firstpass/.github/workflows/python-wheels.yml at main · dshakes/firstpass · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
name: python-wheels
# Build Firstpass as Python wheels so `pip install firstpass` and `uvx firstpass`
# work without a Rust toolchain — the maturin `bindings = "bin"` model ruff/uv use.
# Wheels + sdist build on every v* tag. Publishing to PyPI uses trusted publishing
# (OIDC, no long-lived token) and is gated on the repo variable PUBLISH_TO_PYPI —
# mirrors the distil release setup. Until that var is 'true' a tag still produces
# wheel artifacts; only the registry push is skipped.
#
# One-time PyPI setup (pypi.org → Publishing → Add a pending publisher):
#   Project: firstpass · Owner: dshakes · Repo: firstpass
#   Workflow: python-wheels.yml · Environment: pypi
# then set repo variable PUBLISH_TO_PYPI = true.
on:
  push:
    tags: ["v*"]
  workflow_dispatch:

permissions:
  contents: read

jobs:
  wheels:
    name: wheels (${{ matrix.target }})
    runs-on: ${{ matrix.runner }}
    strategy:
      fail-fast: false
      matrix:
        include:
          # Both macOS wheels build on the arm64 runner (x86_64 via cross) —
          # the macos-13 Intel runner is being retired and queues indefinitely.
          - { runner: macos-latest,   target: aarch64-apple-darwin }
          - { runner: macos-latest,   target: x86_64-apple-darwin }
          - { runner: ubuntu-22.04,   target: x86_64-unknown-linux-gnu }
          - { runner: ubuntu-22.04,   target: aarch64-unknown-linux-gnu }
          - { runner: windows-latest, target: x86_64-pc-windows-msvc }
    steps:
      - uses: actions/checkout@v4
      - name: Build wheel
        uses: PyO3/maturin-action@v1
        with:
          working-directory: crates/firstpass-proxy
          target: ${{ matrix.target }}
          args: --release --out dist
          manylinux: auto
          # ring's aarch64 asm needs __ARM_ARCH defined or the manylinux cross-gcc
          # errors ("ARM assembler must define __ARM_ARCH"). Target-scoped, so it
          # only affects the aarch64-linux build.
          before-script-linux: export CFLAGS_aarch64_unknown_linux_gnu="-D__ARM_ARCH=8"
      - uses: actions/upload-artifact@v4
        with:
          name: wheels-${{ matrix.target }}
          path: crates/firstpass-proxy/dist/*.whl

  sdist:
    name: sdist
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Build sdist
        uses: PyO3/maturin-action@v1
        with:
          working-directory: crates/firstpass-proxy
          command: sdist
          args: --out dist
      - uses: actions/upload-artifact@v4
        with:
          name: wheels-sdist
          path: crates/firstpass-proxy/dist/*.tar.gz

  publish:
    name: publish to PyPI
    needs: [wheels, sdist]
    runs-on: ubuntu-latest
    # Trusted publishing; opt-in via repo variable once the PyPI publisher exists.
    if: ${{ startsWith(github.ref, 'refs/tags/') && vars.PUBLISH_TO_PYPI == 'true' }}
    environment:
      name: pypi
      url: https://pypi.org/p/firstpass
    permissions:
      id-token: write
    steps:
      - uses: actions/download-artifact@v4
        with:
          pattern: wheels-*
          path: dist
          merge-multiple: true
      - uses: pypa/gh-action-pypi-publish@release/v1
        with:
          # tolerate re-running a release for a version already on PyPI
          skip-existing: true