python.yml

name: Python CI & Wheels

on:
  push:
    branches: [main]
    tags:
      - 'v*'
  # Single-anchor releases (#313): PyPI publishes only after the canonical
  # GitHub Release exists — never straight off a tag push. A tag push still
  # builds wheels/sdist as artifacts (pre-validation), but does not publish.
  release:
    types: [published]
  # A release created by release.yml with GITHUB_TOKEN does NOT emit a
  # `release` event to other workflows (GitHub suppresses token-caused events,
  # except workflow_dispatch/repository_dispatch — the v0.4.1 lesson). The
  # github-release job therefore dispatches this workflow explicitly with the
  # release tag; the `release:` trigger above still serves manually-published
  # releases.
  workflow_dispatch:
    inputs:
      publish:
        description: 'Publish to PyPI (only for a real release dispatch)'
        type: boolean
        default: false
      release_tag:
        description: 'Release tag to build and publish (e.g. v0.4.1); empty = current ref'
        type: string
        default: ''

concurrency:
  group: python-${{ github.workflow }}-${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

# Minimal default; the publish-pypi job elevates id-token itself.
permissions:
  contents: read

jobs:
  test:
    name: Test Python Bindings (${{ matrix.os }}, Py ${{ matrix.python-version }})
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
        python-version: ["3.8", "3.10", "3.12"]
        exclude:
          - os: windows-latest
            python-version: "3.8"
    runs-on: ${{ matrix.os }}
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@v7
        with:
          ref: ${{ inputs.release_tag || github.ref }}

      - name: Set up Python ${{ matrix.python-version }}
        uses: actions/setup-python@v7
        with:
          python-version: ${{ matrix.python-version }}

      - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable

      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2

      - name: Install build and test dependencies
        run: |
          python -m pip install --upgrade pip
          python -m pip install "maturin>=1.5,<2.0" pytest

      - name: Build and install expanse-trie
        run: |
          pip install .

      - name: Run Pytest suite
        run: |
          pytest tests/test_python_bindings.py -v

  wheels:
    name: Build Wheels (${{ matrix.target }} - ${{ matrix.os }})
    if: startsWith(github.ref, 'refs/tags/v') || github.event_name == 'workflow_dispatch'
    strategy:
      fail-fast: false
      max-parallel: 4
      matrix:
        include:
          - os: ubuntu-latest
            target: x86_64-unknown-linux-gnu
            manylinux: auto
          - os: ubuntu-latest
            target: aarch64-unknown-linux-gnu
            manylinux: auto
          - os: macos-latest
            target: aarch64-apple-darwin
          - os: macos-latest
            target: x86_64-apple-darwin
          - os: windows-latest
            target: x86_64-pc-windows-msvc
    runs-on: ${{ matrix.os }}
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@v7
        with:
          ref: ${{ inputs.release_tag || github.ref }}

      - name: Set up Python
        uses: actions/setup-python@v7
        with:
          python-version: "3.10"

      - name: Build wheels via maturin-action
        uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
        with:
          target: ${{ matrix.target }}
          args: -m crates/expanse-py/Cargo.toml --release --out dist --find-interpreter
          manylinux: ${{ matrix.manylinux }}

      - name: Upload wheel artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: wheels-${{ matrix.target }}
          path: dist/*.whl
          if-no-files-found: error

  sdist:
    name: Build Source Distribution (sdist)
    if: startsWith(github.ref, 'refs/tags/v') || github.event_name == 'workflow_dispatch'
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v7
        with:
          ref: ${{ inputs.release_tag || github.ref }}

      - name: Set up Python
        uses: actions/setup-python@v7
        with:
          python-version: "3.10"

      - name: Build sdist via maturin-action
        uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
        with:
          command: sdist
          args: --out dist

      - name: Upload sdist artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: sdist
          path: dist/*.tar.gz
          if-no-files-found: error

  publish-pypi:
    name: Publish to PyPI
    needs: [test, wheels, sdist]
    runs-on: ubuntu-latest
    # Anchor-first (#313): publish only for a GitHub Release — either the
    # `release` event (manual releases) or the explicit dispatch from
    # release.yml's github-release job (the pipeline's path, since
    # GITHUB_TOKEN-created releases emit no event). Wheels/sdist above are
    # built from the dispatched release_tag.
    if: github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && inputs.publish)
    permissions:
      id-token: write # Required for OIDC trusted publishing
      contents: read
    steps:
      - name: Download wheel and sdist artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          pattern: '{wheels-*,sdist}'
          merge-multiple: true
          path: dist

      - name: Publish package distributions to PyPI
        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1
        with:
          packages-dir: dist/
          skip-existing: true