python.yml

# This file is autogenerated by maturin v1.12.6 and **manually** edited. You can
# regenerate it as follows but do not forget to re-add the manual bits:
#
#    maturin generate-ci github --pytest --manifest-path bindings/py/Cargo.toml
#
name: Python

on:
  push:
    branches: ["main"]
    tags: ["*"]
    paths:
      - "bindings/py/**"
      - "core/**"
      - "sysand/**"
      - "Cargo.*"
      - ".github/workflows/python.yml"
      - ".github/scripts/*"
  pull_request:
    branches: ["main"]
    paths:
      - "bindings/py/**"
      - "core/**"
      - "sysand/**"
      - "Cargo.*"
      - ".github/workflows/python.yml"
      - ".github/scripts/*"
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

defaults:
  run:
    shell: bash

env:
  CARGO_NET_RETRY: 10
  RUSTUP_MAX_RETRIES: 10
  UV_HTTP_RETRIES: 5
  UV_HTTP_TIMEOUT: 60

jobs:
  windows:
    runs-on: ${{ matrix.platform.runner }}
    strategy:
      matrix:
        platform:
          - runner: windows-latest
            target: x64
            rust_target: x86_64-pc-windows-msvc
          - runner: windows-latest
            target: x86
            rust_target: i686-pc-windows-msvc
          - runner: windows-11-arm
            target: arm64 # not aarch64 because expected by setup-python
            rust_target: aarch64-pc-windows-msvc
        # A single python version is used for each run, because some tools
        # don't know which version to use if multiple are present
        python:
          - version: "3.13"
            label: "default"
            args_suffix: ""
          - version: "3.13t"
            label: 3.13-free-threaded
            args_suffix: " --interpreter python3.13t"
          - version: "3.14t"
            label: 3.14-free-threaded
            args_suffix: " --interpreter python3.14t"
        exclude:
          # Free-threaded python does not work on windows arm currently
          # https://github.com/actions/setup-python/issues/1267
          - platform:
              runner: windows-11-arm
            python:
              version: "3.13t"
          - platform:
              runner: windows-11-arm
            python:
              version: "3.14t"
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: ${{ matrix.python.version }}
          architecture: ${{ matrix.platform.target }}
      - name: Build wheels
        uses: PyO3/maturin-action@86b9d133d34bc1b40018696f782949dac11bd380 # 1.49.4
        with:
          target: ${{ matrix.platform.rust_target }}
          args: --release --out dist --compatibility pypi --manifest-path bindings/py/Cargo.toml${{ matrix.python.args_suffix }}
          sccache: ${{ !startsWith(github.ref, 'refs/tags/') }}
      - name: Upload wheels
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          name: wheels-windows-${{ matrix.platform.target }}-${{ matrix.python.label }}
          path: dist
      - name: Run Rust tests for Python bindings
        run: |
          cd bindings/py
          cargo test --locked --package sysand-py --verbose --no-default-features --target ${{ matrix.platform.rust_target }}
      - name: Install uv
        uses: astral-sh/setup-uv@e06108dd0aef18192324c70427afc47652e63a82 # 7.5.0
      - name: pytest
        run: |
          export UV_PYTHON=${{ matrix.python.version }}
          export ACTIVATION_SCRIPT=.venv/Scripts/activate
          /bin/bash .github/scripts/run-pytest.sh ${{ matrix.python.version }}

  musllinux:
    runs-on: ${{ matrix.platform.runner }}
    strategy:
      matrix:
        platform:
          - runner: ubuntu-22.04
            target: x86_64
            native: true
          - runner: ubuntu-22.04
            target: x86
            native: true
          - runner: ubuntu-22.04-arm
            target: aarch64
            native: true
          - runner: ubuntu-22.04
            target: armv7
            native: false
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: Run Rust tests for Python bindings
        run: cargo test --locked --package sysand-py --verbose --no-default-features
      - name: Build wheels
        uses: PyO3/maturin-action@86b9d133d34bc1b40018696f782949dac11bd380 # 1.49.4
        with:
          target: ${{ matrix.platform.target }}
          args: --release --out dist --compatibility pypi --manifest-path bindings/py/Cargo.toml
          sccache: ${{ !startsWith(github.ref, 'refs/tags/') }}
          manylinux: musllinux_1_2
      - name: Build free-threaded wheels
        uses: PyO3/maturin-action@86b9d133d34bc1b40018696f782949dac11bd380 # 1.49.4
        with:
          target: ${{ matrix.platform.target }}
          args: --release --out dist --compatibility pypi --manifest-path bindings/py/Cargo.toml --interpreter python3.13t --interpreter python3.14t
          sccache: ${{ !startsWith(github.ref, 'refs/tags/') }}
          manylinux: musllinux_1_2
      - name: Upload wheels
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          name: wheels-musllinux-${{ matrix.platform.target }}
          path: dist
      - name: pytest (native)
        if: ${{ matrix.platform.native }}
        uses: maus007/docker-run-action-fork@5ddaad0f7eedd03f64e412b1931852bd3031b273 # v1
        with:
          image: ${{ matrix.platform.target == 'x86' && 'i386/alpine:latest' || 'alpine:latest' }}
          options: -v ${{ github.workspace }}:/io -w /io
          run: |
            apk add curl bash python3
            curl -LsSf https://astral.sh/uv/install.sh | sh
            export PATH=$PATH:$HOME/.local/bin
            /bin/bash .github/scripts/run-pytest.sh
      - name: pytest (emulated)
        if: ${{ !matrix.platform.native }}
        uses: uraimo/run-on-arch-action@d94c13912ea685de38fccc1109385b83fd79427d # 3.0.1
        with:
          arch: ${{ matrix.platform.target }}
          distro: alpine_latest
          githubToken: ${{ github.token }}
          install: |
            apk add curl bash python3
          run: |
            curl -LsSf https://astral.sh/uv/install.sh | sh
            export PATH=$PATH:$HOME/.local/bin
            /bin/bash .github/scripts/run-pytest.sh

  linux:
    runs-on: ${{ matrix.platform.runner }}
    strategy:
      matrix:
        platform:
          - runner: ubuntu-22.04
            target: x86_64
            native: true
          - runner: ubuntu-22.04
            target: x86
            native: true
          - runner: ubuntu-22.04-arm
            target: aarch64
            native: true
          - runner: ubuntu-22.04
            target: armv7
            native: false
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: Run Rust tests for Python bindings
        run: cargo test --locked --package sysand-py --verbose --no-default-features
      - name: Build wheels
        uses: PyO3/maturin-action@86b9d133d34bc1b40018696f782949dac11bd380 # 1.49.4
        with:
          target: ${{ matrix.platform.target }}
          args: --release --out dist --compatibility pypi --manifest-path bindings/py/Cargo.toml
          sccache: ${{ !startsWith(github.ref, 'refs/tags/') }}
          manylinux: manylinux2014
      - name: Build free-threaded wheels
        uses: PyO3/maturin-action@86b9d133d34bc1b40018696f782949dac11bd380 # 1.49.4
        with:
          target: ${{ matrix.platform.target }}
          args: --release --out dist --compatibility pypi --manifest-path bindings/py/Cargo.toml --interpreter python3.13t --interpreter python3.14t
          sccache: ${{ !startsWith(github.ref, 'refs/tags/') }}
          manylinux: manylinux2014 # TODO: don't use default cross-compile containers for aarch64
      - name: Upload wheels
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          name: wheels-linux-${{ matrix.platform.target }}
          path: dist
      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: 3.14
      - name: Install uv
        uses: astral-sh/setup-uv@e06108dd0aef18192324c70427afc47652e63a82 # 7.5.0
      - name: pytest (native)
        # TODO: run tests on x86_32. Currently skipped because no containers are used here
        # and run-on-arch-action does not support x86_32
        if: ${{ matrix.platform.native && matrix.platform.target != 'x86' }}
        run: /bin/bash .github/scripts/run-pytest.sh
      - name: pytest (emulated)
        if: ${{ !matrix.platform.native }}
        uses: uraimo/run-on-arch-action@d94c13912ea685de38fccc1109385b83fd79427d # 3.0.1
        with:
          arch: ${{ matrix.platform.target }}
          distro: ubuntu22.04
          githubToken: ${{ github.token }}
          install: |
            apt-get update
            apt-get install -y curl python3
            curl -LsSf https://astral.sh/uv/install.sh | sh
          run: |
            export PATH=$PATH:$HOME/.local/bin
            /bin/bash .github/scripts/run-pytest.sh
      - name: linters
        if: ${{ matrix.platform.target == 'x86_64' }}
        run: |
          cd bindings/py
          source .venv/bin/activate
          uv sync --group linters --active --no-install-project --locked
          ruff format --check python tests
          ruff check python
          mypy --strict python

  macos:
    runs-on: ${{ matrix.platform.runner }}
    strategy:
      matrix:
        platform:
          - runner: macos-15-intel
            target: x86_64
          - runner: macos-14
            target: aarch64
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: 3.14
      - name: Run Rust tests for Python bindings
        run: cargo test --locked --package sysand-py --verbose --no-default-features
      - name: Build wheels
        uses: PyO3/maturin-action@86b9d133d34bc1b40018696f782949dac11bd380 # 1.49.4
        with:
          target: ${{ matrix.platform.target }}
          args: --release --out dist --compatibility pypi --manifest-path bindings/py/Cargo.toml
          sccache: ${{ !startsWith(github.ref, 'refs/tags/') }}
      - name: Build free-threaded wheels
        uses: PyO3/maturin-action@86b9d133d34bc1b40018696f782949dac11bd380 # 1.49.4
        with:
          target: ${{ matrix.platform.target }}
          args: --release --out dist --compatibility pypi --manifest-path bindings/py/Cargo.toml --interpreter python3.13t --interpreter python3.14t
          sccache: ${{ !startsWith(github.ref, 'refs/tags/') }}
      - name: Upload wheels
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          name: wheels-macos-${{ matrix.platform.target }}
          path: dist
      - name: Install uv
        uses: astral-sh/setup-uv@e06108dd0aef18192324c70427afc47652e63a82 # 7.5.0
      - name: pytest
        run: |
          /bin/bash .github/scripts/run-pytest.sh

  sdist:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: Maturin fixup
        # Maturin-action blindly downloads the specified toolchain without
        # checking that it won't be needed at all for sdist
        # TODO: fix maturin so that this isn't needed
        run: rm rust-toolchain.toml
      - name: Build sdist
        uses: PyO3/maturin-action@86b9d133d34bc1b40018696f782949dac11bd380 # 1.49.4
        with:
          command: sdist
          args: --out dist --manifest-path bindings/py/Cargo.toml
      - name: Upload sdist
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          name: wheels-sdist
          path: dist

  release:
    name: Release to PyPI
    environment: pypi-publish
    runs-on: ubuntu-slim
    if: ${{ startsWith(github.ref, 'refs/tags/') || github.event_name == 'workflow_dispatch' }}
    needs: [linux, musllinux, macos, windows, sdist]
    permissions:
      # Used to sign the release artifacts
      id-token: write
      # Used to upload release artifacts
      contents: write
      # Used to generate artifact attestation
      attestations: write
    steps:
      - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
      - name: Generate artifact attestation
        id: attest
        uses: actions/attest-build-provenance@00014ed6ed5efc5b1ab7f7f34a39eb55d41aa4f8 # v3.1.0
        with:
          subject-path: "wheels-*/*"
      - name: Prepare attestations for uv
        run: |
          # The action creates one attestation bundle for all artifacts, but
          # uv expects a separate .publish.attestation file for each artifact
          for file in wheels-*/*; do
            cp "${{ steps.attest.outputs.bundle-path }}" "$file.publish.attestation"
          done
      - name: Install uv
        uses: astral-sh/setup-uv@e06108dd0aef18192324c70427afc47652e63a82 # 7.5.0
        if: ${{ github.event_name == 'push' && startsWith(github.ref, 'refs/tags/') }}
      - name: Publish to PyPI
        if: ${{ github.event_name == 'push' && startsWith(github.ref, 'refs/tags/') }}
        run: |
          uv publish -v --trusted-publishing always wheels-*/*