kerness/.github/workflows/release.yml at main · xwings/kerness · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
# Builds the release artifacts, attaches them to a draft GitHub Release, and
# uploads the wheels and the sdist to PyPI.
#
# Nothing authenticates with a stored token. `publish-pypi` requests a GitHub
# OIDC identity token and maturin exchanges it for a short-lived PyPI one at
# upload time, so PyPI must carry a Trusted Publisher for owner `xwings`,
# repository `kerness`, workflow `release.yml`, environment `pypi`. The four
# have to match exactly or the exchange is refused.
#
# Publishing runs on `v*` tags after every wheel and the clean sdist install
# pass. The `pypi` environment must allow tags matching `v*`; a branch rule for
# `main` does not allow tags. Required reviewers are optional; leave them unset
# for automatic publishing. See README.md#releasing for the one-time setup.
#
# The crate is not published from here. To start, add to the end of this file:
#
#   publish-crate:
#     needs: [verify-sdist]
#     runs-on: ubuntu-latest
#     steps:
#       - uses: actions/checkout@v4
#       - uses: dtolnay/rust-toolchain@stable
#       - run: cargo publish -p kerness --locked
#         env:
#           CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
#
# `kerness-py` is not published to crates.io: it is the wheel's contents, and
# nothing depends on it as a crate.

name: Release

on:
  push:
    tags: ["v*"]
  workflow_dispatch:

env:
  CARGO_TERM_COLOR: always

jobs:
  wheels:
    name: Wheel (${{ matrix.platform }} ${{ matrix.target }})
    runs-on: ${{ matrix.runner }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - { platform: linux, runner: ubuntu-latest, target: x86_64 }
          - { platform: linux, runner: ubuntu-24.04-arm, target: aarch64 }
          - { platform: macos, runner: macos-15-intel, target: x86_64 }
          - { platform: macos, runner: macos-15, target: aarch64 }
          - { platform: windows, runner: windows-latest, target: x64 }
    steps:
      - uses: actions/checkout@v4

      # One wheel per platform covers every supported Python: the extension is
      # built against the stable ABI, so the tag is cp310-abi3, not cp310-cp310.
      - uses: PyO3/maturin-action@v1
        with:
          target: ${{ matrix.target }}
          args: --release --out dist
          manylinux: auto
          working-directory: bindings/python

      - uses: actions/upload-artifact@v7
        with:
          name: wheels-${{ matrix.platform }}-${{ matrix.target }}
          path: bindings/python/dist

  sdist:
    name: Source distribution
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: PyO3/maturin-action@v1
        with:
          command: sdist
          args: --out dist
          working-directory: bindings/python

      - uses: actions/upload-artifact@v7
        with:
          name: sdist
          path: bindings/python/dist

  verify-sdist:
    name: Install the sdist from clean
    needs: sdist
    runs-on: ubuntu-latest
    steps:
      # Deliberately no checkout. The interpreter must find the gameplans, the
      # personas and the skills inside the installed package, and a working
      # tree sitting next to it would hide the case where it cannot.
      - uses: actions/setup-python@v5
        with:
          python-version: "3.10"

      - uses: dtolnay/rust-toolchain@stable

      - uses: actions/download-artifact@v4
        with:
          name: sdist
          path: dist

      - name: Install
        run: pip install dist/*.tar.gz

      - name: Self-check
        run: python -m kerness.selfcheck

  release:
    name: Attach to the release
    needs: [wheels, verify-sdist]
    if: startsWith(github.ref, 'refs/tags/v')
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/download-artifact@v4
        with:
          path: dist
          pattern: wheels-*
          merge-multiple: true

      - uses: actions/download-artifact@v4
        with:
          name: sdist
          path: dist

      - uses: softprops/action-gh-release@v2
        with:
          files: dist/*
          draft: true
          generate_release_notes: true

  publish-pypi:
    name: Publish to PyPI
    # Every wheel, not just the sdist check: the job uploads whatever `wheels-*`
    # artifacts exist when it starts, so waiting on only one of the two would
    # race the matrix and ship a partial set of platforms.
    needs: [wheels, verify-sdist]
    # The workflow also answers workflow_dispatch, which would otherwise publish
    # from any branch a manual run was started on.
    if: startsWith(github.ref, 'refs/tags/v')
    runs-on: ubuntu-latest
    environment: pypi
    permissions:
      id-token: write        # PyPI Trusted Publishing — no token in secrets
    steps:
      - uses: actions/download-artifact@v4
        with:
          pattern: wheels-*
          path: dist
          merge-multiple: true

      - uses: actions/download-artifact@v4
        with:
          name: sdist
          path: dist

      - uses: PyO3/maturin-action@v1
        with:
          command: upload
          args: --non-interactive dist/*