CI.yml

name: CI

on:
  push:
    tags:
      - "v*"
  workflow_run:
    workflows: ["Release"]
    types: [completed]

permissions:
  contents: read

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: false

env:
  CARGO_TERM_COLOR: always

jobs:
  quality:
    name: Quality Checks
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: recursive
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
      - uses: astral-sh/setup-uv@v5
      - uses: dtolnay/rust-toolchain@stable
      - name: Install dev dependencies
        run: uv sync --group dev --no-install-project
      - name: Ruff lint
        run: uv run --no-project ruff check .
      - name: Ruff format check
        run: uv run --no-project ruff format --check .

  tests:
    name: Python Tests
    needs: quality
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: recursive
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
      - uses: astral-sh/setup-uv@v5
      - uses: dtolnay/rust-toolchain@stable
      - name: Rust cache
        uses: Swatinem/rust-cache@v2

      - name: Install dev dependencies
        run: uv sync --group dev --no-install-project
      - name: Build native extension
        run: uv run maturin develop
      - name: Run pytest
        run: uv run pytest -q

  linux:
    name: Linux manylinux wheels
    needs: [quality, tests]
    runs-on: ${{ matrix.platform.runner }}
    strategy:
      fail-fast: false
      matrix:
        platform:
          - runner: ubuntu-22.04
            target: x86_64
          - runner: ubuntu-22.04
            target: aarch64
          - runner: ubuntu-22.04
            target: i686
          - runner: ubuntu-22.04
            target: s390x
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: recursive
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
      - name: Setup QEMU
        if: matrix.platform.target != 'x86_64'
        uses: docker/setup-qemu-action@v3
        with:
          platforms: ${{ matrix.platform.target }}
      - name: Workaround ring ARM asm macro in cross builds
        if: matrix.platform.target == 'aarch64'
        run: echo "CFLAGS_aarch64_unknown_linux_gnu=-D__ARM_ARCH=8" >> "$GITHUB_ENV"
      - uses: dtolnay/rust-toolchain@stable
      - name: Build wheels
        uses: PyO3/maturin-action@v1
        with:
          target: ${{ matrix.platform.target }}
          args: --release --out dist --find-interpreter
          sccache: ${{ !startsWith(github.ref, 'refs/tags/') && matrix.platform.target != 'aarch64' }}
          manylinux: auto
      - name: Upload wheels
        uses: actions/upload-artifact@v4
        with:
          name: wheels-linux-${{ matrix.platform.target }}
          path: dist

  android:
    name: Android wheels
    needs: [quality, tests]
    runs-on: ubuntu-22.04
    strategy:
      fail-fast: false
      matrix:
        target:
          - aarch64
          - x86_64
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: recursive
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}-linux-android
      - name: Setup Android NDK
        uses: nttld/setup-ndk@v1
        with:
          ndk-version: r27d
      - name: Build wheels
        uses: PyO3/maturin-action@v1
        with:
          target: ${{ matrix.target }}-linux-android
          args: --release --out dist
          container: off
      - name: Upload wheels
        uses: actions/upload-artifact@v4
        with:
          name: wheels-android-${{ matrix.target }}
          path: dist

  windows:
    name: Windows wheels
    needs: [quality, tests]
    runs-on: ${{ matrix.platform.runner }}
    strategy:
      fail-fast: false
      matrix:
        platform:
          - runner: windows-latest
            target: x64
            python_arch: x64
          - runner: windows-latest
            target: x86
            python_arch: x86
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: recursive
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
          architecture: ${{ matrix.platform.python_arch }}
      - uses: dtolnay/rust-toolchain@stable
      - name: Build wheels
        uses: PyO3/maturin-action@v1
        with:
          target: ${{ matrix.platform.target }}
          args: --release --out dist --find-interpreter
          sccache: ${{ !startsWith(github.ref, 'refs/tags/') }}
      - name: Upload wheels
        uses: actions/upload-artifact@v4
        with:
          name: wheels-windows-${{ matrix.platform.target }}
          path: dist

  macos:
    name: macOS wheels
    needs: [quality, tests]
    # Both targets use macos-latest (Apple Silicon) — x86_64 is cross-compiled.
    # macos-13 runners have very long queues (12h+); macos-latest is faster.
    runs-on: macos-latest
    strategy:
      fail-fast: false
      matrix:
        target: [aarch64, x86_64]
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: recursive
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}-apple-darwin
      - name: Build wheels
        uses: PyO3/maturin-action@v1
        with:
          target: ${{ matrix.target }}
          args: --release --out dist --find-interpreter
          sccache: ${{ !startsWith(github.ref, 'refs/tags/') }}
      - name: Upload wheels
        uses: actions/upload-artifact@v4
        with:
          name: wheels-macos-${{ matrix.target }}
          path: dist

  sdist:
    name: Source distribution
    needs: [quality, tests]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: recursive
      - uses: dtolnay/rust-toolchain@stable
      - name: Build sdist
        uses: PyO3/maturin-action@v1
        with:
          command: sdist
          args: --out dist
      - name: Upload sdist
        uses: actions/upload-artifact@v4
        with:
          name: wheels-sdist
          path: dist

  release:
    name: Publish to PyPI
    if: >
      ${{
        github.event_name == 'workflow_run' &&
        github.event.workflow_run.conclusion == 'success'
      }}
    needs: [linux, android, windows, macos, sdist]
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
    steps:
      - name: Log release context
        run: |
          echo "event=${GITHUB_EVENT_NAME}"
          echo "ref=${GITHUB_REF}"
          echo "sha=${GITHUB_SHA}"

      - name: Download wheel artifacts
        uses: actions/download-artifact@v4
        with:
          pattern: wheels-*
          merge-multiple: true
          path: dist

      - name: Ensure PyPI token exists
        env:
          UV_PUBLISH_TOKEN: ${{ secrets.PYPI_API_TOKEN }}
        run: |
          if [ -z "${UV_PUBLISH_TOKEN}" ]; then
            echo "::error::Missing PYPI_API_TOKEN secret."
            exit 1
          fi

      - name: Validate release artifacts
        run: |
          set -euo pipefail
          shopt -s nullglob
          files=(dist/*)
          if [ ${#files[@]} -eq 0 ]; then
            echo "::error::No artifacts found in dist/."
            exit 1
          fi
          printf '%s\n' "${files[@]}"

      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - uses: astral-sh/setup-uv@v5

      - name: Publish artifacts
        run: uv publish dist/*
        env:
          UV_PUBLISH_TOKEN: ${{ secrets.PYPI_API_TOKEN }}