release-python.yml

name: "Python Release"

on:
  workflow_dispatch:
    inputs:
      tag:
        description: "The version to tag, without the leading 'v'. If omitted, will initiate a dry run (no uploads)."
        type: string
      sha:
        description: "The full sha of the commit to be released. If omitted, the latest commit on the default branch will be used."
        default: ""
        type: string
  pull_request:
    paths:
      # When we change pyproject.toml, we want to ensure that the maturin builds still work
      - py-rattler/pyproject.toml
      # And when we change this workflow itself...
      - .github/workflows/release-python.yaml

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  PACKAGE_NAME: py_rattler
  PYTHON_VERSION: "3.11"
  CARGO_INCREMENTAL: 0
  CARGO_NET_RETRY: 10
  CARGO_TERM_COLOR: always
  RUSTUP_MAX_RETRIES: 10

jobs:
  sdist:
    name: Build sdist
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ inputs.sha }}
      - uses: actions/setup-python@v5
        with:
          python-version: ${{ env.PYTHON_VERSION }}
      - name: "Build sdist"
        uses: PyO3/maturin-action@v1
        with:
          working-directory: py-rattler
          command: sdist
          args: --out dist
      - name: "Test sdist"
        run: |
          rustup default $(cat rust-toolchain)
          pip install py-rattler/dist/${{ env.PACKAGE_NAME }}-*.tar.gz --force-reinstall
          python -c "import rattler; print(rattler.__version__)"
      - name: "Upload sdist"
        uses: actions/upload-artifact@v4
        with:
          name: sdist
          path: py-rattler/dist

  windows:
    runs-on: windows-latest
    name: Build ${{ matrix.platform.target }}
    strategy:
      fail-fast: false
      matrix:
        platform:
          - target: x86_64-pc-windows-msvc
            arch: x64
          - target: i686-pc-windows-msvc
            arch: x86
          - target: aarch64-pc-windows-msvc
            arch: x64
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ inputs.sha }}
      - uses: actions/setup-python@v5
        with:
          python-version: ${{ env.PYTHON_VERSION }}
          architecture: ${{ matrix.platform.arch }}
      - name: "Build wheels"
        uses: PyO3/maturin-action@v1
        with:
          working-directory: py-rattler
          target: ${{ matrix.platform.target }}
          args: --release --out dist --no-default-features --features rustls-tls
      - name: "Test wheel"
        if: ${{ !startsWith(matrix.platform.target, 'aarch64') }}
        shell: bash
        run: |
          python -m pip install py-rattler/dist/${{ env.PACKAGE_NAME }}-*.whl --force-reinstall
          python -c "import rattler; print(rattler.__version__)"
      - name: "Upload wheels"
        uses: actions/upload-artifact@v4
        with:
          name: windows-wheels-${{ matrix.platform.target }}
          path: py-rattler/dist

  linux:
    runs-on: ${{ matrix.platform.runner }}
    name: Build ${{ matrix.platform.target }}
    strategy:
      matrix:
        platform:
          - runner: ubuntu-latest
            target: x86_64
          - runner: ubuntu-latest
            target: x86
          - runner: ubuntu-latest
            target: aarch64
          - runner: ubuntu-latest
            target: armv7
          - runner: ubuntu-latest
            target: s390x
          - runner: ubuntu-latest
            target: ppc64le
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ inputs.sha }}
      - uses: actions/setup-python@v5
        with:
          python-version: ${{ env.PYTHON_VERSION }}
      - name: "Build wheels"
        uses: PyO3/maturin-action@v1
        with:
          working-directory: py-rattler
          target: ${{ matrix.platform.target }}
          manylinux: auto
          args: --release --out dist --zig --no-default-features --features rustls-tls
      - name: "Test wheel"
        if: ${{ startsWith(matrix.target, 'x86_64') }}
        run: |
          pip install py-rattler/dist/${{ env.PACKAGE_NAME }}-*.whl --force-reinstall
          python3 -c "import rattler; print(rattler.__version__)"
      - name: "Upload wheels"
        uses: actions/upload-artifact@v4
        with:
          name: linux-wheels-${{ matrix.target }}
          path: py-rattler/dist

  musllinux:
    name: Build musl ${{ matrix.platform.target }}
    runs-on: ${{ matrix.platform.runner }}
    strategy:
      matrix:
        platform:
          - runner: ubuntu-latest
            target: x86_64
          - runner: ubuntu-latest
            target: x86
          - runner: ubuntu-latest
            target: aarch64
          - runner: ubuntu-latest
            target: armv7
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ inputs.sha }}
      - uses: actions/setup-python@v5
        with:
          python-version: ${{ env.PYTHON_VERSION }}
      - name: "Build wheels"
        uses: PyO3/maturin-action@v1
        with:
          working-directory: py-rattler
          target: ${{ matrix.target }}
          manylinux: musllinux_1_2
          args: --release --out dist --no-default-features --features rustls-tls
      - name: "Test wheel"
        if: matrix.target == 'x86_64-unknown-linux-musl'
        uses: addnab/docker-run-action@v3
        with:
          image: alpine:latest
          options: -v ${{ github.workspace }}:/io -w /io
          run: |
            apk add py3-pip
            pip3 install ${{ env.PACKAGE_NAME }} --no-index --find-links /io/py-rattler/dist/ --force-reinstall --break-system-packages
            python3 -c "import rattler; print(rattler.__version__)"
      - name: "Upload wheels"
        uses: actions/upload-artifact@v4
        with:
          name: linux-wheels-${{ matrix.target }}
          path: py-rattler/dist

  macos-x86_64:
    runs-on: macos-13   # x86_64 runner
    name: Build x86_64-macos
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ inputs.sha }}
      - uses: actions/setup-python@v5
        with:
          python-version: ${{ env.PYTHON_VERSION }}
          architecture: x64
      - name: "Build wheels - x86_64"
        uses: PyO3/maturin-action@v1
        with:
          working-directory: py-rattler
          target: x86_64
          args: --release --out dist --no-default-features --features rustls-tls
      - name: "Test wheel - x86_64"
        run: |
          pip install py-rattler/dist/${{ env.PACKAGE_NAME }}-*.whl --force-reinstall
          python -c "import rattler; print(rattler.__version__)"
      - name: "Upload wheels"
        uses: actions/upload-artifact@v4
        with:
          name: macos-wheels-x86_64
          path: py-rattler/dist

  macos-universal:
    runs-on: macos-latest
    name: Build universal2-apple-macos
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ inputs.sha }}
      - uses: actions/setup-python@v5
        with:
          python-version: ${{ env.PYTHON_VERSION }}
          architecture: x64
      - name: "Build wheels - universal2"
        uses: PyO3/maturin-action@v1
        with:
          args: --release --target universal2-apple-darwin --out dist --no-default-features --features rustls-tls
          working-directory: py-rattler
      - name: "Test wheel - universal2"
        run: |
          pip install py-rattler/dist/${{ env.PACKAGE_NAME }}-*universal2.whl --force-reinstall
          python -c "import rattler; print(rattler.__version__)"
      - name: "Upload wheels"
        uses: actions/upload-artifact@v4
        with:
          name: macos-wheels-universal2
          path: py-rattler/dist

  validate-tag:
    name: Validate tag
    runs-on: ubuntu-latest
    # If you don't set an input tag, it's a dry run (no uploads).
    if: ${{ inputs.tag }}
    steps:
      - uses: actions/checkout@v4
        with:
          ref: main # We checkout the main branch to check for the commit
      - name: Check main branch
        if: ${{ inputs.sha }}
        run: |
          # Fetch the main branch since a shallow checkout is used by default
          git fetch origin main --unshallow
          if ! git branch --contains ${{ inputs.sha }} | grep -E '(^|\s)main$'; then
            echo "The specified sha is not on the main branch" >&2
            exit 1
          fi
      - name: Check tag consistency
        run: |
          # Switch to the commit we want to release
          git checkout ${{ inputs.sha }}
          version=$(grep -m 1 "version = " py-rattler/Cargo.toml | sed -e 's/version = "\(.*\)"/\1/g')
          if [ "${{ inputs.tag }}" != "${version}" ]; then
            echo "The input tag does not match the version from Cargo.toml:" >&2
            echo "${{ inputs.tag }}" >&2
            echo "${version}" >&2
            exit 1
          else
            echo "Releasing ${version}"
          fi

  upload-release:
    name: Upload to PyPI
    runs-on: ubuntu-latest
    needs:
      - sdist
      - macos-universal
      - macos-x86_64
      - windows
      - linux
      - musllinux
      - validate-tag
    # If you don't set an input tag, it's a dry run (no uploads).
    if: ${{ inputs.tag }}
    environment:
      name: release
    permissions:
      # For pypi trusted publishing
      id-token: write
    steps:
      - uses: actions/download-artifact@v4
        with:
          merge-multiple: true
          path: wheels
      - name: Publish to PyPi
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          skip-existing: true
          packages-dir: wheels
          verbose: true

  tag-release:
    name: Tag release
    runs-on: ubuntu-latest
    needs: upload-release
    # If you don't set an input tag, it's a dry run (no uploads).
    if: ${{ inputs.tag }}
    permissions:
      # For git tag
      contents: write
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ inputs.sha }}
      - name: git tag
        run: |
          git config user.email "hi@prefix.dev"
          git config user.name "Prefix.dev Release CI"
          git tag -m "py-rattler-v${{ inputs.tag }}" "py-rattler-v${{ inputs.tag }}"
          # If there is duplicate tag, this will fail. The publish to pypi action will have been a noop (due to skip
          # existing), so we make a non-destructive exit here
          git push --tags