python-release.yml

name: Python Release

on:
  push:
    tags: ['v*']
  pull_request:
    paths:
      - 'bindings/python/**'
      - '.github/workflows/python-release.yml'

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ !startsWith(github.ref, 'refs/tags/') }}

env:
  CARGO_TERM_COLOR: always
  CARGO_INCREMENTAL: 0
  CARGO_HTTP_MULTIPLEXING: false

jobs:
  preflight:
    name: Release lockfile preflight
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v4

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Check release lockfiles
        run: ./scripts/check-release-lockfiles.sh

  macos:
    needs: preflight
    runs-on: macos-14
    timeout-minutes: 35
    strategy:
      fail-fast: false
      matrix:
        include:
          - target: x86_64-apple-darwin
            deployment_target: '10.13'
          - target: aarch64-apple-darwin
            deployment_target: '11.0'
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}
      - uses: Swatinem/rust-cache@v2
        with:
          key: python-macos-${{ matrix.target }}
          cache-on-failure: true
      - uses: actions/cache@v4
        with:
          path: |
            lib/boringssl/${{ matrix.target }}
            lib/boringssl/include
          key: boringssl-python-${{ matrix.target }}-${{ hashFiles('Cargo.lock', 'bindings/python/Cargo.toml') }}
      - name: Install prebuilt BoringSSL for ${{ matrix.target }}
        run: |
          set -euo pipefail
          chmod +x scripts/install-boringssl-prebuilt.sh
          ./scripts/install-boringssl-prebuilt.sh --manifest-path bindings/python/Cargo.toml "${{ matrix.target }}"
      - uses: PyO3/maturin-action@v1
        with:
          target: ${{ matrix.target }}
          args: --release --locked --out dist -m bindings/python/Cargo.toml
        env:
          MACOSX_DEPLOYMENT_TARGET: ${{ matrix.deployment_target }}
          BORING_BSSL_PATH: ${{ github.workspace }}/lib/boringssl/${{ matrix.target }}/build
          BORING_BSSL_INCLUDE_PATH: ${{ github.workspace }}/lib/boringssl/include
      - name: Upload wheels
        uses: actions/upload-artifact@v4
        with:
          name: wheels-macos-${{ matrix.target }}
          path: dist/*.whl

  linux:
    needs: preflight
    timeout-minutes: 35
    strategy:
      fail-fast: false
      matrix:
        include:
          - host: ubuntu-latest
            target: x86_64-unknown-linux-gnu
          - host: ubuntu-24.04-arm
            target: aarch64-unknown-linux-gnu
    runs-on: ${{ matrix.host }}
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}
      - uses: Swatinem/rust-cache@v2
        with:
          key: python-linux-${{ matrix.target }}
          cache-on-failure: true
      - uses: actions/cache@v4
        with:
          path: |
            lib/boringssl/${{ matrix.target }}
            lib/boringssl/include
          key: boringssl-python-${{ matrix.target }}-${{ hashFiles('Cargo.lock', 'bindings/python/Cargo.toml') }}
      - name: Install prebuilt BoringSSL on host (filesystem mounted into container)
        run: |
          set -euo pipefail
          chmod +x scripts/install-boringssl-prebuilt.sh
          ./scripts/install-boringssl-prebuilt.sh --manifest-path bindings/python/Cargo.toml "${{ matrix.target }}"
      - uses: PyO3/maturin-action@v1
        with:
          target: ${{ matrix.target }}
          # manylinux2014 (CentOS 7) ships clang 5 which is too old for bindgen 0.72
          # (clang_getTranslationUnitTargetInfo requires libclang >= 9). manylinux_2_28
          # is AlmaLinux 8 with GCC 14 + modern clang; covers Debian 10+, Ubuntu 18.10+,
          # Fedora 29+, RHEL 8+ which is the realistic 2026 PyPI install base.
          manylinux: '2_28'
          args: --release --locked --out dist -m bindings/python/Cargo.toml
          before-script-linux: |
            dnf install -y clang
          # The action mounts $GITHUB_WORKSPACE at the same absolute path inside the
          # container (NOT /io -- that's the raw `docker run` convention). BORING_*
          # env vars are NOT in the action's ALLOWED_ENV_PREFIXES, so they must be
          # forwarded explicitly via docker-options, not via step `env:`.
          docker-options: |
            -e BORING_BSSL_PATH=${{ github.workspace }}/lib/boringssl/${{ matrix.target }}/build
            -e BORING_BSSL_INCLUDE_PATH=${{ github.workspace }}/lib/boringssl/include
            -e CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER=gcc
      - name: Upload wheels
        uses: actions/upload-artifact@v4
        with:
          name: wheels-linux-${{ matrix.target }}
          path: dist/*.whl

  sdist:
    needs: preflight
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
        with:
          key: python-sdist
          cache-on-failure: true
      - uses: PyO3/maturin-action@v1
        with:
          command: sdist
          args: --out dist -m bindings/python/Cargo.toml
      - name: Upload sdist
        uses: actions/upload-artifact@v4
        with:
          name: sdist
          path: dist/*.tar.gz

  test:
    name: Test wheel (macOS)
    needs: preflight
    runs-on: macos-14
    timeout-minutes: 25
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: '3.11'
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
        with:
          key: python-test-aarch64-apple-darwin
          cache-on-failure: true
      - uses: actions/cache@v4
        with:
          path: |
            lib/boringssl/aarch64-apple-darwin
            lib/boringssl/include
          key: boringssl-python-aarch64-apple-darwin-${{ hashFiles('Cargo.lock', 'bindings/python/Cargo.toml') }}
      - name: Install prebuilt BoringSSL for aarch64-apple-darwin
        run: |
          set -euo pipefail
          chmod +x scripts/install-boringssl-prebuilt.sh
          ./scripts/install-boringssl-prebuilt.sh --manifest-path bindings/python/Cargo.toml aarch64-apple-darwin
      - name: Create virtualenv and install deps
        run: |
          python -m venv .venv
          . .venv/bin/activate
          pip install --upgrade pip
          pip install maturin pytest pytest-asyncio
      - name: Build and install wheel
        run: |
          . .venv/bin/activate
          maturin build --release --locked --out dist -m bindings/python/Cargo.toml
          pip install dist/*.whl
        env:
          MACOSX_DEPLOYMENT_TARGET: '11.0'
          BORING_BSSL_PATH: ${{ github.workspace }}/lib/boringssl/aarch64-apple-darwin/build
          BORING_BSSL_INCLUDE_PATH: ${{ github.workspace }}/lib/boringssl/include
      - name: Run tests
        run: |
          . .venv/bin/activate
          unset PYTHONPATH
          python -c "import warpsock; print('loaded:', warpsock.__file__)"
          test_dir="$(mktemp -d)"
          cp -R bindings/python/tests "$test_dir/tests"
          (cd "$test_dir" && python -m pytest tests/ -v)

  test-linux:
    name: Test wheel (Linux ${{ matrix.target }})
    needs: linux
    timeout-minutes: 20
    strategy:
      fail-fast: false
      matrix:
        include:
          - host: ubuntu-latest
            target: x86_64-unknown-linux-gnu
          - host: ubuntu-24.04-arm
            target: aarch64-unknown-linux-gnu
    runs-on: ${{ matrix.host }}
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: '3.11'
      - uses: actions/download-artifact@v4
        with:
          name: wheels-linux-${{ matrix.target }}
          path: dist
      - name: Install wheel into clean venv and smoke
        run: |
          set -euo pipefail
          python -m venv .venv
          . .venv/bin/activate
          unset PYTHONPATH
          pip install --upgrade pip pytest pytest-asyncio
          pip install dist/*.whl
          # Distribution name is `warpsock`; the native extension installs as
          # `warpsock.warpsock` behind the Python package shim.
          python -c "import warpsock; print('loaded:', warpsock.__file__)"
          test_dir="$(mktemp -d)"
          cp -R bindings/python/tests "$test_dir/tests"
          (cd "$test_dir" && python -m pytest tests/ -v)

  release:
    name: Release
    runs-on: ubuntu-latest
    timeout-minutes: 10
    needs: [macos, linux, sdist, test, test-linux]
    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/')
    permissions:
      id-token: write
    steps:
      - uses: actions/download-artifact@v4
        with:
          pattern: wheels-*
          merge-multiple: true
          path: dist
      - uses: actions/download-artifact@v4
        with:
          name: sdist
          path: dist
      - uses: pypa/gh-action-pypi-publish@release/v1
        with:
          skip-existing: true
          password: ${{ secrets.PYPI_API_TOKEN }}