python-packaging.yml

# This file was mostly autogenerated by maturin v1.7.1
# To update, run
#
#    maturin generate-ci github --manifest-path py-binding/Cargo.toml
#
# NOTE: There are some customizations added to the generated output.
# - workflow name is more descriptive
# - use zig compiler on most cross-compiled Linux wheels
name: Python builds

on:
  push:
    branches: [main]
    paths:
      - cpp-linter/**.{rs,toml}
      - clang-tools-manager/src/**
      - clang-tools-manager/Cargo.toml
      - bindings/python/**
      - Cargo.{toml,lock}
      - .github/workflows/python-packaging.yml
      - pyproject.toml
    tags:
      - 'cpp-linter-py/v*'
  pull_request:
    branches: [main]
    paths:
      - cpp-linter/**.{rs,toml}
      - clang-tools-manager/src/**
      - clang-tools-manager/Cargo.toml
      - bindings/python/**
      - Cargo.{toml,lock}
      - .github/workflows/python-packaging.yml
      - pyproject.toml

env:
  CARGO_TERM_COLOR: always
  RUST_BACKTRACE: 1

permissions: {}

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}

jobs:
  seed-build-script:
    runs-on: ubuntu-latest
    name: Pre-seed static binaries' versions
    steps:
      - env:
          GITHUB_TOKEN: ${{ github.token }}
        run: >-
          gh release download
          -R cpp-linter/clang-tools-static-binaries
          --pattern versions.json
          --output versions.json
      - name: Upload versions.json
        uses: actions/upload-artifact@v7
        with:
          name: static-binary-versions
          path: versions.json
          if-no-files-found: error

  linux:
    needs: [seed-build-script]
    runs-on: ${{ matrix.platform.runner }}
    strategy:
      fail-fast: false
      matrix:
        platform:
          - runner: ubuntu-latest
            target: x86_64
          - runner: ubuntu-latest
            target: x86
          - runner: ubuntu-latest
            target: aarch64
          - runner: ubuntu-latest
            target: armv7
          # These targets currently fail because the docker containers used for building manylinux wheels
          # use a known-bad C compiler version; aws-lc-sys refuses to build with the bad compiler:
          # https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95189
          # - runner: ubuntu-latest
          #   target: s390x
          # - runner: ubuntu-latest
          #   target: ppc64le
    steps:
      - uses: actions/checkout@v6.0.2
        with:
          persist-credentials: false
      - uses: actions/setup-python@v6
        with:
          python-version: '3.x'
      - name: Restore build script seed
        uses: actions/download-artifact@v8
        with:
          name: static-binary-versions
          path: clang-tools-manager
      - name: Build wheels
        uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
        with:
          target: ${{ matrix.platform.target }}
          # Use the zig toolchain for all targets except ppc64le.
          # Note, this is meant to avoid build errors in aws-lc-sys crate, which compiles C code.
          args: >-
            --release --out dist --find-interpreter --zig
          # avoid cache-poisoning potential for actually distributed builds
          sccache: ${{ startsWith(github.ref, 'refs/tags') && 'false' || 'true' }}
          manylinux: 'auto'
          # before-script-linux: |
          #   case "${{ matrix.platform.target }}" in
          #     ppc64le)
          #       apt-get update
          #       apt-get install -y \
          #         pkg-config \
          #         gcc-powerpc64le-linux-gnu \
          #         g++-powerpc64le-linux-gnu \
          #         binutils-powerpc64le-linux-gnu \
          #         libc6-dev-ppc64el-cross
          #        ;;
          #   esac
      - name: Upload wheels
        uses: actions/upload-artifact@v7
        with:
          name: wheels-linux-${{ matrix.platform.target }}
          path: dist/*

  windows:
    needs: [seed-build-script]
    runs-on: ${{ matrix.platform.runner }}
    strategy:
      matrix:
        platform:
          - runner: windows-latest
            target: x64
          - runner: windows-latest
            target: x86
    steps:
      - uses: actions/checkout@v6.0.2
        with:
          persist-credentials: false
      - uses: actions/setup-python@v6
        with:
          python-version: '3.x'
          architecture: ${{ matrix.platform.target }}
      - name: Restore build script seed
        uses: actions/download-artifact@v8
        with:
          name: static-binary-versions
          path: clang-tools-manager
      - name: Build wheels
        uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
        with:
          target: ${{ matrix.platform.target }}
          args: --release --out dist --find-interpreter
          sccache: ${{ !startsWith(github.ref, 'refs/tags/') }} # zizmor: ignore[cache-poisoning]
      - name: Upload wheels
        uses: actions/upload-artifact@v7
        with:
          name: wheels-windows-${{ matrix.platform.target }}
          path: dist/*

  macos:
    needs: [seed-build-script]
    runs-on: ${{ matrix.platform.runner }}
    strategy:
      fail-fast: false
      matrix:
        platform:
          - runner: macos-15-intel
            target: x86_64
          - runner: macos-15
            target: aarch64
    steps:
      - uses: actions/checkout@v6.0.2
        with:
          persist-credentials: false
      - uses: actions/setup-python@v6
        with:
          python-version: '3.x'
      - name: Restore build script seed
        uses: actions/download-artifact@v8
        with:
          name: static-binary-versions
          path: clang-tools-manager
      - name: Build wheels
        uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
        with:
          target: ${{ matrix.platform.target }}
          args: --release --out dist --find-interpreter
          sccache: ${{ !startsWith(github.ref, 'refs/tags/') }} # zizmor: ignore[cache-poisoning]
      - name: Upload wheels
        uses: actions/upload-artifact@v7
        with:
          name: wheels-macos-${{ matrix.platform.target }}
          path: dist/*

  sdist:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6.0.2
        with:
          persist-credentials: false
      - uses: actions/setup-python@v6
        with:
          python-version: 3.x
      - name: Build sdist
        uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
        with:
          command: sdist
          args: --out dist
      - name: Upload sdist
        uses: actions/upload-artifact@v7
        with:
          name: wheels-sdist
          path: dist/*

  release:
    name: Release
    runs-on: ubuntu-latest
    needs: [linux, windows, macos, sdist]
    permissions:
      id-token: write
    steps:
      - uses: actions/download-artifact@v8
        with:
          pattern: wheels-*
          path: dist
          merge-multiple: true
      - name: Setup Python
        if: ${{ !startsWith(github.ref, 'refs/tags/cpp-linter-py/v') }}
        uses: actions/setup-python@v6
        with:
          python-version: 3.x
      - name: Check distributions
        if: ${{ !startsWith(github.ref, 'refs/tags/cpp-linter-py/v') }}
        run: pipx run twine check dist/*
      - name: Publish to PyPI
        if: startsWith(github.ref, 'refs/tags/cpp-linter-py/v')
        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
        with:
          skip-existing: true
          # This workflow is registered as a trusted publisher (for test-pypi and pypi).
          # A token should not be required (and actually is discouraged with trusted publishers).
          repository-url: ${{ contains(github.ref_name, 'rc') && 'https://test.pypi.org/legacy/' || 'https://upload.pypi.org/legacy/' }}