python.yml

name: Python

on:
  push:
    branches: [trunk]
    tags: ['v*']
    paths:
      - 'slonq-python/**'
      - 'slonq-core/**'
      - 'Cargo.toml'
      - 'Cargo.lock'
      - '.github/workflows/python.yml'
  pull_request:
    branches: [trunk]
    paths:
      - 'slonq-python/**'
      - 'slonq-core/**'
      - 'Cargo.toml'
      - 'Cargo.lock'
      - '.github/workflows/python.yml'
  workflow_dispatch:

env:
  CARGO_TERM_COLOR: always
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: 'true'

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ !startsWith(github.ref, 'refs/tags/') }}

defaults:
  run:
    shell: bash

jobs:
  test:
    name: Test
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Install Python 3.x
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: '3.x'

      - name: Install uv
        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0

      - name: Install Rust stable
        uses: dtolnay/rust-toolchain@efa25f7f19611383d5b0ccf2d1c8914531636bf9
        with:
          toolchain: stable

      - name: Cargo cache
        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1

      - name: maturin develop + pytest
        working-directory: slonq-python
        run: |
          uv run maturin develop
          uv run pytest

  build:
    # Build matrix runs on every trigger, so we catch platform-specific failures before release.
    # Wheel artifacts, on the other hand, are only uploaded on push/workflow_dispatch.
    name: Build wheels (${{ matrix.platform.key }})
    runs-on: ${{ matrix.platform.runner }}
    strategy:
      fail-fast: false
      matrix:
        platform:
          # Linux gnu (manylinux). aarch64 cross-compiles via QEMU inside maturin-action.
          - key: linux-x64-gnu
            runner: ubuntu-22.04
            target: x86_64
            manylinux: auto
            python_arch: x64
          - key: linux-arm64-gnu
            runner: ubuntu-22.04
            target: aarch64
            manylinux: auto
            python_arch: x64
          # Linux musl (musllinux). Same QEMU story for aarch64.
          - key: linux-x64-musl
            runner: ubuntu-22.04
            target: x86_64
            manylinux: musllinux_1_2
            python_arch: x64
          - key: linux-arm64-musl
            runner: ubuntu-22.04
            target: aarch64
            manylinux: musllinux_1_2
            python_arch: x64
          # macOS
          - key: macos-x64
            runner: macos-15-intel
            target: x86_64
            manylinux: ''
            python_arch: x64
          - key: macos-arm64
            runner: macos-latest
            target: aarch64
            manylinux: ''
            python_arch: arm64
          # Windows.
          - key: windows-x64
            runner: windows-latest
            target: x64
            manylinux: ''
            python_arch: x64
          - key: windows-arm64
            runner: windows-11-arm
            target: aarch64
            manylinux: ''
            python_arch: arm64
    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Install Python 3.x
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: ${{ matrix.platform.key == 'windows-arm64' && '3.13' || '3.x' }}
          architecture: ${{ matrix.platform.python_arch }}

      - name: Build wheels
        uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
        with:
          working-directory: slonq-python
          target: ${{ matrix.platform.target }}
          args: --release --out dist --find-interpreter
          sccache: ${{ !startsWith(github.ref, 'refs/tags/') }}
          manylinux: ${{ matrix.platform.manylinux }}

      # Only upload wheel artifacts on push/dispatch — PR runs verify the
      # build but discard output to save artifact storage.
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        if: ${{ github.event_name == 'push' || github.event_name == 'workflow_dispatch' }}
        with:
          name: wheels-${{ matrix.platform.key }}
          path: slonq-python/dist
          if-no-files-found: error

  sdist:
    name: Build sdist
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Build sdist
        uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
        with:
          working-directory: slonq-python
          command: sdist
          args: --out dist

      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        if: ${{ github.event_name == 'push' || github.event_name == 'workflow_dispatch' }}
        with:
          name: wheels-sdist
          path: slonq-python/dist
          if-no-files-found: error

  release:
    name: Release
    runs-on: ubuntu-latest
    if: ${{ startsWith(github.ref, 'refs/tags/') || github.event_name == 'workflow_dispatch' }}
    needs: [build, sdist]
    permissions:
      id-token: write
      contents: write
      attestations: write
    steps:
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          path: artifacts

      - name: Stage wheels into one directory
        run: |
          mkdir -p dist
          find artifacts -name '*.whl' -o -name '*.tar.gz' | xargs -I{} cp {} dist/

      - name: Generate artifact attestation
        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
        with:
          subject-path: 'dist/*'

      - name: Install uv
        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0

      - name: Publish to PyPI
        env:
          UV_PUBLISH_TOKEN: ${{ secrets.PYPI_API_TOKEN }}
        # `--check-url` lets a re-run after a partial-failure tag skip wheels that
        # already exist on PyPI instead of erroring out.
        run: uv publish --check-url https://pypi.org/simple/ 'dist/*'

  ci-passed:
    # Aggregator job. Branch protection / Repository Rulesets should require this
    # check; it gives a stable status name regardless of which prereq jobs ran.
    name: CI passed
    runs-on: ubuntu-latest
    needs: [test, build, sdist]
    if: always()
    steps:
      - name: Verify prerequisite jobs
        run: |
          fail=0
          for r in "${{ needs.test.result }}" "${{ needs.build.result }}" "${{ needs.sdist.result }}"; do
            case "$r" in
              success|skipped) ;;
              *) echo "::error::prerequisite job result: $r"; fail=1 ;;
            esac
          done
          exit $fail