python.yml

name: Python CI & Wheels

on:
  # Tags only, plus the daily schedule below. On a push to main this workflow
  # ran the OS x Python test matrix, which `test-python` in ci.yml (Linux, one
  # interpreter) does not replace -- so that matrix now runs on main once a
  # day instead of on every merge, where its eight legs held hosted runners
  # the account shares across every repository (docs/CI.md).
  push:
    tags:
      - 'v*'
  schedule:
    - cron: "11 7 * * *"
  # Single-anchor releases (#313): PyPI publishes only after the canonical
  # GitHub Release exists — never straight off a tag push. A tag push still
  # builds wheels/sdist as artifacts (pre-validation), but does not publish.
  release:
    types: [published]
  # A release created by release.yml with GITHUB_TOKEN does NOT emit a
  # `release` event to other workflows (GitHub suppresses token-caused events,
  # except workflow_dispatch/repository_dispatch — the v0.4.1 lesson). The
  # github-release job therefore dispatches this workflow explicitly with the
  # release tag; the `release:` trigger above still serves manually-published
  # releases.
  workflow_dispatch:
    inputs:
      publish:
        description: 'Publish to PyPI (only for a real release dispatch)'
        type: boolean
        default: false
      release_tag:
        description: 'Release tag to build and publish (e.g. v0.4.1); empty = current ref'
        type: string
        default: ''

concurrency:
  group: python-${{ github.workflow }}-${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

env:
  # The compiler, as in release.yml: an exact version, never a channel.
  RELEASE_TOOLCHAIN: "1.99.0"
  # The maturin that builds the published wheels and sdist. maturin-action
  # otherwise resolves the newest release matching pyproject.toml's range on
  # the day. Equal to the maturin pin in .github/requirements/python-bindings.in,
  # which the test job builds with; scripts/check_release_workflow.py holds both.
  MATURIN_VERSION: "v1.16.0"

# Minimal default; the publish-pypi job elevates id-token itself.
permissions:
  contents: read

jobs:
  test:
    name: Test Python Bindings (${{ matrix.os }}, Py ${{ matrix.python-version }})
    strategy:
      fail-fast: false
      # Exact images and interpreters: the ones `macos-latest`, `windows-latest`
      # and the minor-only versions resolved to in the v0.16.0 release dispatch
      # (run 40257579245). setup-python's builds differ per OS, so the patch
      # release is listed per row.
      matrix:
        include:
          - { os: ubuntu-24.04, python-version: "3.10.22" }
          - { os: ubuntu-24.04, python-version: "3.12.15" }
          - { os: macos-26, python-version: "3.10.11" }
          - { os: macos-26, python-version: "3.12.10" }
          - { os: windows-2025-vs2026, python-version: "3.10.11" }
          - { os: windows-2025-vs2026, python-version: "3.12.10" }
    runs-on: ${{ matrix.os }}
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ inputs.release_tag || github.ref }}
          persist-credentials: false

      - name: Set up Python ${{ matrix.python-version }}
        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
        with:
          python-version: ${{ matrix.python-version }}

      - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
        with:
          toolchain: ${{ env.RELEASE_TOOLCHAIN }}

      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3

      - name: Install build and test dependencies
        run: |
          python -m pip install --require-hashes -r .github/requirements/python-bindings.txt

      - name: Build and install expanse-trie
        run: |
          pip install --no-deps --no-build-isolation .

      - name: Run Pytest suite
        run: |
          pytest tests/test_python_bindings.py -v

  wheels:
    name: Build Wheels (${{ matrix.target }} - ${{ matrix.os }})
    if: startsWith(github.ref, 'refs/tags/v') || github.event_name == 'workflow_dispatch'
    strategy:
      fail-fast: false
      max-parallel: 4
      matrix:
        include:
          # Images and interpreters as resolved in run 40257579245.
          - os: ubuntu-24.04
            target: x86_64-unknown-linux-gnu
            manylinux: auto
            python: "3.10.22"
          - os: ubuntu-24.04
            target: aarch64-unknown-linux-gnu
            manylinux: auto
            python: "3.10.22"
          - os: macos-26
            target: aarch64-apple-darwin
            python: "3.10.11"
          - os: macos-26
            target: x86_64-apple-darwin
            python: "3.10.11"
          - os: windows-2025-vs2026
            target: x86_64-pc-windows-msvc
            python: "3.10.11"
    runs-on: ${{ matrix.os }}
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ inputs.release_tag || github.ref }}
          persist-credentials: false

      - name: Set up Python
        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
        with:
          python-version: ${{ matrix.python }}

      - name: Build wheels via maturin-action
        uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
        with:
          maturin-version: ${{ env.MATURIN_VERSION }}
          target: ${{ matrix.target }}
          args: -m crates/expanse-py/Cargo.toml --release --out dist --find-interpreter
          manylinux: ${{ matrix.manylinux }}

      - name: Upload wheel artifact
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: wheels-${{ matrix.target }}
          path: dist/*.whl
          if-no-files-found: error

  sdist:
    name: Build Source Distribution (sdist)
    if: startsWith(github.ref, 'refs/tags/v') || github.event_name == 'workflow_dispatch'
    runs-on: ubuntu-24.04
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ inputs.release_tag || github.ref }}
          persist-credentials: false

      - name: Set up Python
        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
        with:
          python-version: "3.10.22"  # as resolved in run 40257579245

      - name: Build sdist via maturin-action
        uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
        with:
          maturin-version: ${{ env.MATURIN_VERSION }}
          command: sdist
          args: --out dist

      - name: Upload sdist artifact
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: sdist
          path: dist/*.tar.gz
          if-no-files-found: error

  publish-pypi:
    name: Publish to PyPI
    needs: [test, wheels, sdist]
    runs-on: ubuntu-24.04
    # Anchor-first (#313): publish only for a GitHub Release — either the
    # `release` event (manual releases) or the explicit dispatch from
    # release.yml's github-release job (the pipeline's path, since
    # GITHUB_TOKEN-created releases emit no event). Wheels/sdist above are
    # built from the dispatched release_tag.
    # A pre-release published by hand is not a PyPI release: the manifests of
    # an `-rc` tag carry the final version, and PyPI cannot take one back.
    if: (github.event_name == 'release' && !github.event.release.prerelease) || (github.event_name == 'workflow_dispatch' && inputs.publish)
    permissions:
      id-token: write # Required for OIDC trusted publishing
      contents: read
    steps:
      - name: Download wheel and sdist artifacts
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          pattern: '{wheels-*,sdist}'
          merge-multiple: true
          path: dist

      - name: Publish package distributions to PyPI
        uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # release/v1
        with:
          packages-dir: dist/
          skip-existing: true