secretspec-sqlite/.github/workflows/python-wheels.yml at main · djbclark/secretspec-sqlite · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
name: "Python wheels"

# Builds portable abi3 wheels for the Python SDK and publishes them to PyPI on a
# version tag. The Rust resolver is statically linked into a compiled pyo3
# extension (secretspec-py-native, see secretspec-py/Cargo.toml) -- there is no
# separate cdylib bundled. The extension targets pyo3's abi3-py39 feature, so
# one cp39-abi3 wheel per platform serves all CPython >= 3.9.
#
# Linux wheels are built via PyO3/maturin-action inside a manylinux container
# (old glibc); maturin repairs the wheel itself, so no separate auditwheel step
# is needed. macOS builds natively.
#
# Windows builds natively on the MSVC toolchain and uses Windows Credential
# Manager. The SDK itself is exercised on every PR by the devenv-based sdks.yml;
# this workflow only builds the distributable wheels.
#
# The build/repair pipeline is validated in CI; the publish job additionally
# needs PyPI Trusted Publishing configured for this repo's "pypi" environment
# before the first version tag.

on:
  workflow_call:
  workflow_dispatch:
  push:
    tags:
      - v**
  # PR runs are scoped to changes in the Python SDK or this workflow. Core
  # resolver and FFI changes are verified on PRs by the devenv-based test.yml,
  # sdks.yml, and ffi-build.yml; the full matrix here still runs on tags and
  # manual dispatch.
  pull_request:
    paths:
      - "secretspec-py/**"
      - ".github/workflows/python-wheels.yml"
      - "scripts/sync-sdk-versions.sh"

permissions:
  contents: read

jobs:
  linux:
    name: wheel ${{ matrix.arch }} (manylinux)
    runs-on: ${{ matrix.runner }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - { arch: x86_64, target: x86_64-unknown-linux-gnu, runner: ubuntu-latest }
          - { arch: aarch64, target: aarch64-unknown-linux-gnu, runner: ubuntu-24.04-arm }
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Sync SDK package versions
        run: bash scripts/sync-sdk-versions.sh
      - name: Build wheel (manylinux)
        uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
        with:
          working-directory: secretspec-py
          target: ${{ matrix.target }}
          manylinux: 2_28
          rust-toolchain: "1.92.0" # matches rust-toolchain.toml
          # Compiler cache backed by the GitHub Actions cache; works inside
          # the manylinux container, where a host-level cargo cache cannot.
          sccache: true
          args: --release --out ${{ github.workspace }}/wheelhouse
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: wheels-linux-${{ matrix.arch }}
          path: wheelhouse/*.whl

  native:
    name: wheel ${{ matrix.target }}
    runs-on: ${{ matrix.runner }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - { target: macos-aarch64, runner: macos-latest }
          - { target: windows-x86_64, runner: windows-latest }
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Sync SDK package versions
        run: bash scripts/sync-sdk-versions.sh
      - name: Install Rust (pinned by rust-toolchain.toml)
        run: rustup toolchain install
      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.11"
      - name: Build wheel
        uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
        with:
          working-directory: secretspec-py
          sccache: true
          args: --release --out ${{ github.workspace }}/wheelhouse
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: wheels-${{ matrix.target }}
          path: wheelhouse/*.whl

  publish:
    name: publish to PyPI
    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
    needs: [linux, native]
    runs-on: ubuntu-latest
    environment: pypi
    permissions:
      id-token: write # PyPI Trusted Publishing (OIDC), no token needed
    steps:
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          path: dist
          merge-multiple: true
      - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
        with:
          packages-dir: dist