release-rust-python-package.yaml

name: Release Rust Python Package Plugin

on:
  push:
    tags:
      - "*-v*"
  workflow_call:
    inputs:
      tag:
        description: "Release tag <slug>-v<version> at the workflow commit"
        required: true
        type: string
      repository:
        description: "Target package repository"
        required: true
        type: string
      publish_enabled:
        description: "Whether to run the publish job"
        required: false
        default: false
        type: boolean
  workflow_dispatch:
    inputs:
      tag:
        description: "Release tag <slug>-v<version> at the workflow commit; dispatch on this tag"
        required: true
        type: string
      repository:
        description: "Target package repository"
        required: true
        default: testpypi
        type: choice
        options:
          - testpypi
          - pypi
      publish_enabled:
        description: "Whether to run the publish job"
        required: false
        default: true
        type: boolean
permissions:
  contents: read

jobs:
  resolve:
    runs-on: ubuntu-latest
    outputs:
      plugin: ${{ steps.resolve.outputs.plugin }}
      slug: ${{ steps.resolve.outputs.plugin }}
      plugin_path: ${{ steps.resolve.outputs.plugin_path }}
      wheel_matrix: ${{ steps.resolve.outputs.wheel_matrix }}
      publish_env: ${{ steps.resolve.outputs.publish_env }}
      publish_enabled: ${{ steps.resolve.outputs.publish_enabled }}
      tag_on_main: ${{ steps.resolve.outputs.tag_on_main }}
      skip: ${{ steps.resolve.outputs.skip }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ github.sha }}

      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.12"

      - name: Validate plugin catalog
        run: python3 tools/plugin_catalog.py validate .

      - id: resolve
        shell: bash
        env:
          TAG_INPUT: ${{ inputs.tag }}
          REPOSITORY_INPUT: ${{ inputs.repository }}
          PUBLISH_ENABLED: ${{ inputs.publish_enabled }}
        run: |
          set -euo pipefail
          git fetch --force origin "refs/heads/main:refs/remotes/origin/main"
          if [[ -n "${TAG_INPUT}" ]]; then
            tag="${TAG_INPUT}"
            repository="${REPOSITORY_INPUT}"
            git check-ref-format "refs/tags/${tag}"
            if git ls-remote --exit-code --tags origin "refs/tags/${tag}" >/dev/null 2>&1; then
              git fetch --force origin "refs/tags/${tag}:refs/tags/${tag}"
              tag_sha="$(git rev-parse --verify "refs/tags/${tag}^{commit}")"
              if [[ "${tag_sha}" != "${GITHUB_SHA}" ]]; then
                echo "Release tag ${tag} does not match workflow commit ${GITHUB_SHA}; dispatch on the release tag" >&2
                exit 1
              fi
            elif [[ "${GITHUB_EVENT_NAME}" == "pull_request" && "${PUBLISH_ENABLED}" == "false" ]]; then
              echo "Validating unreleased tag ${tag} at PR commit ${GITHUB_SHA}"
            else
              echo "Release tag ${tag} does not exist" >&2
              exit 1
            fi
          else
            tag="${GITHUB_REF_NAME}"
            repository="pypi"
          fi

          if git merge-base --is-ancestor "${GITHUB_SHA}" "refs/remotes/origin/main"; then
            tag_on_main=true
          else
            tag_on_main=false
          fi

          release_info="$(python3 tools/plugin_catalog.py release-info . "${tag}")"
          plugin="$(printf '%s' "${release_info}" | python3 -c 'import json, sys; print(json.load(sys.stdin)["slug"])')"
          plugin_path="$(printf '%s' "${release_info}" | python3 -c 'import json, sys; print(json.load(sys.stdin)["path"])')"
          language="$(printf '%s' "${release_info}" | python3 -c 'import json, sys; print(json.load(sys.stdin)["language"])')"
          if [[ "${language}" != "rust" ]]; then
            skip=true
            wheel_matrix="[]"
          elif [[ -n "${TAG_INPUT}" ]]; then
            skip=false
            wheel_matrix="$(python3 -c 'import json; print(json.dumps([{"runner":"ubuntu-latest","platform":"linux-x86_64"},{"runner":"ubuntu-24.04-arm","platform":"linux-aarch64"},{"runner":"ubuntu-24.04-s390x","platform":"linux-s390x"},{"runner":"ubuntu-24.04-ppc64le","platform":"linux-ppc64le"},{"runner":"macos-latest","platform":"macos-arm64"},{"runner":"windows-latest","platform":"windows-x86_64"}]))')"
          else
            skip=false
            wheel_matrix="$(printf '%s' "${release_info}" | python3 -c 'import json, sys; print(json.dumps(json.load(sys.stdin)["release_wheel_matrix"]))')"
          fi

          {
            echo "plugin=${plugin}"
            echo "plugin_path=${plugin_path}"
            echo "wheel_matrix=${wheel_matrix}"
            echo "tag_on_main=${tag_on_main}"
            if [[ "${skip}" == "true" ]]; then
              echo "skip=true"
            else
              echo "skip=false"
            fi
            if [[ "${PUBLISH_ENABLED}" == "false" ]]; then
              echo "publish_enabled=false"
            else
              echo "publish_enabled=true"
            fi
            if [[ "${repository}" == "testpypi" ]]; then
              echo "publish_env=testpypi"
            else
              echo "publish_env=pypi"
            fi
          } >> "$GITHUB_OUTPUT"

  preflight:
    needs: resolve
    if: needs.resolve.outputs.skip != 'true'
    runs-on: ubuntu-latest
    defaults:
      run:
        shell: bash
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ github.sha }}

      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.12"

      - name: Verify Rust toolchain
        run: |
          rustc --version
          cargo --version

      - name: Verify stubs are checked in
        working-directory: ${{ needs.resolve.outputs.plugin_path }}
        run: test -n "$(find . -name '*.pyi' -print -quit)"

  build-wheel:
    needs: [resolve, preflight]
    if: needs.resolve.outputs.skip != 'true'
    strategy:
      fail-fast: false
      matrix:
        include: ${{ fromJson(needs.resolve.outputs.wheel_matrix) }}
    runs-on: ${{ matrix.runner }}
    defaults:
      run:
        shell: bash
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ github.sha }}

      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        if: ${{ matrix.runner != 'ubuntu-24.04-s390x' && matrix.runner != 'ubuntu-24.04-ppc64le' }}
        with:
          python-version: "3.12"

      - name: Install system Python on partner runners
        if: ${{ matrix.runner == 'ubuntu-24.04-s390x' || matrix.runner == 'ubuntu-24.04-ppc64le' }}
        run: |
          sudo apt-get update
          sudo apt-get install -y python3.12 python3.12-dev python3.12-venv python3-pip
          sudo apt-get clean
          sudo rm -rf /var/lib/apt/lists/*
          python_bin_dir="${RUNNER_TEMP}/python-bin"
          mkdir -p "${python_bin_dir}"
          ln -sf "$(which python3.12)" "${python_bin_dir}/python"
          export PATH="${python_bin_dir}:$PATH"
          echo "${python_bin_dir}" >> "$GITHUB_PATH"
          python --version
          python -m pip --version

      - name: Verify Rust toolchain
        run: |
          rustc --version
          cargo --version

      - name: Install uv
        run: python -m pip install uv==0.9.30 maturin==1.12.6

      - name: Build wheel
        working-directory: ${{ needs.resolve.outputs.plugin_path }}
        run: uv run maturin build --release --out dist

      - name: Upload wheel artifact
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: wheel-${{ matrix.platform }}
          path: ${{ needs.resolve.outputs.plugin_path }}/dist/*.whl

      - name: Test built wheel in isolated virtualenv
        working-directory: ${{ needs.resolve.outputs.plugin_path }}
        run: |
          tmpdir="$(mktemp -d)"
          python -m venv "${tmpdir}/venv"
          venv_python="${tmpdir}/venv/bin/python"
          if [[ ! -f "${venv_python}" ]]; then
            venv_python="${tmpdir}/venv/Scripts/python.exe"
          fi
          uv pip install --python "${venv_python}" --group dev PyYAML
          "${venv_python}" -m pip install dist/*.whl
          if [[ -d "${GITHUB_WORKSPACE}/plugins/tests/${{ needs.resolve.outputs.slug }}" ]]; then
            mkdir -p "${tmpdir}/tests"
            cp -R "${GITHUB_WORKSPACE}/plugins/tests/${{ needs.resolve.outputs.slug }}" "${tmpdir}/tests/${{ needs.resolve.outputs.slug }}"
            cp "${GITHUB_WORKSPACE}/plugins/tests/conftest.py" "${tmpdir}/tests/conftest.py"
            cp "${GITHUB_WORKSPACE}/plugins/tests/plugin_hooks.py" "${tmpdir}/tests/plugin_hooks.py"
            cp "${GITHUB_WORKSPACE}/plugins/tests/real_cpex_imports.py" "${tmpdir}/tests/real_cpex_imports.py"
            cp "${GITHUB_WORKSPACE}/plugins/tests/pytest.ini" "${tmpdir}/pytest.ini"
            cd "${tmpdir}"
            export CPEX_TEST_PLUGIN_HOOKS=1
            export PYTHONPATH="${tmpdir}/tests"
            "${venv_python}" -m pytest \
              -c "${tmpdir}/pytest.ini" \
              "${tmpdir}/tests/${{ needs.resolve.outputs.slug }}" -v
          fi

  build-sdist:
    needs: [resolve, preflight]
    if: needs.resolve.outputs.skip != 'true'
    runs-on: ubuntu-latest
    defaults:
      run:
        shell: bash
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ github.sha }}

      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.12"

      - name: Install uv
        run: python -m pip install uv==0.9.30 maturin==1.12.6

      - name: Build sdist
        working-directory: ${{ needs.resolve.outputs.plugin_path }}
        run: uv run maturin sdist --out dist

      - name: Upload sdist artifact
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: sdist
          path: ${{ needs.resolve.outputs.plugin_path }}/dist/*.tar.gz

      - name: Test built sdist in isolated virtualenv
        working-directory: ${{ needs.resolve.outputs.plugin_path }}
        run: |
          tmpdir="$(mktemp -d)"
          python -m venv "${tmpdir}/venv"
          venv_python="${tmpdir}/venv/bin/python"
          if [[ ! -f "${venv_python}" ]]; then
            venv_python="${tmpdir}/venv/Scripts/python.exe"
          fi
          uv pip install --python "${venv_python}" --group dev PyYAML
          "${venv_python}" -m pip install dist/*.tar.gz
          if [[ -d "${GITHUB_WORKSPACE}/plugins/tests/${{ needs.resolve.outputs.slug }}" ]]; then
            mkdir -p "${tmpdir}/tests"
            cp -R "${GITHUB_WORKSPACE}/plugins/tests/${{ needs.resolve.outputs.slug }}" "${tmpdir}/tests/${{ needs.resolve.outputs.slug }}"
            cp "${GITHUB_WORKSPACE}/plugins/tests/conftest.py" "${tmpdir}/tests/conftest.py"
            cp "${GITHUB_WORKSPACE}/plugins/tests/plugin_hooks.py" "${tmpdir}/tests/plugin_hooks.py"
            cp "${GITHUB_WORKSPACE}/plugins/tests/real_cpex_imports.py" "${tmpdir}/tests/real_cpex_imports.py"
            cp "${GITHUB_WORKSPACE}/plugins/tests/pytest.ini" "${tmpdir}/pytest.ini"
            cd "${tmpdir}"
            export CPEX_TEST_PLUGIN_HOOKS=1
            export PYTHONPATH="${tmpdir}/tests"
            "${venv_python}" -m pytest \
              -c "${tmpdir}/pytest.ini" \
              "${tmpdir}/tests/${{ needs.resolve.outputs.slug }}" -v
          fi

  publish:
    if: ${{ needs.resolve.outputs.skip != 'true' && needs.resolve.outputs.publish_enabled == 'true' && (needs.resolve.outputs.publish_env != 'pypi' || needs.resolve.outputs.tag_on_main == 'true') }}
    needs: [resolve, build-wheel, build-sdist]
    runs-on: ubuntu-latest
    environment: ${{ needs.resolve.outputs.publish_env }}
    permissions:
      id-token: write
    steps:
      - name: Download all artifacts
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          path: dist
          merge-multiple: true

      - name: Publish distributions to TestPyPI
        if: needs.resolve.outputs.publish_env == 'testpypi'
        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
        with:
          packages-dir: dist/
          repository-url: https://test.pypi.org/legacy/
          skip-existing: true

      - name: Publish distributions to PyPI
        if: needs.resolve.outputs.publish_env == 'pypi'
        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
        with:
          packages-dir: dist/
          skip-existing: true