --release --out dist --find-interpreter
          sccache: ${{ !startsWith(github.ref, 'refs/tags/') && matrix.platform.target != 'aarch64' }}
          manylinux: auto
      - name: Upload wheels
        uses: actions/upload-artifact@v4
        with:
          name: wheels-linux-${{ matrix.platform.target }}
          path: dist

  windows:
    name: Windows wheels
    needs: quality
    runs-on: ${{ matrix.platform.runner }}
    strategy:
      fail-fast: false
      matrix:
        platform:
          - runner: windows-latest
            target: x64
            python_arch: x64
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: recursive
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
          architecture: ${{ matrix.platform.python_arch }}
      - uses: dtolnay/rust-toolchain@stable
      - name: Build wheels
        uses: PyO3/maturin-action@v1
        with:
          target: ${{ matrix.platform.target }}
          args: --release --out dist --find-interpreter
          sccache: ${{ !startsWith(github.ref, 'refs/tags/') }}
      - name: Upload wheels
        uses: actions/upload-artifact@v4
        with:
          name: wheels-windows-${{ matrix.platform.target }}
          path: dist

  macos:
    name: macOS wheels
    needs: quality
    runs-on: ${{ matrix.platform.runner }}
    strategy:
      fail-fast: false
      matrix:
        platform:
          - runner: macos-15-intel
            target: x86_64
          - runner: macos-latest
            target: aarch64
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: recursive
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
      - uses: dtolnay/rust-toolchain@stable
      - name: Build wheels
        uses: PyO3/maturin-action@v1
        with:
          target: ${{ matrix.platform.target }}
          args: --release --out dist --find-interpreter
          sccache: ${{ !startsWith(github.ref, 'refs/tags/') }}
      - name: Upload wheels
        uses: actions/upload-artifact@v4
        with:
          name: wheels-macos-${{ matrix.platform.target }}
          path: dist

  sdist:
    name: Source distribution
    needs: quality
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: recursive
      - uses: dtolnay/rust-toolchain@stable
      - name: Build sdist
        uses: PyO3/maturin-action@v1
        with:
          command: sdist
          args: --out dist
      - name: Upload sdist
        uses: actions/upload-artifact@v4
        with:
          name: wheels-sdist
          path: dist

  release:
    name: Publish to PyPI
    if: ${{ startsWith(github.ref, 'refs/tags/v') }}
    needs: [linux, windows, macos, sdist]
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
    steps:
      - name: Log release context
        run: |
          echo "event=${GITHUB_EVENT_NAME}"
          echo "ref=${GITHUB_REF}"
          echo "sha=${GITHUB_SHA}"

      - name: Download wheel artifacts
        uses: actions/download-artifact@v4
        with:
          pattern: wheels-*
          merge-multiple: true
          path: dist

      - name: Ensure PyPI token exists
        env:
          UV_PUBLISH_TOKEN: ${{ secrets.PYPI_API_TOKEN }}
        run: |
          if [ -z "${UV_PUBLISH_TOKEN}" ]; then
            echo "::error::Missing PYPI_API_TOKEN secret."
            exit 1
          fi

      - name: Validate release artifacts
        run: |
          set -euo pipefail
          shopt -s nullglob
          files=(dist/*)
          if [ ${#files[@]} -eq 0 ]; then
            echo "::error::No artifacts found in dist/."
            exit 1
          fi
          printf '%s\n' "${files[@]}"

      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - uses: astral-sh/setup-uv@v5

      - name: Publish artifacts
        run: uv publish dist/*
        env:
          UV_PUBLISH_TOKEN: ${{ secrets.PYPI_API_TOKEN }}