secretspec/.github/workflows/python-wheels.yml at main · Intelecy/secretspec · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
name: "Python wheels"

# Builds portable abi3 wheels for the Python SDK and publishes them to PyPI on a
# version tag. The Rust resolver is statically linked into a compiled pyo3
# extension (secretspec-py-native, see secretspec-py/Cargo.toml) -- there is no
# separate cdylib bundled. The extension targets pyo3's abi3-py39 feature, so
# one cp39-abi3 wheel per platform serves all CPython >= 3.9 with the GIL.
#
# Free-threaded CPython (3.14t) cannot load abi3 extensions, so each platform
# also gets a version-specific cp314t wheel: built against a free-threaded
# interpreter, pyo3 drops abi3, and since pyo3 0.28 the bare #[pymodule]
# declares free-threading support, so importing it keeps the GIL disabled.
# An sdist is published too, so any interpreter without a matching wheel can
# still build from source (it bundles the workspace crates it needs).
#
# Linux wheels are built via PyO3/maturin-action inside a manylinux container
# (old glibc); maturin repairs the wheel itself, so no separate auditwheel step
# is needed. macOS builds natively.
#
# Windows builds natively on the MSVC toolchain and uses Windows Credential
# Manager. The SDK itself is exercised on every PR by the devenv-based sdks.yml;
# this workflow only builds the distributable wheels.
#
# The build/repair pipeline is validated in CI; the publish job additionally
# needs PyPI Trusted Publishing configured for this repo's "pypi" environment
# before the first version tag.

on:
  workflow_call:
    inputs:
      pre_release:
        description: Run as part of the canonical pre-release suite
        required: false
        type: boolean
        default: false
  workflow_dispatch:
  push:
    tags:
      - v**
  # PR runs are scoped to changes in the Python SDK or this workflow. Core
  # resolver and FFI changes are verified on PRs by the devenv-based test.yml,
  # sdks.yml, and ffi-build.yml; the full matrix here still runs on tags and
  # manual dispatch.
  pull_request:
    paths:
      - "secretspec-py/**"
      - ".github/workflows/python-wheels.yml"
      - "scripts/sync-sdk-versions.sh"

permissions:
  contents: read

jobs:
  linux:
    name: wheel ${{ matrix.arch }} ${{ matrix.interpreter || 'abi3' }} (manylinux)
    if: >-
      inputs.pre_release ||
      github.event_name != 'pull_request' ||
      !startsWith(github.event.pull_request.title, 'Release ')
    runs-on: ${{ matrix.runner }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - { arch: x86_64, target: x86_64-unknown-linux-gnu, runner: ubuntu-latest }
          - { arch: aarch64, target: aarch64-unknown-linux-gnu, runner: ubuntu-24.04-arm }
          # Free-threaded: the manylinux image ships /opt/python/cp314-cp314t.
          - { arch: x86_64, target: x86_64-unknown-linux-gnu, runner: ubuntu-latest, interpreter: python3.14t }
          - { arch: aarch64, target: aarch64-unknown-linux-gnu, runner: ubuntu-24.04-arm, interpreter: python3.14t }
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Sync SDK package versions
        run: bash scripts/sync-sdk-versions.sh
      - name: Build wheel (manylinux)
        uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
        with:
          working-directory: secretspec-py
          target: ${{ matrix.target }}
          manylinux: 2_28
          rust-toolchain: "1.92.0" # matches rust-toolchain.toml
          # Compiler cache backed by the GitHub Actions cache; works inside
          # the manylinux container, where a host-level cargo cache cannot.
          sccache: true
          args: >-
            --release --out ${{ github.workspace }}/wheelhouse
            ${{ matrix.interpreter && format('--interpreter {0}', matrix.interpreter) || '' }}
      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: wheels-linux-${{ matrix.arch }}${{ matrix.interpreter && '-freethreaded' || '' }}
          path: wheelhouse/*.whl

  native:
    name: wheel ${{ matrix.target }} ${{ matrix.freethreaded && 'cp314t' || 'abi3' }}
    if: >-
      inputs.pre_release ||
      github.event_name != 'pull_request' ||
      !startsWith(github.event.pull_request.title, 'Release ')
    runs-on: ${{ matrix.runner }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - { target: macos-aarch64, runner: macos-latest, python: "3.11" }
          - { target: windows-x86_64, runner: windows-latest, python: "3.11" }
          - { target: macos-aarch64, runner: macos-latest, python: "3.14t", freethreaded: true }
          - { target: windows-x86_64, runner: windows-latest, python: "3.14t", freethreaded: true }
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Sync SDK package versions
        run: bash scripts/sync-sdk-versions.sh
      - name: Install Rust (pinned by rust-toolchain.toml)
        run: rustup toolchain install
      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        id: python
        with:
          python-version: ${{ matrix.python }}
      - name: Build wheel
        uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
        with:
          working-directory: secretspec-py
          sccache: true
          args: >-
            --release --out ${{ github.workspace }}/wheelhouse
            ${{ matrix.freethreaded && format('--interpreter {0}', steps.python.outputs.python-path) || '' }}
      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: wheels-${{ matrix.target }}${{ matrix.freethreaded && '-freethreaded' || '' }}
          path: wheelhouse/*.whl

  sdist:
    name: sdist
    if: >-
      inputs.pre_release ||
      github.event_name != 'pull_request' ||
      !startsWith(github.event.pull_request.title, 'Release ')
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Sync SDK package versions
        run: bash scripts/sync-sdk-versions.sh
      - name: Build sdist
        uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
        with:
          working-directory: secretspec-py
          command: sdist
          args: --out ${{ github.workspace }}/wheelhouse
      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: sdist
          path: wheelhouse/*.tar.gz

  publish:
    name: publish to PyPI
    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
    needs: [linux, native, sdist]
    runs-on: ubuntu-latest
    environment: pypi
    permissions:
      id-token: write # PyPI Trusted Publishing (OIDC), no token needed
    steps:
      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          path: dist
          merge-multiple: true
      - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
        with:
          packages-dir: dist