python.yml

name: python

# Wheels build on every push and pull request. They are published to PyPI from a
# version tag: `v*` ships the bindings alongside a CLI release, and `py-v*` ships a
# bindings-only release without cutting a new CLI version.
on:
  push:
    branches: [main]
    tags: ["v*", "py-v*"]
  pull_request:
  workflow_dispatch:

jobs:
  test:
    name: build and smoke (${{ matrix.os }})
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest # manylinux x86_64
          - os: ubuntu-24.04-arm # manylinux aarch64
          - os: macos-latest # arm64
          - os: windows-latest # x86_64 msvc
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-python@v7
        with:
          python-version: "3.12"
      - uses: dtolnay/rust-toolchain@stable
      - name: build wheel
        uses: PyO3/maturin-action@v1
        with:
          maturin-version: latest
          args: --release --manifest-path python/Cargo.toml --out target/wheels
      - name: smoke test the wheel
        run: |
          python -m venv /tmp/wheelcheck
          # Windows venvs put executables in Scripts/, unix venvs in bin/.
          BIN=/tmp/wheelcheck/bin
          [ -d /tmp/wheelcheck/Scripts ] && BIN=/tmp/wheelcheck/Scripts
          "$BIN/pip" install target/wheels/*.whl
          "$BIN/python" python/tests/smoke.py
        shell: bash
      - uses: actions/upload-artifact@v7
        with:
          name: wheels-${{ matrix.os }}
          path: target/wheels

  publish:
    name: publish to PyPI
    # Any version tag publishes: `v*` from a CLI release, `py-v*` from a
    # bindings-only release. `--skip-existing` makes a re-run harmless.
    if: startsWith(github.ref, 'refs/tags/v') || startsWith(github.ref, 'refs/tags/py-v')
    needs: test
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
    environment: pypi
    steps:
      - uses: actions/download-artifact@v8
        with:
          path: target/wheels
          merge-multiple: true
      - name: publish
        # `upload` takes the built wheels directly. `publish` would rebuild from a
        # manifest, which this job does not have: it only downloads the artifacts the
        # test matrix produced and never checks the repository out.
        uses: PyO3/maturin-action@v1
        with:
          maturin-version: latest
          command: upload
          args: --skip-existing target/wheels/*