python.yml

name: python

on:
  push:
  release:
    types:
      - published

concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

# See the cache-key comment in `build_test.yml` for why the keys look like this.
env:
  CCACHE_DIR: ${{ github.workspace }}/.ccache
  CCACHE_MAXSIZE: 1G
  CCACHE_KEY_SUFFIX: r1
  CONAN_HOME: ${{ github.workspace }}/.conan2
  CONAN_KEY_SUFFIX: r1

jobs:
  format:
    runs-on: ubuntu-24.04
    steps:
      - name: checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: setup python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
        with:
          python-version: 3.14
      - name: install black
        run: pip install black

      - name: check python formatting
        run: black --check --diff python

  # The bindings themselves are built and tested by the `build` job in
  # `build_test.yml`, out of the same configure as the core. What stays here is
  # everything that needs the wheel's own, reduced dependency set.
  wheels:
    runs-on: ${{ matrix.os }}
    # Builds the wheel-specific configuration that `pyproject.toml` pins
    # (static, no cli/tests, bundled assets), so it cannot share a cache with
    # `build_test`.
    env:
      CACHE_FLAVOR: wheel
    strategy:
      fail-fast: false
      matrix:
        include:
          - { os: ubuntu-24.04, build_profile: ubuntu-24.04-clang-18, host_profile: ubuntu-24.04-clang-18 }
          - { os: macos-26, build_profile: macos-26-armv8-clang-14, host_profile: macos-26-armv8-clang-14 }
    steps:
      - name: checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          # setuptools-scm derives the package version from git tags.
          fetch-depth: 0
      - name: checkout conan-odr-index
        run: git submodule update --init --depth 1 conan-odr-index

      # The conan profiles use ccache as compiler launcher, so it must exist
      # even for `--build missing` source builds.
      - name: ubuntu install ccache
        if: runner.os == 'Linux'
        run: |
          sudo apt install ccache
          ccache -V
      - name: macos install ccache
        if: runner.os == 'macOS'
        run: |
          brew install ccache
          ccache -V

      - name: setup python 3.14
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
        with:
          python-version: 3.14
      - name: install python dependencies
        run: pip install conan build pytest

      - name: conan cache key
        shell: bash
        run: echo "CONAN_CACHE_KEY=$(git rev-parse HEAD:conan-odr-index)-${{ hashFiles('conanfile.py', 'pyproject.toml', '.github/config/conan/**') }}" >> "$GITHUB_ENV"

      - name: cache conan
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
        with:
          path: ${{ env.CONAN_HOME }}
          key: conan-${{ env.CACHE_FLAVOR }}-${{ matrix.host_profile }}-${{ env.CONAN_KEY_SUFFIX }}-${{ env.CONAN_CACHE_KEY }}
          restore-keys: |
            conan-${{ env.CACHE_FLAVOR }}-${{ matrix.host_profile }}-${{ env.CONAN_KEY_SUFFIX }}-

      - name: export conan-odr-index
        run: python conan-odr-index/scripts/conan_export_all_packages.py --selection-config conan-odr-index/defaults.yaml
      - name: conan config
        run: conan config install .github/config/conan

      - name: restore ccache
        uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
        with:
          path: ${{ env.CCACHE_DIR }}
          key: ccache-${{ env.CACHE_FLAVOR }}-${{ matrix.host_profile }}-${{ env.CCACHE_KEY_SUFFIX }}-${{ github.run_id }}
          restore-keys: |
            ccache-${{ env.CACHE_FLAVOR }}-${{ matrix.host_profile }}-${{ env.CCACHE_KEY_SUFFIX }}-

      # Match the dependency set that pyproject.toml enables. libmagic stays on
      # and `bundle_assets` bridges its database path into the build so
      # `magic.mgc` lands in `pyodr/data`.
      - name: conan install
        run: >
          conan install .
          -o '&:with_python=True'
          -o '&:bundle_assets=True'
          --profile:host '${{ matrix.host_profile }}'
          --profile:build '${{ matrix.build_profile }}'
          --build missing

      - name: build wheel
        run: python -m build --wheel
        env:
          CMAKE_ARGS: -DCMAKE_TOOLCHAIN_FILE=${{ github.workspace }}/conan_toolchain.cmake

      - name: save ccache
        if: github.ref == 'refs/heads/main'
        uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
        with:
          path: ${{ env.CCACHE_DIR }}
          key: ccache-${{ env.CACHE_FLAVOR }}-${{ matrix.host_profile }}-${{ env.CCACHE_KEY_SUFFIX }}-${{ github.run_id }}

      # PyPI rejects plain `linux_*` platform tags; auditwheel grafts the wheel
      # onto the matching manylinux tag (the conan deps are linked statically,
      # so there should be no external libraries to vendor).
      - name: audit wheel
        if: runner.os == 'Linux'
        run: |
          sudo apt install patchelf
          pipx run auditwheel repair --wheel-dir dist-audited dist/*.whl
          rm dist/*.whl
          mv dist-audited/*.whl dist/

      - name: test wheel
        run: |
          pip install dist/*.whl
          python -m pytest python/tests -v

      - name: upload wheels
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: wheel-${{ matrix.host_profile }}
          path: dist/*.whl
          if-no-files-found: error

  sdist:
    runs-on: ubuntu-24.04
    steps:
      - name: checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          # setuptools-scm derives the package version from git tags.
          fetch-depth: 0

      - name: build sdist
        run: pipx run build --sdist
      - name: check metadata
        run: pipx run twine check dist/*

      - name: upload sdist
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: sdist
          path: dist/*.tar.gz
          if-no-files-found: error

  publish:
    needs: [wheels, sdist]
    runs-on: ubuntu-24.04
    if: github.event_name == 'release' && github.event.action == 'published'
    permissions:
      contents: write
    steps:
      - name: download artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          path: dist
          merge-multiple: true

      - name: upload release assets
        env:
          GH_TOKEN: ${{ github.token }}
        run: gh release upload '${{ github.event.release.tag_name }}' dist/* --repo '${{ github.repository }}'

  # Uses PyPI trusted publishing (OIDC, no token): the `pyodr` project on PyPI
  # must list this repo + workflow + the `pypi` environment as a publisher.
  # Note pip cannot build the published sdist on its own (the build needs a
  # conan-generated toolchain plus the conan-odr-index recipes, see
  # python/README.md); it is published for completeness.
  pypi:
    needs: [wheels, sdist]
    runs-on: ubuntu-24.04
    if: github.event_name == 'release' && github.event.action == 'published'
    environment: pypi
    permissions:
      id-token: write
    steps:
      - name: download artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          path: dist
          merge-multiple: true

      - name: publish to PyPI
        uses: pypa/gh-action-pypi-publish@ba38be9e461d3875417946c167d0b5f3d385a247 # v1.14.1