python-publish.yml

name: Python Publish

on:
  release:
    types:
      - released
  pull_request:
    paths:
      - .github/workflows/python-publish.yml
      - Cargo.lock
      - python/Cargo.lock
      - python/pyproject.toml
  workflow_dispatch:
    inputs:
      mode:
        description: "dry_run: build & test only, release: build & publish to PyPI"
        required: true
        default: dry_run
        type: choice
        options:
          - dry_run
          - release

jobs:
  build:
    name: build-${{ matrix.name }}
    runs-on: ${{ matrix.os }}
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: linux-x86_64
            os: ubuntu-24.04
            target: x86_64
            manylinux: "2_28"
            wheel-pattern: "*manylinux_2_28_x86_64.whl"
            extra-args: "--sdist"
          - name: linux-aarch64
            os: ubuntu-24.04
            target: aarch64
            manylinux: "2_28"
            wheel-pattern: "*manylinux_2_28_aarch64.whl"
            extra-args: ""
          - name: macos-arm64
            os: macos-14
            target: aarch64-apple-darwin
            wheel-pattern: "*macosx_11_0_arm64.whl"
            extra-args: ""
    env:
      CARGO_TERM_COLOR: always
      RUSTFLAGS: "-C debuginfo=0"
      RUST_BACKTRACE: "1"
      CARGO_INCREMENTAL: "0"
      MACOSX_DEPLOYMENT_TARGET: "11.0"
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Install macOS build dependencies
        if: runner.os == 'macOS'
        run: |
          brew install protobuf

      - name: Build Linux distributions
        if: runner.os == 'Linux'
        uses: PyO3/maturin-action@v1
        with:
          command: build
          args: --release --strip --out dist ${{ matrix.extra-args }}
          working-directory: python
          manylinux: ${{ matrix.manylinux }}
          target: ${{ matrix.target }}
          rust-toolchain: stable
          before-script-linux: |
            if command -v yum >/dev/null 2>&1; then
              yum install -y curl make openssl-devel perl
            elif command -v apt-get >/dev/null 2>&1; then
              apt-get update
              apt-get install -y curl libssl-dev ca-certificates make perl
            fi
            PROTOC_VERSION=25.6
            curl -LsS -o /tmp/protoc.zip "https://github.com/protocolbuffers/protobuf/releases/download/v${PROTOC_VERSION}/protoc-${PROTOC_VERSION}-linux-x86_64.zip"
            python3 - <<'PY'
            from zipfile import ZipFile
            ZipFile("/tmp/protoc.zip").extractall("/tmp/protoc")
            PY
            install -m 0755 /tmp/protoc/bin/protoc /usr/local/bin/protoc
            cp -R /tmp/protoc/include/* /usr/local/include/
            protoc --version

      - name: Build macOS distributions
        if: runner.os == 'macOS'
        uses: PyO3/maturin-action@v1
        with:
          command: build
          args: --release --strip --out dist ${{ matrix.extra-args }}
          working-directory: python
          target: ${{ matrix.target }}
          rust-toolchain: stable

      - name: Verify sdist workspace lockfile
        if: matrix.name == 'linux-x86_64'
        run: |
          python3 - <<'PY'
          import tarfile
          from pathlib import Path

          archives = list(Path("python/dist").glob("*.tar.gz"))
          if len(archives) != 1:
              raise SystemExit(f"Expected one source distribution, found {len(archives)}")
          archive = archives[0]
          with tarfile.open(archive) as source:
              root = archive.name.removesuffix(".tar.gz")
              if f"{root}/Cargo.lock" not in source.getnames():
                  raise SystemExit("Source distribution is missing the workspace Cargo.lock")
              lock = source.extractfile(f"{root}/Cargo.lock")
              if lock is None or lock.read() != Path("Cargo.lock").read_bytes():
                  raise SystemExit("Source distribution must contain the workspace Cargo.lock")
              if f"{root}/python/Cargo.lock" in source.getnames():
                  raise SystemExit("Source distribution contains an obsolete nested Cargo.lock")
          print("Source distribution preserves the workspace Cargo.lock")
          PY

      - name: Verify wheel tag
        run: |
          ls python/dist/${{ matrix.wheel-pattern }}

      - name: Upload distributions
        uses: actions/upload-artifact@v4
        with:
          name: python-dist-${{ matrix.name }}
          path: python/dist

  publish:
    runs-on: ubuntu-latest
    needs: build
    permissions:
      id-token: write
      contents: read
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Install uv
        uses: astral-sh/setup-uv@v4

      - name: Download distributions
        uses: actions/download-artifact@v4
        with:
          pattern: python-dist-*
          path: python/dist
          merge-multiple: true

      - name: Check distribution sizes before publishing
        working-directory: python
        run: |
          python3 - <<'PY'
          from pathlib import Path

          # PyPI reports this limit as "100 MB", but enforces it in MiB.
          max_bytes = 100 * 1024 * 1024
          distributions = sorted(Path("dist").glob("*.whl")) + sorted(
              Path("dist").glob("*.tar.gz")
          )
          if not distributions:
              raise SystemExit("No distributions found in dist/")

          oversized = False
          for path in distributions:
              size = path.stat().st_size
              print(f"{path.name}: {size:,} bytes ({size / 1024**2:.2f} MiB)")
              if size > max_bytes:
                  print(
                      f"::error::{path.name} exceeds the PyPI per-file limit "
                      f"of {max_bytes:,} bytes (100 MiB)"
                  )
                  oversized = True

          if oversized:
              raise SystemExit("Distribution size check failed; nothing was uploaded")
          PY

      - name: Publish to PyPI
        if: >
          (github.event_name == 'release' && github.event.action == 'released') ||
          (github.event_name == 'workflow_dispatch' && github.event.inputs.mode == 'release')
        working-directory: python
        run: |
          uv publish --trusted-publishing always