build-upload.yml

name: Build and upload to PyPI

on:
  push:
    tags:
      - '**'
    branches:
      - main
      - master
      - "temp/**"
  pull_request:

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

permissions: {}

jobs:
  prebuild:
    name: Lint & get SOURCE_DATE_EPOCH
    permissions:
      contents: read
    runs-on: ubuntu-slim
    outputs:
      SOURCE_DATE_EPOCH: ${{ steps.SOURCE_DATE_EPOCH.outputs.SOURCE_DATE_EPOCH }}
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - name: Set SOURCE_DATE_EPOCH output
        id: SOURCE_DATE_EPOCH
        run: echo "SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct)" >> "$GITHUB_OUTPUT"
      - name: Setup uv & nox
        uses: ./.github/actions/setup-uv-nox
      - run: nox -s lint

  build_wheels:
    name: ${{ matrix.build || matrix.platform }} ${{ matrix.archs }} wheels
    needs: [prebuild]
    permissions:
      contents: read
    runs-on: "${{ matrix.runs-on }}${{ startsWith(matrix.archs, 'aarch64') && '-arm' || '' }}"
    strategy:
      matrix:
        platform: ["linux"]
        archs: ["x86_64, i686", "aarch64, armv7l", "ppc64le", "s390x", "riscv64"]
        build: ["manylinux", "musllinux"]
        runs-on: [ubuntu-24.04]
        include:
          - platform: "windows"
            archs: "AMD64"
            runs-on: windows-2022
          - platform: "windows"
            archs: "x86"
            runs-on: windows-2022
          - platform: "windows"
            archs: "ARM64"
            runs-on: windows-11-arm
          - platform: "macos"
            archs: "x86_64"
            runs-on: macos-15-intel
          - platform: "macos"
            archs: "arm64"
            runs-on: macos-14
          - platform: "ios"
            archs: "x86_64_iphonesimulator"
            runs-on: macos-15-intel
          - platform: "ios"
            archs: "arm64_iphonesimulator,arm64_iphoneos"
            runs-on: macos-14
          - platform: "android"
            archs: "arm64_v8a,x86_64"
            runs-on: ubuntu-24.04
          - platform: "pyodide"
            archs: "wasm32"
            runs-on: ubuntu-24.04
    steps:
      - name: Clean Up runner
        if: runner.os == 'Linux' && runner.arch == 'X64'
        run: |
          df -h
          docker system prune -a -f
          sudo rm -rf \
            /opt/hostedtoolcache/CodeQL \
            /opt/hostedtoolcache/Java_Temurin-Hotspot_jdk \
            /opt/hostedtoolcache/PyPy \
            /opt/hostedtoolcache/Ruby \
            /opt/hostedtoolcache/go \
            /usr/local/share/chromium
          ls -al /opt/hostedtoolcache/
          find /opt/hostedtoolcache/Python -name '*.tgz' -delete
          df -h
      - name: Set git to use LF
        run: |
          git config --global core.autocrlf false
          git config --global core.eol lf
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          submodules: recursive
          persist-credentials: false
      - name: Install a pinned version of uv
        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
        with:
          enable-cache: ${{ !startsWith(github.ref, 'refs/tags/') }} # zizmor: ignore[cache-poisoning]
          version: "0.11.18"
      - name: Set up QEMU
        if: runner.os == 'Linux' && runner.arch == 'X64'
        uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
      # https://github.blog/changelog/2024-04-02-github-actions-hardware-accelerated-android-virtualization-now-available/
      - name: Enable KVM for Android emulator
        if: matrix.platform == 'android' && runner.os == 'Linux' && runner.arch == 'X64'
        run: |
          echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' | sudo tee /etc/udev/rules.d/99-kvm4all.rules
          sudo udevadm control --reload-rules
          sudo udevadm trigger --name-match=kvm
      - name: Build wheels
        uses: pypa/cibuildwheel@294735312765b09d24a2fbec22660ce817587d55 # v4.1.0
        env:
          CIBW_ARCHS: "${{ matrix.archs }}"
          CIBW_BUILD: "${{ matrix.build && '*-' || ''}}${{ matrix.build }}*"
          CIBW_ENABLE: "${{ (!startsWith(github.ref, 'refs/tags/v')) && 'cpython-prerelease' || '' }}"
          CIBW_PLATFORM: "${{ matrix.platform }}"
          SOURCE_DATE_EPOCH: "${{ needs.prebuild.outputs.SOURCE_DATE_EPOCH }}"
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: "pypi-wheels ${{ matrix.build || matrix.platform }} ${{ matrix.archs }}"
          path: ./wheelhouse/*.whl

  build_sdist:
    name: source distribution
    needs: [prebuild]
    permissions:
      contents: read
    runs-on: ubuntu-24.04
    env:
      CIBUILDWHEEL: 1  # make C extension mandatory
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          submodules: recursive
          persist-credentials: false
      - name: Install a pinned version of uv
        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
        with:
          enable-cache: ${{ !startsWith(github.ref, 'refs/tags/') }} # zizmor: ignore[cache-poisoning]
          python-version: "3.12"
          version: "0.11.18"
      - name: Build sdist
        run: uv build --build-constraints requirements/build-system/requirements-ci.txt --require-hashes --sdist
        env:
          SOURCE_DATE_EPOCH: "${{ needs.prebuild.outputs.SOURCE_DATE_EPOCH }}"
      - name: Install
        run: uv venv && uv pip install --build-constraints requirements/build-system/requirements-ci.txt ./dist/pybase64*.tar.gz
      - name: Test
        run: uv run --frozen --only-group test pytest
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: pypi-sdist
          path: dist/*.tar.gz

  check_dist:
    if: always()
    name: Check dist
    needs: [build_wheels, build_sdist]
    permissions:
      contents: read
    runs-on: ubuntu-24.04
    steps:
      - name: Decide whether the needed jobs succeeded or failed
        uses: re-actors/alls-green@05ac9388f0aebcb5727afa17fcccfecd6f8ec5fe # v1.2.2
        with:
          jobs: ${{ toJSON(needs) }}
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          # unpacks all PyPI artifacts into dist/
          pattern: pypi-*
          path: dist
          merge-multiple: true
      - name: Install the latest version of uv
        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
        with:
          enable-cache: false  # we always want to run the latest twine here, no artifacts are uploaded from this job
          python-version: "3.12"
      - run: |
          set -x
          WHEEL_COUNT=$(find dist -name '*.whl' | wc -l)
          EXPECTED_WHEEL_COUNT=${{ startsWith(github.ref, 'refs/tags/v') && '168' || '211' }}
          test ${WHEEL_COUNT} -eq ${EXPECTED_WHEEL_COUNT}
          uvx twine check --strict dist/*

  upload_test_pypi:
    name: Upload to Test PyPI
    needs: [check_dist]
    runs-on: ubuntu-24.04
    if: github.event_name == 'push' && github.repository == 'mayeut/pybase64'
    environment:
      name: test-pypi
      url: https://test.pypi.org/p/pybase64
    permissions:
      id-token: write # trusted publishing + attestations
    steps:
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          # unpacks all PyPI artifacts into dist/
          pattern: pypi-*
          path: dist
          merge-multiple: true
      - name: Upload to Test PyPI
        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
        with:
          skip-existing: true
          repository-url: https://test.pypi.org/legacy/

  upload_pypi:
    name: Upload to PyPI
    needs: [upload_test_pypi]
    runs-on: ubuntu-24.04
    if: github.event_name == 'push' && github.repository == 'mayeut/pybase64' && startsWith(github.ref, 'refs/tags/v')
    environment:
      name: pypi
      url: https://pypi.org/p/pybase64
    permissions:
      id-token: write # trusted publishing + attestations
    steps:
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          # unpacks all PyPI artifacts into dist/
          pattern: pypi-*
          path: dist
          merge-multiple: true
      - name: Upload to PyPI
        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
        with:
          skip-existing: true