python.yml

name: Python wheels

on:
  workflow_dispatch:
  workflow_call:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

env:
  CARGO_TERM_COLOR: always
  RUST_BACKTRACE: 1
  # Do not re-enable a machine-global sccache wrapper in any wheel build.
  RUSTC_WRAPPER: ""

# All actions are pinned to commit SHAs, including PyO3/maturin-action.
# The python binding enables PyO3's stable abi3-py39 feature; the maturin
# binary itself is pinned to 1.11.5 in every build job below.

jobs:
  macos-arm64:
    name: wheel / macOS arm64
    runs-on: macos-15
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
        with:
          python-version: "3.13"

      - name: Build wheel
        uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
        with:
          working-directory: python
          command: build
          target: aarch64-apple-darwin
          rust-toolchain: stable
          maturin-version: "v1.11.5"
          args: --release --locked --compatibility pypi --out target/wheels

      - name: Move raw wheel
        shell: bash
        run: |
          set -euo pipefail
          cd "$GITHUB_WORKSPACE"
          shopt -s nullglob
          wheels=(python/target/wheels/*.whl)
          test "${#wheels[@]}" -eq 1
          raw_dir=python/target/wheels-raw
          final_dir=python/target/wheels-final
          rm -rf "$raw_dir" "$final_dir"
          mkdir -p "$raw_dir" "$final_dir"
          mv "${wheels[0]}" "$raw_dir/"

      - name: Create audit environment
        shell: bash
        run: |
          set -euo pipefail
          audit_venv="$RUNNER_TEMP/libdeno-audit-venv"
          python -m venv "$audit_venv"
          "$audit_venv/bin/python" -m pip install --upgrade pip 'delocate==0.13.0'

      - name: Audit raw wheel with delocate
        shell: bash
        run: |
          set -euo pipefail
          cd "$GITHUB_WORKSPACE"
          shopt -s nullglob
          raw_wheels=(python/target/wheels-raw/*.whl)
          test "${#raw_wheels[@]}" -eq 1
          "$RUNNER_TEMP/libdeno-audit-venv/bin/delocate-listdeps" "${raw_wheels[0]}"

      - name: Repair wheel with delocate
        shell: bash
        run: |
          set -euo pipefail
          cd "$GITHUB_WORKSPACE"
          shopt -s nullglob
          raw_wheels=(python/target/wheels-raw/*.whl)
          test "${#raw_wheels[@]}" -eq 1
          "$RUNNER_TEMP/libdeno-audit-venv/bin/delocate-wheel" \
            --require-archs arm64 \
            --wheel-dir python/target/wheels-final \
            "${raw_wheels[0]}"

      - name: Audit final wheel with delocate
        shell: bash
        run: |
          set -euo pipefail
          cd "$GITHUB_WORKSPACE"
          shopt -s nullglob
          final_wheels=(python/target/wheels-final/*.whl)
          test "${#final_wheels[@]}" -eq 1
          "$RUNNER_TEMP/libdeno-audit-venv/bin/delocate-listdeps" "${final_wheels[0]}"

      - name: Smoke-test wheel in a fresh virtualenv
        shell: bash
        run: |
          set -euo pipefail
          cd "$GITHUB_WORKSPACE"
          shopt -s nullglob
          final_wheels=(python/target/wheels-final/*.whl)
          test "${#final_wheels[@]}" -eq 1
          smoke_venv="$RUNNER_TEMP/libdeno-smoke-venv"
          python -m venv "$smoke_venv"
          "$smoke_venv/bin/python" -m pip install --no-index "${final_wheels[0]}"
          "$smoke_venv/bin/python" -m unittest discover -s python/tests -p 'test_*.py'

      - name: Upload wheel
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: libdeno-wheel-macos-arm64
          path: python/target/wheels-final/*.whl
          if-no-files-found: error

  macos-x86_64:
    name: wheel / macOS x86_64
    runs-on: macos-15-intel
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
        with:
          # This leg is the real abi3-py39 smoke test for macOS.
          python-version: "3.9"

      - name: Build wheel
        uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
        with:
          working-directory: python
          command: build
          target: x86_64-apple-darwin
          rust-toolchain: stable
          maturin-version: "v1.11.5"
          args: --release --locked --compatibility pypi --out target/wheels

      - name: Move raw wheel
        shell: bash
        run: |
          set -euo pipefail
          cd "$GITHUB_WORKSPACE"
          shopt -s nullglob
          wheels=(python/target/wheels/*.whl)
          test "${#wheels[@]}" -eq 1
          raw_dir=python/target/wheels-raw
          final_dir=python/target/wheels-final
          rm -rf "$raw_dir" "$final_dir"
          mkdir -p "$raw_dir" "$final_dir"
          mv "${wheels[0]}" "$raw_dir/"

      - name: Create audit environment
        shell: bash
        run: |
          set -euo pipefail
          audit_venv="$RUNNER_TEMP/libdeno-audit-venv"
          python -m venv "$audit_venv"
          "$audit_venv/bin/python" -m pip install --upgrade pip 'delocate==0.13.0'

      - name: Audit raw wheel with delocate
        shell: bash
        run: |
          set -euo pipefail
          cd "$GITHUB_WORKSPACE"
          shopt -s nullglob
          raw_wheels=(python/target/wheels-raw/*.whl)
          test "${#raw_wheels[@]}" -eq 1
          "$RUNNER_TEMP/libdeno-audit-venv/bin/delocate-listdeps" "${raw_wheels[0]}"

      - name: Repair wheel with delocate
        shell: bash
        run: |
          set -euo pipefail
          cd "$GITHUB_WORKSPACE"
          shopt -s nullglob
          raw_wheels=(python/target/wheels-raw/*.whl)
          test "${#raw_wheels[@]}" -eq 1
          "$RUNNER_TEMP/libdeno-audit-venv/bin/delocate-wheel" \
            --require-archs x86_64 \
            --wheel-dir python/target/wheels-final \
            "${raw_wheels[0]}"

      - name: Audit final wheel with delocate
        shell: bash
        run: |
          set -euo pipefail
          cd "$GITHUB_WORKSPACE"
          shopt -s nullglob
          final_wheels=(python/target/wheels-final/*.whl)
          test "${#final_wheels[@]}" -eq 1
          "$RUNNER_TEMP/libdeno-audit-venv/bin/delocate-listdeps" "${final_wheels[0]}"

      - name: Verify abi3-py39 wheel tag
        shell: bash
        run: |
          set -euo pipefail
          cd "$GITHUB_WORKSPACE"
          shopt -s nullglob
          final_wheels=(python/target/wheels-final/*.whl)
          test "${#final_wheels[@]}" -eq 1
          case "$(basename "${final_wheels[0]}")" in
            *-cp39-abi3-*.whl) ;;
            *) echo "expected a cp39-abi3 wheel, got $(basename "${final_wheels[0]}")"; exit 1 ;;
          esac

      - name: Smoke-test wheel in a fresh virtualenv
        shell: bash
        run: |
          set -euo pipefail
          cd "$GITHUB_WORKSPACE"
          shopt -s nullglob
          final_wheels=(python/target/wheels-final/*.whl)
          test "${#final_wheels[@]}" -eq 1
          smoke_venv="$RUNNER_TEMP/libdeno-smoke-venv"
          python -m venv "$smoke_venv"
          "$smoke_venv/bin/python" -m pip install --no-index "${final_wheels[0]}"
          "$smoke_venv/bin/python" -m unittest discover -s python/tests -p 'test_*.py'

      - name: Upload wheel
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: libdeno-wheel-macos-x86_64
          path: python/target/wheels-final/*.whl
          if-no-files-found: error

  windows-x86_64:
    name: wheel / Windows x86_64
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
        with:
          # This leg is the real abi3-py39 smoke test for Windows.
          python-version: "3.9"

      - name: Build wheel
        uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
        with:
          working-directory: python
          command: build
          target: x86_64-pc-windows-msvc
          rust-toolchain: stable
          maturin-version: "v1.11.5"
          args: --release --locked --compatibility pypi --out target/wheels

      - name: Move raw wheel
        shell: pwsh
        run: |
          $ErrorActionPreference = 'Stop'
          Set-Location $env:GITHUB_WORKSPACE
          $wheelDir = Join-Path $env:GITHUB_WORKSPACE 'python/target/wheels'
          $rawDir = Join-Path $env:GITHUB_WORKSPACE 'python/target/wheels-raw'
          $finalDir = Join-Path $env:GITHUB_WORKSPACE 'python/target/wheels-final'
          if (Test-Path -LiteralPath $rawDir) { Remove-Item -LiteralPath $rawDir -Recurse -Force }
          if (Test-Path -LiteralPath $finalDir) { Remove-Item -LiteralPath $finalDir -Recurse -Force }
          New-Item -ItemType Directory -Path $rawDir, $finalDir -Force | Out-Null
          $wheels = @(Get-ChildItem -LiteralPath $wheelDir -Filter '*.whl' -File)
          if ($wheels.Count -ne 1) { throw "expected one raw wheel, found $($wheels.Count)" }
          Move-Item -LiteralPath $wheels[0].FullName -Destination $rawDir

      - name: Create audit environment
        shell: pwsh
        run: |
          $ErrorActionPreference = 'Stop'
          $auditVenv = Join-Path $env:RUNNER_TEMP 'libdeno-audit-venv'
          python -m venv $auditVenv
          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
          $auditPython = Join-Path $auditVenv 'Scripts/python.exe'
          & $auditPython -m pip install --upgrade pip 'delvewheel==1.13.0'
          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }

      - name: Audit raw wheel with delvewheel
        shell: pwsh
        run: |
          $ErrorActionPreference = 'Stop'
          Set-Location $env:GITHUB_WORKSPACE
          $rawDir = Join-Path $env:GITHUB_WORKSPACE 'python/target/wheels-raw'
          $rawWheels = @(Get-ChildItem -LiteralPath $rawDir -Filter '*.whl' -File)
          if ($rawWheels.Count -ne 1) { throw "expected one raw wheel, found $($rawWheels.Count)" }
          $auditPython = Join-Path $env:RUNNER_TEMP 'libdeno-audit-venv/Scripts/python.exe'
          & $auditPython -m delvewheel show $rawWheels[0].FullName
          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }

      - name: Repair wheel with delvewheel
        shell: pwsh
        run: |
          $ErrorActionPreference = 'Stop'
          Set-Location $env:GITHUB_WORKSPACE
          $rawDir = Join-Path $env:GITHUB_WORKSPACE 'python/target/wheels-raw'
          $finalDir = Join-Path $env:GITHUB_WORKSPACE 'python/target/wheels-final'
          $rawWheels = @(Get-ChildItem -LiteralPath $rawDir -Filter '*.whl' -File)
          if ($rawWheels.Count -ne 1) { throw "expected one raw wheel, found $($rawWheels.Count)" }
          $auditPython = Join-Path $env:RUNNER_TEMP 'libdeno-audit-venv/Scripts/python.exe'
          & $auditPython -m delvewheel repair --wheel-dir $finalDir $rawWheels[0].FullName
          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }

      - name: Audit final wheel with delvewheel
        shell: pwsh
        run: |
          $ErrorActionPreference = 'Stop'
          Set-Location $env:GITHUB_WORKSPACE
          $finalDir = Join-Path $env:GITHUB_WORKSPACE 'python/target/wheels-final'
          $finalWheels = @(Get-ChildItem -LiteralPath $finalDir -Filter '*.whl' -File)
          if ($finalWheels.Count -ne 1) { throw "expected one final wheel, found $($finalWheels.Count)" }
          $auditPython = Join-Path $env:RUNNER_TEMP 'libdeno-audit-venv/Scripts/python.exe'
          & $auditPython -m delvewheel show $finalWheels[0].FullName
          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }

      - name: Verify abi3-py39 wheel tag
        shell: pwsh
        run: |
          $ErrorActionPreference = 'Stop'
          $finalDir = Join-Path $env:GITHUB_WORKSPACE 'python/target/wheels-final'
          $finalWheels = @(Get-ChildItem -LiteralPath $finalDir -Filter '*.whl' -File)
          if ($finalWheels.Count -ne 1) { throw "expected one final wheel, found $($finalWheels.Count)" }
          if ($finalWheels[0].Name -notmatch '-cp39-abi3-') {
            throw "expected a cp39-abi3 wheel, got $($finalWheels[0].Name)"
          }

      - name: Smoke-test wheel in a fresh virtualenv
        shell: pwsh
        run: |
          $ErrorActionPreference = 'Stop'
          Set-Location $env:GITHUB_WORKSPACE
          $finalDir = Join-Path $env:GITHUB_WORKSPACE 'python/target/wheels-final'
          $finalWheels = @(Get-ChildItem -LiteralPath $finalDir -Filter '*.whl' -File)
          if ($finalWheels.Count -ne 1) { throw "expected one final wheel, found $($finalWheels.Count)" }
          $smokeVenv = Join-Path $env:RUNNER_TEMP 'libdeno-smoke-venv'
          python -m venv $smokeVenv
          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
          $smokePython = Join-Path $smokeVenv 'Scripts/python.exe'
          & $smokePython -m pip install --no-index $finalWheels[0].FullName
          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
          & $smokePython -m unittest discover -s python/tests -p 'test_*.py'
          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }

      - name: Upload wheel
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: libdeno-wheel-windows-x86_64
          path: python/target/wheels-final/*.whl
          if-no-files-found: error

  linux-x86_64:
    name: wheel / Linux x86_64 manylinux_2_28
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
        with:
          # The manylinux build uses cp39; the host audit/smoke environment uses Python 3.10 because auditwheel 6.8.1 requires Python >=3.10.
          python-version: "3.10"

      # maturin-action runs this build in its x86_64 manylinux_2_28 container.
      - name: Build wheel
        uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
        with:
          working-directory: python
          command: build
          target: x86_64-unknown-linux-gnu
          rust-toolchain: stable
          maturin-version: "v1.11.5"
          manylinux: "2_28"
          before-script-linux: |
            dnf install -y clang-devel
          args: >-
            --release --locked --compatibility pypi
            -i python3.9
            --out target/wheels

      - name: Create audit environment
        shell: bash
        run: |
          set -euo pipefail
          audit_venv="$RUNNER_TEMP/libdeno-audit-venv"
          python -m venv "$audit_venv"
          "$audit_venv/bin/python" -m pip install --upgrade pip 'auditwheel==6.8.1'

      - name: Audit wheel with auditwheel
        shell: bash
        run: |
          set -euo pipefail
          cd "$GITHUB_WORKSPACE"
          shopt -s nullglob
          wheels=(python/target/wheels/*.whl)
          test "${#wheels[@]}" -eq 1
          "$RUNNER_TEMP/libdeno-audit-venv/bin/auditwheel" show "${wheels[0]}"

      - name: Smoke-test wheel in a fresh virtualenv
        shell: bash
        run: |
          set -euo pipefail
          cd "$GITHUB_WORKSPACE"
          shopt -s nullglob
          wheels=(python/target/wheels/*.whl)
          test "${#wheels[@]}" -eq 1
          smoke_venv="$RUNNER_TEMP/libdeno-smoke-venv"
          python -m venv "$smoke_venv"
          "$smoke_venv/bin/python" -m pip install --no-index "${wheels[0]}"
          "$smoke_venv/bin/python" -m unittest discover -s python/tests -p 'test_*.py'

      - name: Upload wheel
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: libdeno-wheel-linux-x86_64
          path: python/target/wheels/*.whl
          if-no-files-found: error

  linux-aarch64:
    name: wheel / Linux aarch64 manylinux_2_28
    runs-on: ubuntu-24.04-arm
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
        with:
          python-version: "3.13"

      # On the native ARM64 runner this selects manylinux_2_28_aarch64.
      - name: Build wheel
        uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
        with:
          working-directory: python
          command: build
          target: aarch64-unknown-linux-gnu
          rust-toolchain: stable
          maturin-version: "v1.11.5"
          manylinux: "2_28"
          before-script-linux: |
            dnf install -y clang-devel
          args: >-
            --release --locked --compatibility pypi
            -i python3.9
            --out target/wheels

      - name: Create audit environment
        shell: bash
        run: |
          set -euo pipefail
          audit_venv="$RUNNER_TEMP/libdeno-audit-venv"
          python -m venv "$audit_venv"
          "$audit_venv/bin/python" -m pip install --upgrade pip 'auditwheel==6.8.1'

      - name: Audit wheel with auditwheel
        shell: bash
        run: |
          set -euo pipefail
          cd "$GITHUB_WORKSPACE"
          shopt -s nullglob
          wheels=(python/target/wheels/*.whl)
          test "${#wheels[@]}" -eq 1
          "$RUNNER_TEMP/libdeno-audit-venv/bin/auditwheel" show "${wheels[0]}"

      - name: Smoke-test wheel in a fresh virtualenv
        shell: bash
        run: |
          set -euo pipefail
          cd "$GITHUB_WORKSPACE"
          shopt -s nullglob
          wheels=(python/target/wheels/*.whl)
          test "${#wheels[@]}" -eq 1
          smoke_venv="$RUNNER_TEMP/libdeno-smoke-venv"
          python -m venv "$smoke_venv"
          "$smoke_venv/bin/python" -m pip install --no-index "${wheels[0]}"
          "$smoke_venv/bin/python" -m unittest discover -s python/tests -p 'test_*.py'

      - name: Upload wheel
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: libdeno-wheel-linux-aarch64
          path: python/target/wheels/*.whl
          if-no-files-found: error

  wheel-metadata:
    name: validate wheel metadata
    needs: [macos-arm64, macos-x86_64, windows-x86_64, linux-x86_64, linux-aarch64]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
        with:
          python-version: "3.13"

      - name: Download all wheel artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          pattern: libdeno-wheel-*
          path: artifacts
          merge-multiple: true

      - name: Check wheel metadata with twine
        shell: bash
        run: |
          set -euo pipefail
          twine_venv="$RUNNER_TEMP/libdeno-twine-venv"
          python -m venv "$twine_venv"
          "$twine_venv/bin/python" -m pip install --upgrade pip 'twine==7.0.0'
          "$twine_venv/bin/twine" check artifacts/*.whl

      - name: Check all wheel tags are abi3-py39
        shell: bash
        run: |
          set -euo pipefail
          shopt -s nullglob
          wheels=(artifacts/*.whl)
          test "${#wheels[@]}" -eq 5
          for wheel in "${wheels[@]}"; do
            case "$(basename "$wheel")" in
              *-cp39-abi3-*.whl) ;;
              *) echo "expected a cp39-abi3 wheel, got $(basename "$wheel")"; exit 1 ;;
            esac
          done

      - name: Check typing metadata is packaged
        shell: bash
        run: |
          set -euo pipefail
          python - <<'PY'
          from pathlib import Path
          from zipfile import ZipFile

          wheels = sorted(Path("artifacts").glob("*.whl"))
          if len(wheels) != 5:
              raise SystemExit(f"expected exactly five wheel artifacts, found {len(wheels)}")
          required = {"libdeno/__init__.pyi", "libdeno/py.typed"}
          for wheel in wheels:
              with ZipFile(wheel) as archive:
                  missing = required - set(archive.namelist())
              if missing:
                  raise SystemExit(f"{wheel.name}: missing wheel members {sorted(missing)}")
          print("validated typing metadata in all wheels")
          PY