build-python.yml

name: Build Python Application

# Runs the test suite on every branch push and PR — matching every branch
# ('**') rather than an allow-list, because an allow-list silently went stale
# once before and left the active release branch with no CI at all.
#
# The platform build jobs (Windows, Linux) below are a separate concern: each
# one takes 90+ minutes of Nuitka compile time, so they only run on a version
# tag push (an actual release) or a manual workflow_dispatch — never on a
# plain branch push or PR. See each job's `if:` for the gating.

on:
  push:
    branches: [ '**' ]
    tags: [ 'v*' ]
  pull_request:
    branches: [ '**' ]
  workflow_dispatch:
    inputs:
      targets:
        description: "Which platforms to build (tag pushes always build all)"
        required: true
        default: all
        type: choice
        options:
          - all
          - windows
          - linux

jobs:
  test:
    name: Tests (${{ matrix.os }}, Python ${{ matrix.python-version }})
    runs-on: ${{ matrix.os }}
    timeout-minutes: 20
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, windows-latest, macos-latest]
        python-version: ['3.10', '3.12']
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Python ${{ matrix.python-version }}
        uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python-version }}
          cache: 'pip'

      - name: Install Qt system dependencies (Linux)
        if: runner.os == 'Linux'
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends \
            libegl1 libgl1 libxkbcommon0 libdbus-1-3 libxcb-cursor0

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -r requirements-dev.txt

      - name: Run unit tests
        # Integration tests reach the live internet and need FFmpeg, so they are
        # deselected here; run them locally or in a scheduled job.
        env:
          QT_QPA_PLATFORM: offscreen
        run: pytest -m "not integration and not requires_network and not requires_ffmpeg" -q

  build-windows:
    name: Windows (Nuitka one-file .exe)
    runs-on: windows-latest
    needs: test
    # Only build on an actual release (tag push) or a manual run — not on
    # every branch push/PR, which would burn ~90 minutes of Nuitka compile
    # time per commit.
    if: |
      (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')) ||
      (github.event_name == 'workflow_dispatch' && (inputs.targets == 'all' || inputs.targets == 'windows'))
    timeout-minutes: 120
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Python 3.11
        uses: actions/setup-python@v5
        with:
          python-version: '3.11'
          cache: 'pip'

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -r requirements.txt
          pip install "nuitka>=2.4.9,<3" ordered-set zstandard

      - name: Build with Nuitka (one-file)
        timeout-minutes: 90
        env:
          PYTHONUNBUFFERED: "1"
          NUITKA_ONEFILE: "1"
        run: python build_nuitka.py

      - name: Stage Windows artifact
        shell: pwsh
        run: powershell -ExecutionPolicy Bypass -File packaging/windows/package-zip.ps1

      - name: Upload Windows artifact
        uses: actions/upload-artifact@v4
        with:
          name: encodeforge-windows-${{ github.run_number }}
          path: |
            dist-packages/*.exe
          if-no-files-found: error
          retention-days: 14

      - name: Build summary
        shell: bash
        run: |
          echo "## Windows build" >> "$GITHUB_STEP_SUMMARY"
          echo "" >> "$GITHUB_STEP_SUMMARY"
          echo "- Nuitka one-file Windows .exe (dist-packages/EncodeForge-*-windows-x64.exe): artifact encodeforge-windows-${{ github.run_number }}" >> "$GITHUB_STEP_SUMMARY"

  build-linux-packages:
    name: Linux (Nuitka + deb + rpm + AppImage)
    runs-on: ubuntu-22.04
    needs: test
    # Only build on an actual release (tag push) or a manual run — not on
    # every branch push/PR, which would burn ~90 minutes of Nuitka compile
    # time per commit.
    if: |
      (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')) ||
      (github.event_name == 'workflow_dispatch' && (inputs.targets == 'all' || inputs.targets == 'linux'))
    timeout-minutes: 180
    env:
      # The compiled binary can only run on systems whose glibc is >= the
      # build machine's. ubuntu-22.04 (glibc 2.35) was making the released
      # AppImage refuse to start on anything older — flagged by the AppImage
      # catalog's "not self-contained ... references glibc 2.35" check, and
      # the likely cause of it exiting instantly instead of showing a window.
      # Compile inside this container instead: it's the exact glibc floor
      # (2.28) that PySide6's own official wheels are already built against,
      # so it can't be tightened further without PySide6 doing so first.
      MANYLINUX_IMAGE: quay.io/pypa/manylinux_2_28_x86_64
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Build with Nuitka inside manylinux_2_28 (glibc 2.28)
        timeout-minutes: 120
        run: |
          docker run --rm -v "${{ github.workspace }}":/io -w /io \
            "${MANYLINUX_IMAGE}" bash -lc '
              set -euo pipefail
              export PATH="/opt/python/cp311-cp311/bin:${PATH}"
              dnf install -y --setopt=install_weak_deps=False \
                curl patchelf ccache \
                mesa-libGL mesa-libEGL \
                libxkbcommon libxkbcommon-x11 \
                libxcb xcb-util xcb-util-image xcb-util-keysyms xcb-util-renderutil xcb-util-wm \
                fontconfig freetype libSM libICE libXext libXrender libxshmfence \
                dbus-libs glib2 zlib
              python3 -m pip install --upgrade pip
              pip install -r requirements.txt
              pip install "nuitka>=2.4.9,<3" ordered-set zstandard
              PYTHONUNBUFFERED=1 python3 build_nuitka.py
              chmod +x packaging/linux/build-appimage.sh packaging/linux/AppRun
              ./packaging/linux/build-appimage.sh
            '

      - name: Set up Python 3.11 (for deb/rpm packaging)
        uses: actions/setup-python@v5
        with:
          python-version: '3.11'
          cache: 'pip'

      - name: Install fpm and rpmbuild
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends ruby ruby-dev build-essential rpm
          sudo gem install --no-document fpm

      - name: Build deb and rpm
        run: |
          chmod +x packaging/linux/build-deb-rpm.sh
          ./packaging/linux/build-deb-rpm.sh

      - name: Upload Linux packages
        uses: actions/upload-artifact@v4
        with:
          name: encodeforge-linux-packages-${{ github.run_number }}
          path: |
            dist-packages/*.deb
            dist-packages/*.rpm
            dist-packages/*.AppImage
          if-no-files-found: error
          retention-days: 14

      - name: Build summary
        run: |
          echo "## Linux packages" >> "$GITHUB_STEP_SUMMARY"
          echo "" >> "$GITHUB_STEP_SUMMARY"
          echo "- deb, rpm, AppImage: artifact encodeforge-linux-packages-${{ github.run_number }}" >> "$GITHUB_STEP_SUMMARY"
          echo "- Nuitka build + AppImage run inside manylinux_2_28 (glibc 2.28) for broad compatibility" >> "$GITHUB_STEP_SUMMARY"