CI.yml

name: CI

on:
  push:
    branches:
      - main
    tags:
      - '*'
  workflow_dispatch:
  pull_request:

permissions:
  contents: read

concurrency:
  group: ci-${{ github.ref_name }}
  cancel-in-progress: true

jobs:

  lint:
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: '3.11'
      - run: pip install pre-commit
        name: Install pre-commit
      - run: pre-commit run --all
        name: Run pre-commit checks

  test:
    strategy:
      matrix:
        os: [ubuntu-22.04, macos-13, windows-latest ]
        python_version: ['3.7', '3.8', '3.9', '3.10', '3.11', '3.12', '3.13', 'pypy-3.7', 'pypy-3.8', 'pypy-3.9', 'pypy-3.10']
        exclude:
          - python_version: 3.7
            os: macos-13
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python_version }}
          allow-prereleases: true
      - name: Setup dependencies
        run: pip install pytest
      - name: Install mkcert (Linux)
        if: matrix.os == 'ubuntu-22.04'
        run: sudo apt-get install mkcert
      - name: Install mkcert (MacOS)
        if: matrix.os == 'macos-12'
        run: brew install mkcert
      - name: Inject fake CA in TrustStore
        if: matrix.os == 'macos-12' || matrix.os == 'ubuntu-22.04'
        run: mkcert -install
      - name: Generate a valid certificate
        if: matrix.os == 'macos-12' || matrix.os == 'ubuntu-22.04'
        run: mkcert example.test
      - name: Build wheels (Unix, Linux)
        if: matrix.os != 'windows-latest'
        uses: PyO3/maturin-action@v1
        with:
          args: --release --out dist --interpreter ${{ matrix.python_version }}
          sccache: 'true'
          manylinux: auto
      - name: Build wheels (NT)
        if: matrix.os == 'windows-latest'
        uses: PyO3/maturin-action@v1
        with:
          args: --release --out dist
          sccache: 'true'
          target: x64
      - run: pip install --find-links=./dist wassima
        name: Install built package
      - name: Ensure test target (NT)
        if: matrix.os == 'windows-latest'
        run: Remove-Item -Path wassima -Force -Recurse
      - name: Ensure test target (Linux, Unix)
        if: matrix.os != 'windows-latest'
        run: rm -fR wassima
      - run: pytest tests/
        name: Run tests

  linux:
    runs-on: ubuntu-22.04
    needs:
      - test
      - lint
    strategy:
      fail-fast: false
      matrix:
        target: [x86_64, x86, aarch64, armv7, s390x, ppc64le, ppc64, i686]
        python_version: ['3.10', 'pypy-3.7', 'pypy-3.8', 'pypy-3.9', 'pypy-3.10', '3.13t']
        manylinux: ['auto', 'musllinux_1_1']
        exclude:
          - manylinux: musllinux_1_1
            target: s390x
          - manylinux: musllinux_1_1
            target: ppc64
          - manylinux: musllinux_1_1
            target: ppc64le

    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        if: matrix.python_version != '3.13t'
        with:
          python-version: ${{ matrix.python_version }}
      - uses: Quansight-Labs/setup-python@v5
        if: matrix.python_version == '3.13t'
        with:
          python-version: '3.13t'
      - name: FreeThreaded Patch
        if: matrix.python_version == '3.13t'
        run: git apply freethreaded.patch
      - name: Build wheels
        uses: PyO3/maturin-action@v1
        with:
          target: ${{ matrix.target }}
          args: --release --out dist -i ${{ matrix.python_version }}
          sccache: 'true'
          manylinux: ${{ matrix.manylinux }}
      - name: Upload wheels
        uses: actions/upload-artifact@v3
        with:
          name: wheels
          path: dist

  windows:
    needs:
      - test
      - lint
    runs-on: windows-latest
    strategy:
      fail-fast: false
      matrix:
        target: [x64, aarch64]
        python_version: ['3.10', 'pypy-3.7', 'pypy-3.8', 'pypy-3.9', 'pypy-3.10']
        exclude:
          - target: aarch64
            python_version: 'pypy-3.7'
          - target: aarch64
            python_version: 'pypy-3.8'
          - target: aarch64
            python_version: 'pypy-3.9'
          - target: aarch64
            python_version: 'pypy-3.10'
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python_version }}
          architecture: x64
      - name: Build wheels
        uses: PyO3/maturin-action@v1
        with:
          target: ${{ matrix.target }}
          args: --release --out dist
          sccache: 'true'
      - name: Upload wheels
        uses: actions/upload-artifact@v3
        with:
          name: wheels
          path: dist

  macos:
    needs:
      - test
      - lint
    runs-on: macos-13
    strategy:
      fail-fast: false
      matrix:
        target: [x86_64, aarch64, universal2]
        python_version: ['3.10', 'pypy-3.7', 'pypy-3.8', 'pypy-3.9', 'pypy-3.10']
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python_version }}
      - name: Build wheels
        uses: PyO3/maturin-action@v1
        with:
          target: ${{ matrix.target }}
          args: --release --out dist --interpreter ${{ matrix.python_version }}
          sccache: 'true'
      - name: Upload wheels
        uses: actions/upload-artifact@v3
        with:
          name: wheels
          path: dist

  freethreaded:
    needs:
      - test
      - lint
    name: Build wheels on ${{ matrix.os }}
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        os: [ ubuntu-latest, macos-13 ]  # windows-latest
        qemu: [ '' ]
        include:
          # Split ubuntu job for the sake of speed-up
          - os: ubuntu-latest
            qemu: aarch64
          - os: ubuntu-latest
            qemu: ppc64le
          - os: ubuntu-latest
            qemu: s390x
    steps:
      - name: Checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          submodules: true
      - name: Set up QEMU
        if: ${{ matrix.qemu }}
        uses: docker/setup-qemu-action@49b3bc8e6bdd4a60e6116a5414239cba5943d3cf # v3.2.0
        with:
          platforms: arm64,s390x,ppc64le
        id: qemu
      - name: Prepare emulation
        run: |
          if [[ -n "${{ matrix.qemu }}" ]]; then
            # Build emulated architectures only if QEMU is set,
            # use default "auto" otherwise
            echo "CIBW_ARCHS_LINUX=${{ matrix.qemu }}" >> $GITHUB_ENV
          fi
        shell: bash
      - name: Setup Python
        uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0

      - name: Build wheels
        uses: pypa/cibuildwheel@7940a4c0e76eb2030e473a5f864f291f63ee879b # v2.21.3
        env:
          CIBW_BUILD_FRONTEND: build
          CIBW_BEFORE_BUILD: git apply freethreaded.patch || true
          CIBW_BEFORE_BUILD_WINDOWS: git apply freethreaded.patch || (exit 0)
          CIBW_BUILD: cp313t*
          CIBW_BEFORE_ALL_LINUX: curl -sSf https://sh.rustup.rs | sh -s -- -y
          # CIBW_BEFORE_ALL_WINDOWS: rustup target add aarch64-pc-windows-msvc
          CIBW_BEFORE_ALL_MACOS: rustup target add aarch64-apple-darwin
          CIBW_ENVIRONMENT_LINUX: "PATH=$HOME/.cargo/bin:$PATH"
          CIBW_ARCHS_MACOS: universal2
          # CIBW_ARCHS_WINDOWS: AMD64 ARM64

      - name: Upload wheels
        uses: actions/upload-artifact@v3
        with:
          name: wheels
          path: ./wheelhouse/*.whl

  sdist:
    needs:
      - test
      - lint
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@v4
      - name: Build sdist
        uses: PyO3/maturin-action@v1
        with:
          command: sdist
          args: --out dist
      - name: Upload sdist
        uses: actions/upload-artifact@v3
        with:
          name: wheels
          path: dist

  universal:
    needs:
      - test
      - lint
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: '3.10'
      - name: Install dependencies
        run: python -m pip install build wheel
      - name: Use fallback pyproject.toml
        run: rm -f pyproject.toml && mv pyproject.fb.toml pyproject.toml
      - name: Build fallback wheel
        run: python -m build
      - name: Upload sdist
        uses: actions/upload-artifact@v3
        with:
          name: wheels
          path: dist/*.whl

  checksum:
    name: compute hashes
    runs-on: ubuntu-22.04
    needs: [linux, windows, macos, sdist, universal, freethreaded]
    if: "startsWith(github.ref, 'refs/tags/')"
    outputs:
      hashes: ${{ steps.compute.outputs.hashes }}
    steps:
      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
      - name: Download distributions
        uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
        with:
          name: wheels
          path: dist
      - name: Collected dists
        run: |
          tree dist
      - name: Generate hashes
        id: compute  #  needs.checksum.outputs.hashes
        working-directory: ./dist
        run: echo "hashes=$(sha256sum * | base64 -w0)" >> $GITHUB_OUTPUT

  provenance:
    needs: checksum
    if: "startsWith(github.ref, 'refs/tags/')"
    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.10.0
    permissions:
      actions: read
      id-token: write
      contents: write
    with:
      base64-subjects: ${{ needs.checksum.outputs.hashes }}
      upload-assets: true
      compile-generator: true

  release:
    name: release
    runs-on: ubuntu-22.04
    if: "startsWith(github.ref, 'refs/tags/')"
    needs: provenance
    environment: pypi
    permissions:
      id-token: write
    steps:
      - uses: actions/download-artifact@v3
        with:
          name: wheels
      - name: Publish to PyPI
        uses: PyO3/maturin-action@v1
        with:
          command: upload
          args: --non-interactive --skip-existing *