release-python.yml

name: Release Python Wheels

on:
  workflow_dispatch:
    inputs:
      release_tag:
        description: "Release tag to upload wheels to, for example v0.8.0-alpha.5"
        required: true
        type: string
      publish_to_pypi:
        description: "Publish wheels to PyPI after checks pass"
        required: true
        default: true
        type: boolean

permissions:
  contents: read

jobs:
  validate-inputs:
    name: validate-inputs
    runs-on: ubuntu-24.04
    outputs:
      source_ref: ${{ steps.release.outputs.source_ref }}
      source_sha: ${{ steps.source.outputs.source_sha }}
      source_tree: ${{ steps.source.outputs.source_tree }}
      release_tag: ${{ steps.release.outputs.release_tag }}
      version: ${{ steps.release.outputs.version }}
    steps:
      - name: Validate release inputs
        id: release
        shell: bash
        env:
          DISPATCH_RELEASE_TAG: ${{ inputs.release_tag }}
        run: |
          set -euo pipefail

          semver_re='^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(-(alpha|beta|rc)\.(0|[1-9][0-9]*))?(\+[0-9A-Za-z-]+(\.[0-9A-Za-z-]+)*)?$'
          tag_re="^v${semver_re#^}"
          fail() {
            echo "::error::$1" >&2
            exit 1
          }

          RELEASE_TAG="$DISPATCH_RELEASE_TAG"

          [[ "$RELEASE_TAG" =~ $tag_re ]] || fail "release_tag must match vX.Y.Z or vX.Y.Z-alpha.N/beta.N/rc.N."
          SOURCE_REF="refs/tags/$RELEASE_TAG"

          VERSION="${RELEASE_TAG#v}"
          [[ "$VERSION" =~ $semver_re ]] || fail "release_tag contains an unsupported SemVer version."

          {
            printf 'source_ref=%s\n' "$SOURCE_REF"
            printf 'release_tag=%s\n' "$RELEASE_TAG"
            printf 'version=%s\n' "$VERSION"
          } >> "$GITHUB_OUTPUT"

      - uses: actions/checkout@v7.0.1
        with:
          ref: ${{ steps.release.outputs.source_ref }}
          persist-credentials: false
          fetch-depth: 1
          fetch-tags: true

      - name: Resolve immutable release source
        id: source
        shell: bash
        env:
          RELEASE_TAG: ${{ steps.release.outputs.release_tag }}
        run: |
          set -euo pipefail
          source_sha="$(git rev-parse "HEAD^{commit}")"
          source_tree="$(git rev-parse "HEAD^{tree}")"
          tag_sha="$(git rev-parse "refs/tags/${RELEASE_TAG}^{commit}")"
          tag_tree="$(git rev-parse "refs/tags/${RELEASE_TAG}^{tree}")"
          test "$source_sha" = "$tag_sha"
          test "$source_tree" = "$tag_tree"
          {
            printf 'source_sha=%s\n' "$source_sha"
            printf 'source_tree=%s\n' "$source_tree"
          } >> "$GITHUB_OUTPUT"

  build:
    needs: validate-inputs
    name: build (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os:
          - ubuntu-24.04
          - macos-15
          - windows-2025-vs2026

    defaults:
      run:
        shell: bash

    steps:
      - uses: actions/checkout@v7.0.1
        with:
          ref: ${{ needs.validate-inputs.outputs.source_sha }}
          persist-credentials: false

      - name: Verify pinned release source
        shell: bash
        env:
          EXPECTED_SOURCE_SHA: ${{ needs.validate-inputs.outputs.source_sha }}
          EXPECTED_SOURCE_TREE: ${{ needs.validate-inputs.outputs.source_tree }}
        run: |
          set -euo pipefail
          test "$(git rev-parse "HEAD^{commit}")" = "$EXPECTED_SOURCE_SHA"
          test "$(git rev-parse "HEAD^{tree}")" = "$EXPECTED_SOURCE_TREE"

      - name: Use validated release metadata
        id: version
        env:
          RELEASE_TAG: ${{ needs.validate-inputs.outputs.release_tag }}
          VERSION: ${{ needs.validate-inputs.outputs.version }}
        run: |
          set -euo pipefail
          {
            printf 'tag=%s\n' "$RELEASE_TAG"
            printf 'version=%s\n' "$VERSION"
          } >> "$GITHUB_OUTPUT"
          echo "Tag version: $VERSION"

      - name: Setup Python
        uses: actions/setup-python@v7.0.0
        with:
          python-version: "3.12"

      - name: Verify Python package version matches tag
        env:
          VERSION: ${{ steps.version.outputs.version }}
        run: python scripts/release-version.py check --version "$VERSION"

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@1.95.0

      - name: Rust cache
        uses: Swatinem/rust-cache@v2.9.2

      - name: Build wheel
        run: python scripts/build-python-uniffi-wheel.py

      - name: Repair Linux wheel
        if: runner.os == 'Linux'
        run: |
          sudo apt-get update
          sudo apt-get install -y patchelf
          python -m pip install --upgrade auditwheel
          mkdir -p target/python-wheels/repaired
          python -m auditwheel repair target/python-wheels/merman-*.whl --wheel-dir target/python-wheels/repaired
          rm target/python-wheels/merman-*.whl
          mv target/python-wheels/repaired/merman-*.whl target/python-wheels/
          rmdir target/python-wheels/repaired

      - name: Run final wheel install smoke
        run: |
          python -m venv target/python-final-wheel-smoke
          if [ -f target/python-final-wheel-smoke/Scripts/python.exe ]; then
            PYTHON=target/python-final-wheel-smoke/Scripts/python.exe
          else
            PYTHON=target/python-final-wheel-smoke/bin/python
          fi
          "$PYTHON" -m pip install --no-deps target/python-wheels/merman-*.whl
          "$PYTHON" platforms/python/merman/examples/smoke.py

      - name: Upload wheel artifact
        uses: actions/upload-artifact@v7.0.1
        with:
          name: python-wheel-${{ runner.os }}-${{ runner.arch }}
          path: target/python-wheels/merman-*.whl

  verify-wheel-metadata:
    needs:
      - validate-inputs
      - build
    runs-on: ubuntu-24.04
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v7.0.1
        with:
          ref: ${{ needs.validate-inputs.outputs.source_sha }}
          persist-credentials: false

      - name: Setup Python
        uses: actions/setup-python@v7.0.0
        with:
          python-version: "3.12"

      - name: Download wheel artifacts
        uses: actions/download-artifact@v8.0.1
        with:
          pattern: python-wheel-*
          path: wheels
          merge-multiple: true

      - name: Check wheel metadata
        run: |
          python -m pip install --upgrade twine
          python -m twine check wheels/merman-*.whl
          wheels=(wheels/merman-*.whl)
          test "${#wheels[@]}" -eq 3
          python scripts/python_wheel_licenses.py "${wheels[@]}"
          python - <<'PY'
          from pathlib import Path
          from zipfile import ZipFile

          for wheel in sorted(Path("wheels").glob("merman-*.whl")):
              with ZipFile(wheel) as archive:
                  names = archive.namelist()
                  required_suffixes = (
                      ".dist-info/licenses/LICENSE",
                      ".dist-info/licenses/THIRD_PARTY_NOTICES.md",
                  )
                  for suffix in required_suffixes:
                      if not any(name.endswith(suffix) for name in names):
                          raise SystemExit(f"{wheel} is missing {suffix}")
                  if not any(".dist-info/licenses/THIRD_PARTY_LICENSES/" in name for name in names):
                      raise SystemExit(f"{wheel} is missing third-party license texts")
          PY

  github-release:
    needs:
      - validate-inputs
      - verify-wheel-metadata
    runs-on: ubuntu-24.04
    environment: github-release
    permissions:
      contents: write
    steps:
      - name: Download wheel artifacts
        uses: actions/download-artifact@v8.0.1
        with:
          pattern: python-wheel-*
          path: wheels
          merge-multiple: true

      - name: Create GitHub Release
        env:
          GH_TOKEN: ${{ github.token }}
          GH_REPO: ${{ github.repository }}
          RELEASE_TAG: ${{ needs.validate-inputs.outputs.release_tag }}
        run: |
          if gh release view "$RELEASE_TAG" >/dev/null 2>&1; then
            gh release upload "$RELEASE_TAG" wheels/merman-*.whl --clobber
          else
            echo "::error::GitHub Release $RELEASE_TAG does not exist; create it before uploading Python wheel assets."
            exit 1
          fi

  publish:
    needs:
      - verify-wheel-metadata
      - github-release
    if: ${{ inputs.publish_to_pypi }}
    runs-on: ubuntu-24.04
    environment: pypi
    permissions:
      contents: read
      id-token: write
    steps:
      - name: Download wheel artifacts
        uses: actions/download-artifact@v8.0.1
        with:
          pattern: python-wheel-*
          path: wheels
          merge-multiple: true

      - name: Publish to PyPI
        uses: pypa/gh-action-pypi-publish@v1.14.2
        with:
          packages-dir: wheels
          skip-existing: true