python-release.yml

name: Python Release
on:
  push:
    tags:
      - v*

env:
  AWS_DEFAULT_REGION: us-east-1
  DIST_DIR: ${{ github.sha }}

jobs:
  lock_exists:
    runs-on: ubuntu-latest
    name: Cargo.lock
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
      - name: Cargo.lock lock exists 
        run: cat Cargo.lock
        working-directory: ./bindings/python

  build:
    name: build on ${{ matrix.platform || matrix.os }} (${{ matrix.target }} - ${{ matrix.manylinux || 'auto' }} - ${{ matrix.flavor == 'ft' && '3.14t' || matrix.interpreter || '3.14' }})
    # only run on push to main and on release
    needs: [lock_exists]
    if: startsWith(github.ref, 'refs/tags/') || github.ref == 'refs/heads/main' || contains(github.event.pull_request.labels.*.name, 'Full Build')
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu, macos, windows]
        target: [x86_64, aarch64]
        manylinux: [auto]
        # `flavor` discriminates regular abi3 wheels from free-threaded
        # (3.14t, non-abi3) wheels so the include: entries below for
        # 3.14t create new matrix cells instead of merging with the abi3
        # combos.
        flavor: [abi3]
        include:
          - os: ubuntu
            platform: linux
          - os: windows
            ls: dir
            interpreter: "3.14"
          - os: windows
            ls: dir
            target: x86_64
            python-architecture: x64
            python-install: "3.14"
            interpreter: "3.14"
          - os: windows
            ls: dir
            target: i686
            python-architecture: x86
            python-install: "3.14"
            interpreter: "3.14"
          - os: windows-11-arm
            ls: dir
            target: aarch64
            python-architecture: arm64
            # 3.14t arm64-freethreaded is currently broken upstream:
            # actions/python-versions ships a 0-byte python.exe so pip
            # install fails with `ModuleNotFoundError: encodings`. Drop
            # 3.14t here until the upstream package is fixed.
            python-install: "3.14"
            interpreter: "3.14"
              # - os: windows
              #   ls: dir
              #   target: aarch64
              #   interpreter: 3.11 3.12
          - os: macos
            target: aarch64
            interpreter: "3.14"
          - os: ubuntu
            platform: linux
            target: i686
          - os: ubuntu
            platform: linux
            target: aarch64

          - os: ubuntu
            platform: linux
            target: armv7
            interpreter: "3.14"
          # musllinux
          - os: ubuntu
            platform: linux
            target: x86_64
            manylinux: musllinux_1_1
          - os: ubuntu
            platform: linux
            target: aarch64
            manylinux: musllinux_1_1
          - os: ubuntu
            platform: linux
            target: ppc64le
            interpreter: "3.14"
          - os: ubuntu
            platform: linux
            target: s390x
            interpreter: "3.14"

          # --- Free-threaded Python 3.14t wheels -------------------------
          # `flavor: ft` switches the build to non-abi3 (`--no-default-features
          # --features ext-module`) and `--interpreter 3.14t`, derived from
          # `flavor` in the maturin invocation below. linux container builds
          # (manylinux/musllinux) get 3.14t from the docker image, so
          # `python-install` is unset for those; macOS/windows host builds
          # need it set explicitly so setup-python actually installs 3.14t.
          # windows-11-arm 3.14t is intentionally absent — see the abi3
          # windows-11-arm entry above (upstream-broken package).
          - { os: ubuntu, platform: linux, target: x86_64,  manylinux: auto,           flavor: ft }
          - { os: ubuntu, platform: linux, target: aarch64, manylinux: auto,           flavor: ft }
          - { os: ubuntu, platform: linux, target: x86_64,  manylinux: musllinux_1_1,  flavor: ft }
          - { os: ubuntu, platform: linux, target: aarch64, manylinux: musllinux_1_1,  flavor: ft }
          - { os: macos,                   target: x86_64,  manylinux: auto,           flavor: ft, python-install: "3.14t" }
          - { os: macos,                   target: aarch64, manylinux: auto,           flavor: ft, python-install: "3.14t" }
          - { os: windows, ls: dir, target: x86_64, manylinux: auto, python-architecture: x64, python-install: "3.14t", flavor: ft }
        exclude:
          - os: windows
            target: aarch64
              #   # Optimized PGO builds for x86_64 manylinux and windows follow a different matrix,
              #   # maybe in future maturin-action can support this automatically
              #   - os: ubuntu
              #     target: x86_64
              #     manylinux: auto
              #   - os: windows
              #     target: x86_64
              # Windows on arm64 only supports Python 3.11+

    runs-on: ${{
        matrix.os == 'windows-11-arm' && matrix.os ||
        format('{0}-latest', matrix.os)
      }}
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2

      - name: set up python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
        with:
          python-version: ${{ matrix.python-install || '3.14' }}
          architecture: ${{ matrix.python-architecture || 'x64' }}

      - run: pip install -U twine

      - name: build wheels
        uses: PyO3/maturin-action@3e2bdf6ba6453a61e649744019b8a2d906c7eb38  # v1.51.0
        with:
          target: ${{ matrix.target }}
          working-directory: ./bindings/python
          manylinux: ${{ matrix.manylinux || 'auto' }}
          container: ${{ matrix.container }}
          # `flavor=ft` builds drop the abi3 cargo feature so the resulting
          # wheel is non-abi3 (free-threaded Python can't load limited-API
          # extensions). `flavor=abi3` builds use defaults.
          args: >-
            --release --out dist
            --interpreter ${{ matrix.flavor == 'ft' && '3.14t' || matrix.interpreter || '3.14' }}
            ${{ matrix.flavor == 'ft' && '--no-default-features --features ext-module' || '' }}
          rust-toolchain: stable
          sccache: false
          docker-options: -e CI

      - run: ${{ matrix.ls || 'ls -lh' }} dist/
        working-directory: ./bindings/python

      - run: twine check --strict dist/*
        working-directory: ./bindings/python

      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
        with:
          name: pypi_files-${{ matrix.os }}-${{ matrix.target }}-${{ matrix.manylinux }}-${{ matrix.flavor || 'abi3' }}
          path: ./bindings/python/dist
  build-sdist:
    name: build sdist
    needs: [lock_exists]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
      - uses: PyO3/maturin-action@3e2bdf6ba6453a61e649744019b8a2d906c7eb38  # v1.51.0
        with:
          working-directory: ./bindings/python
          command: sdist
          args: --out dist
          rust-toolchain: stable
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
        with:
          name: pypi_files-srt
          path: ./bindings/python/dist


  upload_package:
    name: Upload package to PyPi
    runs-on: ubuntu-latest
    needs: [build, build-sdist]
    env:
      PYPI_TOKEN: ${{ secrets.PYPI_TOKEN_DIST }}

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2

      - name: Install Python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
        with:
          python-version: "3.14"
          architecture: x64

      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
        with:
          path: ./bindings/python/dist
          merge-multiple: true
          # Temporary deactivation while testing abi3 CI
          # - name: Upload to PyPi
          #   working-directory: ./bindings/python
          #   run: |
          #     pip install twine
          #     twine upload dist/* -u __token__ -p "$PYPI_TOKEN"