cd.yml

name: cd

on:
  push:
    branches:
      - main
    tags:
      - '**'
  pull_request:

env:
  CARGO_TERM_COLOR: always

jobs:
  build:
    name: build on ${{ matrix.os }} (${{ matrix.target }}${{ matrix.os == 'linux' && format(' - {0}', matrix.manylinux == 'auto' && 'manylinux' || matrix.manylinux) || '' }})
    # only run on push to main and on release
    if: startsWith(github.ref, 'refs/tags/') || github.ref == 'refs/heads/main' || contains(github.event.pull_request.labels.*.name, 'Full Build')
    strategy:
      fail-fast: false
      matrix:
        os: [linux, macos, windows]
        target: [x86_64, aarch64]
        manylinux: ['2_28']
        include:
          # manylinux for various platforms
          - { os: linux, manylinux: '2_28', target: i686 }
          - { os: linux, manylinux: '2_28', target: aarch64 }
          - { os: linux, manylinux: '2_28', target: armv7 }
          - { os: linux, manylinux: '2_28', target: ppc64le }
          - { os: linux, manylinux: '2_28', target: s390x }
          # musl
          - { os: linux, manylinux: musllinux_1_1, target: x86_64 }
          - { os: linux, manylinux: musllinux_1_1, target: aarch64 }
          - { os: linux, manylinux: musllinux_1_1, target: armv7 }
          # macos
          - { os: macos, target: x86_64 }
          - { os: macos, target: aarch64 }
          # windows
          - { os: windows, target: x86_64 }
          - { os: windows, target: i686, python-architecture: x86 }
          - { os: windows, target: aarch64 }
    runs-on: ${{ (matrix.os == 'linux' && 'ubuntu') || matrix.os }}-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: '3.13'
          architecture: ${{ matrix.python-architecture || 'x64' }}
      - run: pip install twine
      - uses: PyO3/maturin-action@v1
        with:
          target: ${{ matrix.target }}
          manylinux: ${{ matrix.manylinux }}
          args: --release --out dist --interpreter '3.11 3.12 3.13'
          rust-toolchain: stable
          docker-options: -e CI
      - run: ${{ (matrix.os == 'windows' && 'dir') || 'ls -lh' }} dist/
      - run: twine check --strict dist/*
      - uses: actions/upload-artifact@v4
        with:
          name: pypi-wheels-${{ matrix.os }}-${{ matrix.target }}-${{ matrix.manylinux }}
          path: dist

  inspect:
    # same condition as above in `build`
    if: startsWith(github.ref, 'refs/tags/') || github.ref == 'refs/heads/main' || contains(github.event.pull_request.labels.*.name, 'Full Build')
    runs-on: ubuntu-latest
    needs: build
    steps:
      # keep this the same as below in `publish`
      - uses: actions/download-artifact@v4
        with:
          pattern: pypi-wheels-*
          merge-multiple: true
      - run: ls -lh dist/

  publish:
    if: startsWith(github.ref, 'refs/tags/')
    runs-on: ubuntu-latest
    needs: inspect
    environment: pypi
    permissions:
      id-token: write # to authenticate as Trusted Publisher to pypi.org
    steps:
      # keep this the same as above in `inspect`
      - uses: actions/download-artifact@v4
        with:
          pattern: pypi-wheels-*
          merge-multiple: true
      - uses: pypa/gh-action-pypi-publish@release/v1
        with:
          packages-dir: dist

  release:
    name: update a release PR
    if: github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    permissions:
      pull-requests: write
      contents: write
    steps:
    - uses: actions/checkout@v4
    - uses: dtolnay/rust-toolchain@stable
    - uses: MarcoIeni/release-plz-action@v0.5
      with:
        # since we don’t publish to crates.io,
        # we only want the PR and don’t need to specify a token
        command: release-pr