Migrate to Trusted Publishing #96
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CD | ||
| on: | ||
| # Run on official releases (bump minor or major version number) | ||
| release: | ||
| types: | ||
| - published | ||
| workflow_dispatch: | ||
| env: | ||
| LIEF_VERSION: 0.12.3 | ||
| jobs: | ||
| build_wheels_linux: | ||
| strategy: | ||
| fail-fast: true | ||
| matrix: | ||
| python-version: | ||
| - 3.8 | ||
| os: | ||
| - ubuntu | ||
| name: build wheels | ||
| runs-on: ${{ matrix.os }}-latest | ||
| steps: | ||
| - uses: actions/checkout@v2 | ||
| with: | ||
| fetch-depth: 0 | ||
| submodules: true | ||
| - name: Set up Python | ||
| uses: actions/setup-python@v2 | ||
| with: | ||
| python-version: ${{ matrix.python-version }} | ||
| - name: Install cibuildwheel | ||
| run: python3 -m pip install cibuildwheel | ||
| - name: Login to docker registry | ||
| run: echo "${{ secrets.GHCR_TOKEN }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin | ||
| - name: Pull custom manylinux docker image | ||
| run: | | ||
| docker pull ghcr.io/trailofbits/maat/manylinux2014-x86_64:latest | ||
| docker tag ghcr.io/trailofbits/maat/manylinux2014-x86_64:latest maat_py_packaging | ||
| - name: Build wheels | ||
| run: python3 -m cibuildwheel --output-dir wheelhouse bindings/packaging | ||
| env: | ||
| CIBW_BUILD_VERBOSITY: 3 | ||
| CIBW_BUILD: cp3*-manylinux_x86_64 | ||
| CIBW_MANYLINUX_X86_64_IMAGE: maat_py_packaging | ||
| CIBW_TEST_COMMAND: "python3 -c 'from maat import *; m = MaatEngine(ARCH.X86)'" | ||
| - name: Inspect wheelhouse folder | ||
| run: ls -lah wheelhouse/ | ||
| - uses: actions/upload-artifact@v2 | ||
| with: | ||
| name: ${{ matrix.os }}-wheels | ||
| path: wheelhouse/*.whl | ||
| build_wheels_macos: | ||
| strategy: | ||
| fail-fast: true | ||
| matrix: | ||
| python-version: | ||
| - 3.8 | ||
| os: | ||
| - macos | ||
| target_arch: | ||
| - arm64 | ||
| - x86_64 | ||
| name: build wheels | ||
| runs-on: ${{ matrix.os }}-latest | ||
| steps: | ||
| - uses: actions/checkout@v2 | ||
| with: | ||
| fetch-depth: 0 | ||
| submodules: true | ||
| - name: Set up Python | ||
| uses: actions/setup-python@v2 | ||
| with: | ||
| python-version: ${{ matrix.python-version }} | ||
| - name: Install cibuildwheel | ||
| run: python3 -m pip install cibuildwheel | ||
| - name: Install Dependencies | ||
| if: matrix.target_arch == 'x86_64' | ||
| run: | | ||
| brew install python3 | ||
| wget -O - -c https://github.com/lief-project/LIEF/releases/download/$LIEF_VERSION/LIEF-$LIEF_VERSION-Darwin-x86_64.tar.gz | sudo tar xz -C /usr/local --strip-components=1 | ||
| wget https://gmplib.org/download/gmp/gmp-6.2.1.tar.lz && mkdir -p gmp/build && tar --lzip -xvf gmp-6.2.1.tar.lz -C gmp --strip-components 1 | ||
| cd gmp/build && ../configure --enable-shared --disable-static CFLAGS='-mmacosx-version-min=10.15' CXXFLAGS='-mmacosx-version-min=10.15' LDFLAGS='-mmacosx-version-min=10.15' --build=x86_64-apple-darwin --disable-assembly --enable-cxx | ||
| make "-j$(sysctl -n hw.logicalcpu)" && sudo make install | ||
| cd ../../ | ||
| wget -O z3.tar.gz https://github.com/Z3Prover/z3/archive/refs/tags/z3-4.8.14.tar.gz && mkdir z3 && tar xzvf z3.tar.gz -C z3 --strip-components 1 | ||
| cmake -B z3/build -S z3 -DCMAKE_OSX_DEPLOYMENT_TARGET=10.15 -DCMAKE_BUILD_TYPE=Release -DZ3_BUILD_LIBZ3_SHARED=NO -DZ3_BUILD_EXECUTABLE=FALSE -DZ3_BUILD_TEST_EXECUTABLES=FALSE -DZ3_ENABLE_EXAMPLE_TARGETS=FALSE | ||
| cmake --build z3/build "-j$(sysctl -n hw.logicalcpu)" && sudo cmake --install z3/build | ||
| - name: Install Dependencies | ||
| if: matrix.target_arch == 'arm64' | ||
| run: | | ||
| mkdir -p "${{ github.workspace }}/arm64-cross" | ||
| wget -O - -c https://github.com/lief-project/LIEF/releases/download/$LIEF_VERSION/LIEF-$LIEF_VERSION-Darwin-arm64.tar.gz | tar xz -C "${{ github.workspace }}/arm64-cross" --strip-components=1 | ||
| wget https://gmplib.org/download/gmp/gmp-6.2.1.tar.lz && mkdir -p gmp/build && tar --lzip -xvf gmp-6.2.1.tar.lz -C gmp --strip-components 1 | ||
| cd gmp/build && ../configure --enable-shared --disable-static CFLAGS='-arch arm64 -mmacosx-version-min=11.0' CXXFLAGS='-arch arm64 -mmacosx-version-min=11.0' LDFLAGS='-arch arm64 -mmacosx-version-min=11.0' --build=x86_64-apple-darwin --host=aarch64-apple-darwin --target=aarch64-apple-darwin --disable-assembly --enable-cxx "--prefix=${{ github.workspace }}/arm64-cross" | ||
| make "-j$(sysctl -n hw.logicalcpu)" && make install | ||
| cd ../../ | ||
| wget -O z3.tar.gz https://github.com/Z3Prover/z3/archive/refs/tags/z3-4.8.14.tar.gz && mkdir z3 && tar xzvf z3.tar.gz -C z3 --strip-components 1 | ||
| cmake -B z3/build -S z3 -DCMAKE_OSX_ARCHITECTURES="arm64" -DCMAKE_OSX_DEPLOYMENT_TARGET=11.0 -DCMAKE_BUILD_TYPE=Release -DZ3_BUILD_LIBZ3_SHARED=NO -DZ3_BUILD_EXECUTABLE=FALSE -DZ3_BUILD_TEST_EXECUTABLES=FALSE -DZ3_ENABLE_EXAMPLE_TARGETS=FALSE | ||
| cmake --build z3/build "-j$(sysctl -n hw.logicalcpu)" && cmake --install z3/build --prefix "${{ github.workspace }}/arm64-cross" | ||
| # Native sleigh for running the sleigh compiler | ||
| wget -O - -c https://github.com/lifting-bits/sleigh/releases/download/v10.1.2-2/macOS-sleigh-10.1.2-2.x86_64.tar.gz | sudo tar xz -C /usr/local --strip-components=1 | ||
| - name: Build wheels | ||
| if: matrix.target_arch == 'arm64' | ||
| # Force minimum macOS target version 11.0 for M1 support | ||
| run: | | ||
| export "CMAKE_PREFIX_PATH=${{ github.workspace }}/arm64-cross" | ||
| export MACOSX_DEPLOYMENT_TARGET=11.0 | ||
| export CFLAGS='-arch arm64 -mmacosx-version-min=11.0' | ||
| export CXXFLAGS='-arch arm64 -mmacosx-version-min=11.0' | ||
| export LDFLAGS='-arch arm64 -mmacosx-version-min=11.0' | ||
| python3 -m cibuildwheel --output-dir wheelhouse bindings/packaging | ||
| env: | ||
| MAAT_SLEIGH_COMPILER: "/usr/local/bin/sleigh_opt" | ||
| CIBW_BUILD_VERBOSITY: 3 | ||
| CIBW_BUILD: cp3*-macosx_arm64 | ||
| CIBW_ARCHS_MACOS: "arm64" | ||
| CIBW_TEST_COMMAND: "python3 -c 'from maat import *; m = MaatEngine(ARCH.X86)'" | ||
| - name: Build wheels | ||
| if: matrix.target_arch == 'x86_64' | ||
| # Force minimum macOS target version 10.15 for C++17 support | ||
| run: | | ||
| export MACOSX_DEPLOYMENT_TARGET=10.15 | ||
| python3 -m cibuildwheel --output-dir wheelhouse bindings/packaging | ||
| env: | ||
| CIBW_BUILD_VERBOSITY: 3 | ||
| CIBW_BUILD: cp3*-macosx_x86_64 | ||
| CIBW_TEST_COMMAND: "python3 -c 'from maat import *; m = MaatEngine(ARCH.X86)'" | ||
| - name: Inspect wheelhouse folder | ||
| run: ls -lah wheelhouse/ | ||
| - uses: actions/upload-artifact@v2 | ||
| with: | ||
| name: ${{ matrix.os }}-wheels | ||
| path: wheelhouse/*.whl | ||
| upload_to_pypi: | ||
| name: upload wheels to PyPI | ||
| runs-on: ubuntu-latest | ||
| needs: [build_wheels_linux, build_wheels_macos] | ||
| environment: | ||
| name: pypi | ||
| url: https://pypi.org/p/pymaat | ||
| permissions: | ||
| id-token: write | ||
| strategy: | ||
| matrix: | ||
| # The os names must match the ones in the build_wheels job | ||
| os: | ||
| - ubuntu | ||
| - macos | ||
| steps: | ||
| - uses: actions/download-artifact@v4.1.7 | ||
| with: | ||
| name: ${{ matrix.os }}-wheels | ||
| path: ${{ matrix.os }}-wheels/ | ||
| - name: "Upload wheels" | ||
| uses: pypa/gh-action-pypi-publish@release/v1 | ||
| packages-dir: ${{ matrix.os }}-wheels/ | ||
