cd.yml

# .github/workflows/cd.yml
name: diffctx CD

permissions: {}

concurrency:
  group: release
  cancel-in-progress: false

'on':
  workflow_dispatch:
    inputs:
      version:
        description: 'Version to release (e.g., 1.6.1)'
        required: true
      publish_to_pypi:
        description: 'Publish to PyPI'
        required: true
        default: 'false'
        type: choice
        options:
          - 'true'
          - 'false'

jobs:
  prepare-version:
    name: Prepare Version Commit
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.set_outputs.outputs.version }}
      tag_name: ${{ steps.set_outputs.outputs.tag_name }}
      commit_sha: ${{ steps.commit_version.outputs.commit_sha }}
    steps:
      - name: Checkout Code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        with:
          fetch-depth: 0

      - name: Set up Python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
        with:
          python-version: '3.12'

      - name: Check that we're on main branch
        env:
          CURRENT_BRANCH: ${{ github.ref_name }}
        run: |
          if [ "$CURRENT_BRANCH" != "main" ]; then
            echo "Error: Releases can only be created from the main branch. Current branch: $CURRENT_BRANCH"
            exit 1
          fi

      - name: Validate version format (PEP 440)
        env:
          VERSION: ${{ github.event.inputs.version }}
        run: |
          if ! [[ "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+((a|b|rc)[0-9]+)?(\.dev[0-9]+)?(\.post[0-9]+)?$ ]]; then
            echo "Error: Invalid version format '$VERSION'."
            echo "Expected PEP 440: 1.0.0, 1.0.0a1, 1.0.0b1, 1.0.0rc1, 1.0.0.dev1, 1.0.0.post1"
            exit 1
          fi
          echo "Version format valid (PEP 440): $VERSION"

      - name: Check version is not already set
        env:
          VERSION: ${{ github.event.inputs.version }}
        run: |
          CURRENT=$(python - <<'PY'
          import re
          content = open('src/diffctx/version.py').read()
          m = re.search(r'__version__\s*=\s*["\']([^"\']+)["\']', content)
          print(m.group(1) if m else '')
          PY
          )
          if [ "$CURRENT" = "$VERSION" ]; then
            echo "Error: version.py already contains version $VERSION. Nothing to release."
            exit 1
          fi
          echo "Current version: $CURRENT -> New version: $VERSION"

      - name: Set version in version.py and pyproject.toml
        env:
          VERSION: ${{ github.event.inputs.version }}
        run: |
          echo "Setting version to $VERSION"
          python - <<'PY'
          import os, re, pathlib
          ver = os.environ["VERSION"]

          p = pathlib.Path("src/diffctx/version.py")
          s = p.read_text(encoding="utf-8")
          s, n = re.subn(r'__version__\s*=\s*["\'].*?["\']', f'__version__ = "{ver}"', s, count=1)
          assert n == 1, "version.py: __version__ assignment not found"
          p.write_text(s, encoding="utf-8")

          py = pathlib.Path("pyproject.toml")
          s = py.read_text(encoding="utf-8")
          s, n = re.subn(r'(?m)^version\s*=\s*["\'][^"\']+["\']', f'version = "{ver}"', s, count=1)
          assert n == 1, "pyproject.toml: [project].version not found"
          py.write_text(s, encoding="utf-8")
          PY
          echo "version.py:"
          cat src/diffctx/version.py
          echo "pyproject.toml (version line):"
          grep -E '^version\s*=' pyproject.toml

      - name: Commit version bump (locally only, no push yet)
        id: commit_version
        env:
          VERSION: ${{ github.event.inputs.version }}
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git add src/diffctx/version.py pyproject.toml
          if ! git diff --staged --quiet; then
            git commit -m "Release version ${VERSION}"
          else
            echo "No changes to commit."
          fi
          COMMIT_SHA=$(git rev-parse HEAD)
          echo "Commit SHA: $COMMIT_SHA"
          echo "commit_sha=$COMMIT_SHA" >> "$GITHUB_OUTPUT"

      - name: Check tag doesn't already exist
        env:
          VERSION: ${{ github.event.inputs.version }}
        run: |
          TAG="v${VERSION}"
          git fetch --tags origin 2>/dev/null || true
          if git rev-parse "$TAG" >/dev/null 2>&1; then
            echo "Error: Tag $TAG already exists locally"
            exit 1
          fi
          if git ls-remote --tags origin | grep -q "refs/tags/$TAG$"; then
            echo "Error: Tag $TAG already exists on remote"
            exit 1
          fi
          echo "Tag $TAG does not exist, proceeding..."

      - name: Create local tag (no push yet)
        env:
          VERSION: ${{ github.event.inputs.version }}
        run: |
          git tag -a "v${VERSION}" -m "Release version ${VERSION}"
          echo "Tag created locally: v${VERSION}"

      - name: Create git bundle
        run: git bundle create repo.bundle --all

      - name: Upload bundle as artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
        with:
          name: git-repo-bundle
          path: repo.bundle
          retention-days: 1

      - name: Set outputs
        id: set_outputs
        env:
          VERSION: ${{ github.event.inputs.version }}
        run: |
          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
          echo "tag_name=v${VERSION}" >> "$GITHUB_OUTPUT"

  build-wheels:
    name: Build wheel (${{ matrix.target }})
    needs: prepare-version
    strategy:
      fail-fast: false
      matrix:
        include:
          - runner: ubuntu-latest
            target: x86_64-unknown-linux-gnu
            maturin_target: x86_64
            manylinux: '2_28'
          - runner: ubuntu-22.04-arm
            target: aarch64-unknown-linux-gnu
            maturin_target: aarch64
            manylinux: '2_28'
          # NOTE: macos-13 (Intel) runner pool has multi-hour queue times on
          # public projects. Apple Silicon (macos-14) wheel covers all modern
          # Macs; Intel-Mac users can fall back to the sdist or Rosetta.
          - runner: macos-14
            target: aarch64-apple-darwin
            maturin_target: aarch64
            manylinux: 'off'
          - runner: windows-latest
            target: x86_64-pc-windows-msvc
            maturin_target: x64
            manylinux: 'off'
    runs-on: ${{ matrix.runner }}
    steps:
      - name: Download git bundle
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
        with:
          name: git-repo-bundle

      - name: Restore repository from bundle
        shell: bash
        env:
          TAG_NAME: ${{ needs.prepare-version.outputs.tag_name }}
        run: |
          git clone repo.bundle repo
          cd repo
          git checkout "$TAG_NAME"
          cat src/diffctx/version.py
          grep -E '^version\s*=' pyproject.toml

      - name: Set up Python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
        with:
          python-version: '3.12'

      - name: Build wheel via maturin
        uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b  # v1.51.0
        with:
          working-directory: ./repo
          target: ${{ matrix.maturin_target }}
          manylinux: ${{ matrix.manylinux }}
          args: --release --out dist
          rust-toolchain: '1.92.0'

      - name: List built wheel
        shell: bash
        run: ls -la ./repo/dist/

      - name: Upload wheel artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
        with:
          name: wheel-${{ matrix.target }}
          path: ./repo/dist/*.whl
          retention-days: 1

  build-sdist:
    name: Build sdist
    needs: prepare-version
    runs-on: ubuntu-latest
    steps:
      - name: Download git bundle
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
        with:
          name: git-repo-bundle

      - name: Restore repository from bundle
        env:
          TAG_NAME: ${{ needs.prepare-version.outputs.tag_name }}
        run: |
          git clone repo.bundle repo
          cd repo
          git checkout "$TAG_NAME"

      - name: Set up Python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
        with:
          python-version: '3.12'

      - name: Build sdist via maturin
        uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b  # v1.51.0
        with:
          working-directory: ./repo
          command: sdist
          args: --out dist

      - name: Verify sdist contains Rust sources
        run: |
          tar tzf ./repo/dist/*.tar.gz | grep -E 'diffctx/src/.*\.rs$' | head -5
          echo "OK: sdist contains Rust sources"

      - name: Upload sdist artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
        with:
          name: sdist
          path: ./repo/dist/*.tar.gz
          retention-days: 1

  publish-to-pypi:
    name: Publish to PyPI
    needs: [prepare-version, build-wheels, build-sdist]
    if: github.event.inputs.publish_to_pypi == 'true'
    runs-on: ubuntu-latest
    environment:
      name: pypi
      url: https://pypi.org/p/diffctx
    permissions:
      id-token: write
    steps:
      - name: Download all distribution artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
        with:
          path: ./dist-artifacts
          pattern: '@(wheel-*|sdist)'
          merge-multiple: true

      - name: Collect wheels and sdist
        run: |
          mkdir -p dist
          find ./dist-artifacts -type f \( -name '*.whl' -o -name '*.tar.gz' \) -exec cp {} dist/ \;
          ls -la dist/

      - name: Set up Python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
        with:
          python-version: '3.12'

      - name: Validate distributions
        run: |
          python -m pip install --upgrade pip
          pip install twine
          twine check dist/*

      - name: Publish to PyPI (OIDC trusted publishing)
        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b  # release/v1
        with:
          packages-dir: ./dist
          print-hash: true
          # Idempotent re-runs: if a wheel for this version was already
          # uploaded in a previous (failed) CD run, skip it instead of
          # erroring out. New artifacts (e.g. a corrected sdist) still
          # publish.
          skip-existing: true

  smoke-pypi:
    name: Post-publish smoke test (${{ matrix.os }} / py${{ matrix.python-version }})
    needs: [prepare-version, publish-to-pypi]
    if: github.event.inputs.publish_to_pypi == 'true'
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
        python-version: ['3.10', '3.13']
    runs-on: ${{ matrix.os }}
    steps:
      - name: Set up Python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
        with:
          python-version: ${{ matrix.python-version }}

      - name: Wait for PyPI propagation and install
        shell: bash
        env:
          VERSION: ${{ needs.prepare-version.outputs.version }}
        run: |
          python -m pip install --upgrade pip
          # Poll PyPI until the new version is installable. Up to 5 minutes.
          for attempt in 1 2 3 4 5 6 7 8 9 10; do
            if python -m pip install "diffctx==${VERSION}"; then
              echo "Installed diffctx ${VERSION} on attempt $attempt"
              break
            fi
            echo "PyPI not ready yet (attempt $attempt); sleeping 30s"
            sleep 30
          done
          python -m pip show diffctx | grep -E '^(Name|Version)'

      - name: Smoke - diffctx --version
        run: diffctx --version

      - name: Smoke - tree mapping mode
        shell: bash
        run: |
          mkdir -p smoke-tree && cd smoke-tree
          echo "print('hello')" > a.py
          echo "x = 1" > b.py
          diffctx . --no-content > /dev/null
          echo "OK: tree mode works"

      - name: Smoke - Rust _diffctx is shipped
        shell: bash
        run: |
          python - <<'PY'
          from diffctx._diffctx import GitError, build_diff_context, count_tokens  # noqa: F401
          print("OK: _diffctx imported")
          PY

      - name: Smoke - diff context mode
        shell: bash
        run: |
          mkdir -p smoke-diff && cd smoke-diff
          git init -q
          git config user.email "smoke@test.local"
          git config user.name "Smoke"
          mkdir -p pkg
          printf 'def add(a, b):\n    return a + b\n' > pkg/util.py
          printf 'from pkg.util import add\n\ndef main():\n    print(add(1, 2))\n' > pkg/main.py
          git add -A && git commit -q -m "initial"
          printf 'def add(a, b):\n    return a + b\n\ndef sub(a, b):\n    return a - b\n' > pkg/util.py
          git add -A && git commit -q -m "add sub"
          diffctx . --diff HEAD~1..HEAD --no-content
          echo "OK: diff mode works (Rust extension present)"

  finalize-release:
    name: Push Release and Create GitHub Release
    needs: [prepare-version, build-wheels, build-sdist, publish-to-pypi, smoke-pypi]
    if: |
      always() &&
      needs.prepare-version.result == 'success' &&
      needs.build-wheels.result == 'success' &&
      needs.build-sdist.result == 'success' &&
      (needs.publish-to-pypi.result == 'success' ||
       needs.publish-to-pypi.result == 'skipped') &&
      (needs.smoke-pypi.result == 'success' ||
       needs.smoke-pypi.result == 'skipped')
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - name: Download git bundle
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
        with:
          name: git-repo-bundle

      - name: Restore repository from bundle
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          COMMIT_SHA: ${{ needs.prepare-version.outputs.commit_sha }}
          REPO_FULL_NAME: ${{ github.repository }}
        run: |
          git clone repo.bundle repo
          cd repo
          git checkout "$COMMIT_SHA"
          git remote set-url origin "https://x-access-token:${GH_TOKEN}@github.com/${REPO_FULL_NAME}.git"

      - name: Push commit and tag to main
        working-directory: ./repo
        env:
          TAG_NAME: ${{ needs.prepare-version.outputs.tag_name }}
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git fetch origin main
          REMOTE_MAIN=$(git rev-parse origin/main)
          OUR_PARENT=$(git rev-parse HEAD^)
          if [ "$REMOTE_MAIN" != "$OUR_PARENT" ]; then
            echo "Error: Remote main has changed since release started."
            echo "Expected parent: $OUR_PARENT"
            echo "Remote main:     $REMOTE_MAIN"
            exit 1
          fi
          git push origin HEAD:main
          git push origin "$TAG_NAME"
          echo "Successfully pushed version commit and tag"

      - name: Download all distribution artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
        with:
          path: ./artifacts
          pattern: '@(wheel-*|sdist)'
          merge-multiple: true

      - name: Collect release assets
        run: |
          mkdir -p release-assets
          find ./artifacts -type f \( -name '*.whl' -o -name '*.tar.gz' \) -exec cp {} release-assets/ \;
          ls -la release-assets/

      - name: Create GitHub Release with wheel and sdist assets
        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda  # v2
        with:
          tag_name: ${{ needs.prepare-version.outputs.tag_name }}
          name: Release ${{ needs.prepare-version.outputs.version }}
          draft: false
          prerelease: false
          generate_release_notes: true
          files: ./release-assets/*