release-sdk-pypi.yml

name: SDK PyPI Release

# Publishes smbcloud-sdk-auth (sdk/python) to PyPI.
# Triggered by the crates release workflow when wrapped Rust crates change,
# or manually via workflow_dispatch.
#
# Windows arm64 wheels are intentionally not built here. GitHub's hosted
# Windows runners provide x64 Python, and maturin refuses to build an arm64
# wheel when the interpreter reports win-amd64.

on:
  workflow_dispatch:
    inputs:
      tag:
        description: "Release tag (e.g. v0.3.35)"
        required: true

permissions:
  id-token: write
  contents: read

env:
  CARGO_TERM_COLOR: always
  CLI_CLIENT_SECRET: ${{ secrets.CLI_CLIENT_SECRET }}

jobs:
  build-wheels:
    name: Build PyPI wheels
    runs-on: ${{ matrix.build.OS }}
    strategy:
      fail-fast: false
      matrix:
        build:
          - {
              NAME: linux-x64-glibc,
              OS: ubuntu-latest,
              TARGET: x86_64-unknown-linux-gnu,
              MANYLINUX: "2014",
            }
          - {
              NAME: linux-arm64-glibc,
              OS: ubuntu-24.04-arm,
              TARGET: aarch64-unknown-linux-gnu,
              MANYLINUX: "2014",
            }
          - {
              NAME: win32-x64-msvc,
              OS: windows-2022,
              TARGET: x86_64-pc-windows-msvc,
            }
          - {
              NAME: darwin-x64,
              OS: macos-15-intel,
              TARGET: x86_64-apple-darwin,
            }
          - {
              NAME: darwin-arm64,
              OS: macos-latest,
              TARGET: aarch64-apple-darwin,
            }
    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          ref: ${{ github.event.inputs.tag || github.ref }}

      - name: Set the release version
        shell: bash
        run: |
          if [[ "${GITHUB_REF_TYPE}" == "tag" ]]; then
            release_version="${GITHUB_REF_NAME#v}"
          else
            release_version="${{ github.event.inputs.tag }}"
            release_version="${release_version#v}"
          fi

          echo "RELEASE_VERSION=${release_version}" >> "$GITHUB_ENV"

      - name: Read Rust toolchain
        shell: bash
        run: |
          rust_toolchain="$(sed -n 's/^channel = "\(.*\)"/\1/p' rust-toolchain.toml | head -n 1)"
          if [ -z "$rust_toolchain" ]; then
            echo "Failed to read Rust toolchain from rust-toolchain.toml" >&2
            exit 1
          fi

          echo "RUST_TOOLCHAIN=${rust_toolchain}" >> "$GITHUB_ENV"

      - name: Install toolkit
        uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9
        with:
          toolchain: ${{ env.RUST_TOOLCHAIN }}

      - name: Install Rust target
        shell: bash
        run: |
          rustup target add ${{ matrix.build.TARGET }} --toolchain ${{ env.RUST_TOOLCHAIN }}
          rustup target list --installed

      - name: Verify Cargo.toml version matches tag
        shell: bash
        run: |
          CARGO_VERSION=$(cargo metadata --no-deps --format-version 1 \
            | jq -r '.packages[] | select(.name == "smbcloud-auth-sdk-py") | .version')

          echo "Cargo.toml version : ${CARGO_VERSION}"
          echo "Release tag version: ${RELEASE_VERSION}"

          if [[ "${CARGO_VERSION}" != "${RELEASE_VERSION}" ]]; then
            echo "::error::Version mismatch — bump version in crates/smbcloud-auth-sdk-py/Cargo.toml before releasing."
            exit 1
          fi

      - name: Setup Rust cache
        uses: Swatinem/rust-cache@v2
        with:
          key: sdk-pypi-${{ matrix.build.NAME }}

      # manylinux containers are CentOS-based and use yum; perl-core is required
      # by the openssl-sys vendored build to compile OpenSSL from source.
      - name: Clean dist directory
        shell: bash
        run: rm -rf sdk/python/dist

      - name: Build wheel
        uses: PyO3/maturin-action@v1
        with:
          target: ${{ matrix.build.TARGET }}
          manylinux: ${{ matrix.build.MANYLINUX || 'off' }}
          working-directory: sdk/python
          args: --release --locked --compatibility pypi --out dist
          before-script-linux: yum install -y perl-core
          docker-options: -e CLI_CLIENT_SECRET

      - name: Upload wheel artifact
        uses: actions/upload-artifact@v7
        with:
          name: wheels-${{ matrix.build.NAME }}
          path: sdk/python/dist/*

  build-sdist:
    name: Build source distribution
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          ref: ${{ github.event.inputs.tag || github.ref }}

      - name: Set the release version
        shell: bash
        run: |
          if [[ "${GITHUB_REF_TYPE}" == "tag" ]]; then
            release_version="${GITHUB_REF_NAME#v}"
          else
            release_version="${{ github.event.inputs.tag }}"
            release_version="${release_version#v}"
          fi

          echo "RELEASE_VERSION=${release_version}" >> "$GITHUB_ENV"

      - name: Read Rust toolchain
        shell: bash
        run: |
          rust_toolchain="$(sed -n 's/^channel = "\(.*\)"/\1/p' rust-toolchain.toml | head -n 1)"
          if [ -z "$rust_toolchain" ]; then
            echo "Failed to read Rust toolchain from rust-toolchain.toml" >&2
            exit 1
          fi

          echo "RUST_TOOLCHAIN=${rust_toolchain}" >> "$GITHUB_ENV"

      - name: Install toolkit
        uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9
        with:
          toolchain: ${{ env.RUST_TOOLCHAIN }}

      - name: Clean dist directory
        run: rm -rf sdk/python/dist

      - name: Build sdist
        uses: PyO3/maturin-action@v1
        with:
          command: sdist
          working-directory: sdk/python
          args: --out dist

      - name: Upload sdist artifact
        uses: actions/upload-artifact@v7
        with:
          name: sdist
          path: sdk/python/dist/*

  publish-pypi:
    name: Publish to PyPI
    runs-on: ubuntu-latest
    needs:
      - build-wheels
      - build-sdist

    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          ref: ${{ github.event.inputs.tag || github.ref }}

      - name: Set the release version
        shell: bash
        run: |
          if [[ "${GITHUB_REF_TYPE}" == "tag" ]]; then
            release_version="${GITHUB_REF_NAME#v}"
          else
            release_version="${{ github.event.inputs.tag }}"
            release_version="${release_version#v}"
          fi

          echo "RELEASE_VERSION=${release_version}" >> "$GITHUB_ENV"

      - name: Download distribution artifacts
        uses: actions/download-artifact@v7
        with:
          pattern: "*"
          path: dist
          merge-multiple: true

      - name: Check whether release already exists on PyPI
        id: pypi-check
        shell: bash
        run: |
          if curl -fsS "https://pypi.org/pypi/smbcloud-sdk-auth/${RELEASE_VERSION}/json" >/dev/null 2>&1; then
            echo "smbcloud-sdk-auth ${RELEASE_VERSION} already exists on PyPI, skipping publish"
            echo "exists=true" >> "$GITHUB_OUTPUT"
          else
            echo "exists=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Publish distribution
        if: steps.pypi-check.outputs.exists != 'true'
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          skip-existing: true