publish-python.yml

# PyPI publishing workflow for bashkit Python package
# Builds pre-compiled wheels for all major platforms and publishes to PyPI.
# Triggered alongside publish.yml on GitHub Release or manual dispatch.
# Adapted from https://github.com/pydantic/monty CI wheel-building pattern.
#
# Prerequisites:
#   - PyPI trusted publisher configured for this repo + workflow
#   - GitHub environment "release-python" created in repo settings

name: Publish Python

on:
  release:
    types: [published]
  workflow_dispatch:

permissions:
  contents: read

env:
  CARGO_TERM_COLOR: always
  PYTHON_VERSIONS: "3.9 3.10 3.11 3.12 3.13 3.14"

jobs:
  # Source distribution (platform-independent)
  build-sdist:
    name: Build sdist
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
        with:
          python-version: "3.12"

      - uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1
        with:
          command: sdist
          args: --out dist
          rust-toolchain: stable
          working-directory: crates/bashkit-python

      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: pypi_files-sdist
          path: crates/bashkit-python/dist

  # Pre-compiled binary wheels for each platform
  build:
    name: Build wheel - ${{ matrix.os }} (${{ matrix.target }}, ${{ matrix.manylinux || 'auto' }})
    strategy:
      fail-fast: false
      matrix:
        include:
          # Linux glibc
          - os: linux
            target: x86_64
            runs-on: ubuntu-latest
          # aarch64 wheel builds natively on ubuntu-24.04-arm. Cross-compiling
          # from x86_64 inside the manylinux container fails with toolchain
          # gaps in C-built crypto deps (e.g. ring's asm needs `__ARM_ARCH`,
          # aws-lc-sys's cpu_aarch64_linux.c needs `AT_HWCAP2`). Native arm64
          # avoids both. Same pattern as publish-js.yml.
          - os: linux
            target: aarch64
            runs-on: ubuntu-24.04-arm

          # Linux musl
          - os: linux
            target: x86_64
            manylinux: musllinux_1_1
            runs-on: ubuntu-latest
          - os: linux
            target: aarch64
            manylinux: musllinux_1_1
            runs-on: ubuntu-24.04-arm

          # macOS
          - os: macos
            target: x86_64
            runs-on: macos-latest
          - os: macos
            target: aarch64
            runs-on: macos-latest

          # Windows
          - os: windows
            target: x86_64
            runs-on: windows-latest

    runs-on: ${{ matrix.runs-on }}
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
        with:
          python-version: "3.12"

      - name: Build wheels
        uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1
        with:
          target: ${{ matrix.target }}
          manylinux: ${{ matrix.manylinux || 'auto' }}
          args: --release --out dist -i ${{ env.PYTHON_VERSIONS }}
          rust-toolchain: stable
          docker-options: -e CI
          working-directory: crates/bashkit-python

      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: pypi_files-${{ matrix.os }}-${{ matrix.target }}-${{ matrix.manylinux || 'manylinux' }}
          path: crates/bashkit-python/dist

  # Reduced-feature Pyodide/Emscripten wheel (browser / JupyterLite).
  # Separate job: distinct toolchain (nightly Rust + emsdk + pyodide-build) and a
  # single Python version dictated by the pyodide-build ABI lockstep.
  # See specs/emscripten-wheels.md.
  build-emscripten:
    name: Build wheel - emscripten (Pyodide)
    runs-on: ubuntu-latest
    env:
      # Keep in lockstep with the `wasm` job in python.yml: the nightly's LLVM,
      # pyodide-build's Emscripten/binaryen, and Pyodide's EH ABI must agree.
      # See specs/emscripten-wheels.md "version triangle". Bump together.
      RUST_NIGHTLY: "nightly-2026-05-29"
      PYODIDE_BUILD_VERSION: "0.34.4"
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      # Python 3.13 -> pyodide-build's modern config (Pyodide 0.29.x, Emscripten
      # 4.0.9), whose binaryen understands modern LLVM's wasm target-features and
      # whose runtime supports wasm exception handling. See specs/emscripten-wheels.md.
      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
        with:
          python-version: "3.13"

      # nightly satisfies our deps' MSRV (monty needs 1.95) + edition 2024;
      # its LLVM matches Emscripten 4.0.9's binaryen. pyodide-build manages its
      # own matching emsdk via the cross-build env (no setup-emsdk needed).
      - name: Install nightly Rust with the Emscripten target
        # @nightly matches the repo's other nightly jobs; the exact nightly is
        # pinned via the toolchain: input below.
        uses: dtolnay/rust-toolchain@5b842231ba77f5c045dba54ac5560fed2db780e2 # nightly
        with:
          toolchain: ${{ env.RUST_NIGHTLY }}
          targets: wasm32-unknown-emscripten

      - name: Install pyodide-build
        run: pip install "pyodide-build==${PYODIDE_BUILD_VERSION}"

      - name: Install pyodide cross-build environment
        run: pyodide xbuildenv install

      - name: Build Pyodide wheel
        working-directory: crates/bashkit-python
        env:
          RUSTUP_TOOLCHAIN: ${{ env.RUST_NIGHTLY }}
        run: pyodide build --outdir dist

      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: pypi_files-emscripten
          path: crates/bashkit-python/dist

  # Verify built artifacts
  inspect:
    name: Inspect artifacts
    needs: [build, build-sdist, build-emscripten]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Verify publish source is on main release tag
        env:
          EVENT_NAME: ${{ github.event_name }}
          RELEASE_TAG: ${{ github.event.release.tag_name }}
        run: |
          git fetch --no-tags origin main:refs/remotes/origin/main
          SOURCE_SHA=$(git rev-parse HEAD)
          if ! git merge-base --is-ancestor "$SOURCE_SHA" origin/main; then
            echo "Error: publish source $SOURCE_SHA is not reachable from origin/main"
            exit 1
          fi

          if [ "$EVENT_NAME" = "release" ]; then
            TAG_VERSION="$RELEASE_TAG"
          else
            if [[ ! "$GITHUB_REF" =~ ^refs/tags/v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
              echo "Error: manual publish must run from a stable release tag"
              exit 1
            fi
            TAG_VERSION="${GITHUB_REF#refs/tags/}"
          fi

          TAG_VERSION="${TAG_VERSION#v}"
          CARGO_VERSION=$(grep '^version' Cargo.toml | head -1 | sed 's/.*"\(.*\)".*/\1/')
          if [ "$TAG_VERSION" != "$CARGO_VERSION" ]; then
            echo "Error: Tag version ($TAG_VERSION) does not match Cargo.toml version ($CARGO_VERSION)"
            exit 1
          fi
          echo "Publish source verified: $SOURCE_SHA at v$TAG_VERSION"

      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          pattern: pypi_files-*
          merge-multiple: true
          path: dist

      - name: List dist files
        run: |
          ls -lhR dist/
          echo "---"
          echo "Total files: $(ls -1 dist/ | wc -l)"

      - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
      - run: uvx twine check dist/*

  # Smoke-test wheels on each OS, including the new cp314 artifacts
  test-builds:
    name: Test wheel on ${{ matrix.os }} (Python ${{ matrix.python-version }})
    needs: [build]
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: linux
            runs-on: ubuntu-latest
            python-version: "3.12"
          - os: linux
            runs-on: ubuntu-latest
            python-version: "3.14"
          - os: macos
            runs-on: macos-latest
            python-version: "3.12"
          - os: macos
            runs-on: macos-latest
            python-version: "3.14"
          - os: windows
            runs-on: windows-latest
            python-version: "3.12"
          - os: windows
            runs-on: windows-latest
            python-version: "3.14"
    runs-on: ${{ matrix.runs-on }}
    steps:
      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
        with:
          python-version: ${{ matrix.python-version }}

      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          pattern: pypi_files-${{ matrix.os }}-*
          merge-multiple: true
          path: dist

      - name: Install from wheel
        run: pip install bashkit --no-index --find-links dist --force-reinstall

      - name: Smoke test
        run: python -c "from bashkit import BashTool; t = BashTool(); r = t.execute_sync('echo hello'); print(r); assert r.exit_code == 0"

  # Publish to PyPI using trusted publishing (OIDC)
  publish:
    name: Publish to PyPI
    needs: [inspect, test-builds]
    if: success()
    runs-on: ubuntu-latest

    environment:
      name: release-python

    permissions:
      id-token: write

    steps:
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          pattern: pypi_files-*
          merge-multiple: true
          path: dist

      - name: List dist files
        run: ls -lhR dist/

      - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2

      - name: Publish to PyPI
        run: uv publish --trusted-publishing always dist/*