wheels.yml

name: Wheels

on:
  push:
    tags: ["v*"]
  workflow_dispatch:

# Builds the Python wheels (`pip install sqlite-predict`). Each wheel bundles the
# zero-dependency loadable compiled for its platform. Staging runs `make
# python-src` on the host to drop the amalgamation + SQLite ext headers into the
# package; cibuildwheel then compiles them per platform.
#
# Publishing uses PyPI Trusted Publishing (OIDC) -- no token in GitHub. ONE-TIME
# setup on PyPI: create the `sqlite-predict` project's trusted publisher
# pointing at this repo, workflow `wheels.yml`, and environment `pypi`
# (https://docs.pypi.org/trusted-publishers/). The `publish` job only runs on a
# v* tag; plain pushes / workflow_dispatch just build wheels.
jobs:
  wheels:
    name: wheels (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest]
    steps:
      - uses: actions/checkout@v7
      - name: Stage amalgamation into the package
        run: make python-src
      - name: Build wheels
        uses: pypa/cibuildwheel@v4.1
        with:
          package-dir: bindings/python
        env:
          # the loadable is ABI-agnostic, so one CPython build per platform gives
          # one py3-none-<platform> wheel usable by any Python there. Skip musl.
          CIBW_BUILD: "cp312-*"
          CIBW_SKIP: "*-musllinux*"
          CIBW_BUILD_VERBOSITY: "1"
      - uses: actions/upload-artifact@v7
        with:
          name: wheels-${{ matrix.os }}
          path: wheelhouse/*.whl

  sdist:
    name: sdist
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - name: Stage amalgamation into the package
        run: make python-src
      - name: Build sdist
        run: pipx run build --sdist --outdir wheelhouse bindings/python
      - uses: actions/upload-artifact@v7
        with:
          name: sdist
          path: wheelhouse/*.tar.gz

  publish:
    name: publish to PyPI
    needs: [wheels, sdist]
    runs-on: ubuntu-latest
    if: startsWith(github.ref, 'refs/tags/v')
    environment: pypi
    permissions:
      id-token: write # PyPI Trusted Publishing (OIDC), no token needed
    steps:
      - uses: actions/download-artifact@v8
        with:
          path: dist
          merge-multiple: true
      - uses: pypa/gh-action-pypi-publish@release/v1
        with:
          packages-dir: dist