python.yml

name: Python SDK

on:
  push:
    branches: [main]
    tags: ["v*"]
  pull_request:
    branches: [main]
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: python-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  CARGO_TERM_COLOR: always

jobs:
  build:
    name: Build wheel (${{ matrix.label }})
    runs-on: ${{ matrix.os }}
    timeout-minutes: 45
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            python: "3.12"
            label: ubuntu py3.12
          - os: macos-latest
            python: "3.12"
            label: macos py3.12
          - os: windows-latest
            python: "3.12"
            label: windows py3.12
    steps:
      - uses: actions/checkout@v6
      - uses: ./.github/actions/setup-rust-deps
        with:
          components: clippy
      - uses: actions/setup-python@v6
        with:
          python-version: ${{ matrix.python }}
      - run: cargo run -p thetadatadx --features config-file --bin generate_sdk_surfaces --locked -- --check
      # `too_many_arguments` is allow-listed because every offender is a
      # generated pyo3 endpoint method whose signature mirrors the
      # underlying REST surface — not a real code smell. Every other
      # warning (including new ones) stays fatal.
      - name: Clippy (Python SDK)
        shell: bash
        working-directory: sdks/python
        run: cargo clippy --all-targets -- -D warnings -A clippy::too_many_arguments
      - shell: bash
        run: python -m pip install --upgrade pip "maturin>=1.9.4,<2.0"
      # Linux wheel uses the manylinux2014 (glibc 2.17) Docker toolchain so
      # the published wheel is installable on every supported platform —
      # Ubuntu 22.04 / RHEL 8 / Google Colab / Databricks / CentOS 7 all
      # pin glibc at or below 2.34. Building on `ubuntu-latest` directly
      # tags the wheel with the host glibc floor (currently 2.38), which
      # silently breaks every older runtime.
      - name: Build wheel (Linux, manylinux2014)
        if: matrix.os == 'ubuntu-latest'
        uses: PyO3/maturin-action@v1
        with:
          # `--interpreter python3.9` targets the abi3 floor declared in
          # `sdks/python/Cargo.toml` (pyo3/abi3-py39). The default
          # `python` binary inside the manylinux2014 Docker image is
          # Python 2.7, which lacks `sys.implementation` and breaks
          # maturin's interpreter probe; `python3.9` resolves cleanly
          # inside the image.
          command: build
          args: --release -m sdks/python/Cargo.toml -o dist/ --interpreter python3.9
          manylinux: '2014'
          target: x86_64
          # The manylinux2014 CentOS 7 image ships no `protoc`, which
          # `tonic-prost-build` needs to compile `proto/mdds.proto`.
          # Install a pinned prebuilt binary before maturin starts.
          before-script-linux: |
            set -euo pipefail
            PROTOC_VERSION=29.3
            curl -fsSL -o /tmp/protoc.zip \
              "https://github.com/protocolbuffers/protobuf/releases/download/v${PROTOC_VERSION}/protoc-${PROTOC_VERSION}-linux-x86_64.zip"
            unzip -q /tmp/protoc.zip -d /usr/local
            chmod 0755 /usr/local/bin/protoc
            protoc --version
      - name: Build wheel (macOS / Windows)
        if: matrix.os != 'ubuntu-latest'
        shell: bash
        run: python -m maturin build --release -m sdks/python/Cargo.toml -o dist/ --interpreter python
      - name: Install wheel
        shell: bash
        run: python -m pip install --force-reinstall dist/*.whl
      - name: Import smoke
        shell: bash
        run: |
          python - <<'PY'
          import thetadatadx
          from thetadatadx import implied_volatility

          iv, err = implied_volatility(450.0, 455.0, 0.05, 0.015, 30.0 / 365.0, 8.50, "C")
          print(thetadatadx.__file__)
          print(round(iv, 6), round(err, 6))
          PY
      # Run the Python pytest suite against the freshly-installed wheel. The
      # `THETADX_TEST_CREDS`-gated tests skip cleanly without secrets so this
      # step exercises the install path AND the public-API surface contracts
      # that don't need a live FPSS handshake. Kept as a separate step from
      # the import smoke above so a pytest regression points at the suite,
      # not at the smoke output.
      - name: Pytest suite (skipped tests stay skipped)
        shell: bash
        run: |
          python -m pip install pytest
          python -m pytest sdks/python/tests/ -v
      - uses: actions/upload-artifact@v7
        with:
          name: wheel-${{ runner.os }}
          path: dist/*.whl

  compatibility:
    name: ABI3 smoke (${{ matrix.os }} py${{ matrix.python }})
    runs-on: ${{ matrix.os }}
    needs: build
    timeout-minutes: 15
    if: github.event_name == 'pull_request' || github.ref == 'refs/heads/main'
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
        python: ["3.9", "3.14"]
    steps:
      - uses: actions/setup-python@v6
        with:
          python-version: ${{ matrix.python }}
      - uses: actions/download-artifact@v8
        with:
          name: wheel-${{ runner.os }}
          path: dist/
      - shell: bash
        run: python -m pip install --force-reinstall dist/*.whl
      - shell: bash
        run: python -c "import thetadatadx; print(thetadatadx.__file__)"

  sdist:
    name: Build source distribution
    runs-on: ubuntu-latest
    timeout-minutes: 45
    steps:
      - uses: actions/checkout@v6
      - uses: ./.github/actions/setup-rust-deps
      - uses: actions/setup-python@v6
        with:
          python-version: "3.12"
      - run: cargo run -p thetadatadx --features config-file --bin generate_sdk_surfaces --locked -- --check
      - shell: bash
        run: python -m pip install --upgrade pip "maturin>=1.9.4,<2.0"
      - shell: bash
        run: python -m maturin sdist -m sdks/python/Cargo.toml -o dist/
      - shell: bash
        run: python -m pip install --force-reinstall dist/*.tar.gz
      - shell: bash
        run: python -c "import thetadatadx"
      - if: startsWith(github.ref, 'refs/tags/v') || github.event_name == 'workflow_dispatch'
        uses: actions/upload-artifact@v7
        with:
          name: sdist
          path: dist/*.tar.gz

  publish:
    name: Publish to PyPI
    runs-on: ubuntu-latest
    needs: [build, sdist]
    if: startsWith(github.ref, 'refs/tags/v')
    steps:
      - uses: actions/download-artifact@v8
        with:
          path: dist/
          merge-multiple: true
      - uses: pypa/gh-action-pypi-publish@release/v1
        with:
          password: ${{ secrets.PYPI_API_TOKEN }}
          skip-existing: true