bufbuild · anuraaga · Aug 5, 2026 · Aug 13, 2026 · Aug 13, 2026
diff --git a/.cargo/config.toml b/.cargo/config.toml
@@ -0,0 +1,5 @@
+# Ensure builds use the same value, in practice it seems generating stubs
+# with maturin vs building the project either set or leave this unset and
+# can cause build cache thrashing.
+[env]
+MACOSX_DEPLOYMENT_TARGET = "11.0"
diff --git a/.gitattributes b/.gitattributes
@@ -3,3 +3,7 @@ test/gen/** linguist-generated=true
 
 proto/** linguist-vendored=true
 test/proto/buf/** linguist-vendored=true
+
+crates/**/vendor/** linguist-vendored=true linguist-generated=true
+crates/*/filelist.txt linguist-generated=true
+protovalidate/_protovalidate.pyi linguist-generated=true
diff --git a/.github/CONTRIBUTING.md b/.github/CONTRIBUTING.md
@@ -22,6 +22,9 @@ cd protovalidate-py
 Next, install dependencies. You will need:
 
 * [uv](https://docs.astral.sh/uv/)
+* [rust](https://rust-lang.org/tools/install/)
+* A C++17 compiler. On macOS and Windows, rustup installation will ensure one is present,
+  most Linux systems will also have one, but otherwise use e.g., `apt install build-essential`
 
 Some tasks require additional non-Python tools:
 

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
@@ -1,23 +1,26 @@
 name: CI
 on:
   push:
-    branches: [main]
-    tags: ["v*"]
+    branches:
+      - main
   pull_request:
-    branches: [main]
-  schedule:
-    - cron: "15 22 * * *"
+    branches:
+      - "**"
   workflow_dispatch: {} # support manual runs
 permissions:
   contents: read
 jobs:
   ci:
     name: CI
-    runs-on: ubuntu-latest
+    runs-on: ${{ matrix.runner }}
     strategy:
       fail-fast: false
       matrix:
-        python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]
+        runner:
+          - ubuntu-24.04
+          - macos-15
+          - windows-2025
+        python-version: ["3.10", "3.11", "3.12", "3.13", "3.14", "3.14t"]
         resolution: ["highest", "lowest-direct"]
     env:
       # Shared env variables for all the tests
@@ -29,6 +32,20 @@ jobs:
           go-version: stable
           # We use this to install certain tools defined in poe tasks
           cache-dependency-path: poe_tasks.toml
+      - uses: mozilla-actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba # v0.0.11
+      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: .sccache
+          key: sccache-${{ runner.os }}-${{ runner.arch }}-${{ github.sha }}
+          restore-keys: sccache-${{ runner.os }}-${{ runner.arch }}-
+      - name: Enable sccache
+        shell: bash
+        run: |
+          echo "SCCACHE_DIR=${{ github.workspace }}/.sccache" >> $GITHUB_ENV
+          echo "SCCACHE_CACHE_SIZE=250M" >> $GITHUB_ENV
+          echo "RUSTC_WRAPPER=sccache" >> $GITHUB_ENV
+      - name: Setup rust
+        run: rustup update
       - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
         with:
           python-version: ${{ matrix.python-version }}
@@ -41,15 +58,37 @@ jobs:
           uv sync --no-dev
           uv run --no-dev --group dev-required pytest -k test_conformance
 
+  # Confirm the sdist can be built with a default CI environment.
+  sdist:
+    # Slow so skip on PR
+    if: github.event_name != 'pull_request'
+    runs-on: ${{ matrix.runner }}
+    strategy:
+      fail-fast: false
+      matrix:
+        runner:
+          - ubuntu-24.04
+          - macos-15
+          - macos-15-intel
+          - windows-2025
+          - windows-11-arm
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+      # uv build first generates the sdist and then builds a wheel from it isolated from the repo.
+      # So it is enough to verify the sdist is usable.
+      - run: uv build
+
   lint:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
+    env:
+      # We don't need the built extension for linting
+      UV_NO_PROJECT: "true"
+      PROTOVALIDATE_SKIP_CPP: "true"
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
-        with:
-          go-version: stable
-          # We use this to install certain tools defined in poe tasks
-          cache-dependency-path: poe_tasks.toml
+      - name: Setup rust
+        run: rustup update
       - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
         with:
           python-version: ${{ matrix.python-version }}

diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
@@ -1,53 +1,184 @@
-name: Upload PyPI Release
-
+name: Release
 on:
-  release:
-    types: [published]
+  push:
+    tags:
+      - "v*"
+  workflow_dispatch:
+  pull_request:
+    paths:
+      - .github/workflows/release.yaml
+
+permissions:
+  id-token: write
+  attestations: write
+  contents: write
 
 jobs:
-  build:
-    name: Build package
-    runs-on: ubuntu-latest
-    environment:
-      name: release
+  ext-linux:
+    runs-on: ${{ matrix.platform.runner }}
+    strategy:
+      matrix:
+        platform:
+          - runner: ubuntu-24.04
+            target: x86_64
+          - runner: ubuntu-24.04-arm
+            target: aarch64
+        manylinux:
+          - auto
+          - musllinux_1_2
     steps:
-      - name: Checkout source
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          fetch-depth: 0
-      - name: Set VERSION variable from tag
-        run: |
-          VERSION=${{github.head_ref}}
-          echo "VERSION=${VERSION##*/}" >> $GITHUB_ENV
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: 3.x
+
       - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
-      - name: Build release
-        run: |
-          uv build
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+
+      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
-          name: package
-          path: dist/
+          path: .sccache
+          key: sccache-${{ runner.os }}-${{ runner.arch }}-${{ matrix.manylinux }}-${{ github.sha }}
+          restore-keys: sccache-${{ runner.os }}-${{ runner.arch }}-${{ matrix.manylinux }}-
+
+      - name: Build wheels
+        uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
+        env:
+          RUSTC_WRAPPER: sccache
+          SCCACHE_DIR: ${{ github.workspace }}/.sccache
+          SCCACHE_CACHE_SIZE: 250M
+        with:
+          target: ${{ matrix.platform.target }}
+          args: --release --out dist -i 3.10 -i 3.14t
+          before-script-linux: uv tool install "sccache>=0.10.0"
+          manylinux: ${{ matrix.manylinux }}
+
+      # The container runs as root and leaves .sccache unreadable when saving
+      - name: Fix sccache dir permissions
+        if: always()
+        run: test ! -d .sccache || sudo chmod -R a+rX .sccache
+
+      - name: Upload wheels
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: wheels-linux-${{ matrix.platform.target }}-${{ matrix.manylinux }}
+          path: dist
 
-  publish:
-    name: Publish on PyPI
-    runs-on: ubuntu-latest
-    environment:
-      name: release
-    permissions:
-      # IMPORTANT: this permission is mandatory for Trusted Publishing
-      id-token: write
-    needs: build
+  ext-windows:
+    runs-on: ${{ matrix.platform.runner }}
+    strategy:
+      matrix:
+        platform:
+          - runner: windows-2025
+            target: x86_64
+          - runner: windows-11-arm
+            target: aarch64
     steps:
-      - name: Checkout source
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+
+      - uses: mozilla-actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba # v0.0.11
+
+      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
-          fetch-depth: 0
+          path: .sccache
+          key: sccache-${{ runner.os }}-${{ runner.arch }}-${{ github.sha }}
+          restore-keys: sccache-${{ runner.os }}-${{ runner.arch }}-
 
-      - name: Download built artifact
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - name: Build wheels
+        uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
+        env:
+          RUSTC_WRAPPER: sccache
+          SCCACHE_DIR: ${{ github.workspace }}/.sccache
+          SCCACHE_CACHE_SIZE: 250M
         with:
-          name: package
+          args: --release --out dist -i 3.10 -i 3.14t --features pyo3/generate-import-lib
+
+      - name: Upload wheels
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: wheels-windows-${{ matrix.platform.target }}
           path: dist
 
-      - name: Publish on PyPI
-        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1
+  ext-macos:
+    runs-on: ${{ matrix.platform.runner }}
+    strategy:
+      matrix:
+        platform:
+          - runner: macos-15
+            target: aarch64
+          - runner: macos-15-intel
+            target: x86_64
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: |
+            3.10
+            3.14t
+
+      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+
+      - uses: mozilla-actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba # v0.0.11
+
+      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: .sccache
+          key: sccache-${{ runner.os }}-${{ runner.arch }}-${{ github.sha }}
+          restore-keys: sccache-${{ runner.os }}-${{ runner.arch }}-
+
+      - name: Build wheels
+        uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
+        env:
+          RUSTC_WRAPPER: sccache
+          SCCACHE_DIR: ${{ github.workspace }}/.sccache
+          SCCACHE_CACHE_SIZE: 250M
+        with:
+          target: ${{ matrix.platform.target }}
+          args: --release --out dist -i 3.10 -i 3.14t
+
+      - name: Upload wheels
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: wheels-macos-${{ matrix.platform.target }}
+          path: dist
+
+  ext-sdist:
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Build sdist
+        uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
+        with:
+          command: sdist
+          args: --out dist
+
+      - name: Upload sdist
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: wheels-sdist
+          path: dist
+
+  release:
+    runs-on: ubuntu-24.04
+    environment: ${{ (github.event_name == 'workflow_dispatch' && 'pypi-test') || (github.event_name == 'push' && github.ref_type == 'tag' && 'pypi-release') || null }}
+    needs:
+      - ext-linux
+      - ext-windows
+      - ext-macos
+      - ext-sdist
+    steps:
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          path: dist/
+          merge-multiple: true
+
+      - name: publish all packages
+        if: github.event_name != 'pull_request'
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
+        with:
+          repository-url: ${{ github.event_name == 'workflow_dispatch' && 'https://test.pypi.org/legacy/' || null }}
+          skip-existing: true
diff --git a/.gitignore b/.gitignore
@@ -6,3 +6,9 @@ __pycache__
 .envrc
 .benchmarks
 site
+
+*.so
+target
+dist
+.tmp
+.sccache
-Original file line number
+Diff line change
@@ Expand Up / @@ -6,3 +6,9 @@ __pycache__ @@
     .envrc
     .benchmarks
     site
+    *.so
+    target
+    dist
+    .tmp
+    .sccache