wheels.yml

name: Wheels

# Build the wheels (cibuildwheel; config in pyproject.toml) and the sdist
# as artifacts. setup-recipe stages the llvm-wheel toolchain at /opt/llvm;
# linux mounts it into the build container, the same manylinux_2_28 image
# the toolchain was built on.

# Every code PR and every push to main builds one python per platform
# with the full suite inside; the `build-wheels` label switches a PR to
# the full python list plus the sdist install test. Schedule, tags, and
# dispatch always build the full list.
on:
  workflow_dispatch:
  pull_request:
    types: [opened, synchronize, reopened, labeled]
    paths-ignore:
      - 'README.md'
  push:
    branches: [main]
    tags: ['v*']
  schedule:
    - cron: '30 4 * * 1'

permissions:
  contents: read

concurrency:
  group: wheels-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  wheels:
    name: ${{ matrix.label }}
    # Label events run only when the PR carries build-wheels, whichever
    # label fired; jobs without a needs edge repeat the guard by alias.
    if: &label-guard ${{ github.event.action != 'labeled' || contains(github.event.pull_request.labels.*.name, 'build-wheels') }}
    strategy:
      fail-fast: false
      matrix:
        # One row per shipped wheel; test-relocation reuses this list.
        include: &platforms
          - { os: ubuntu-24.04,     label: manylinux-x86_64,  arch: x86_64 }
          - { os: ubuntu-24.04-arm, label: manylinux-aarch64, arch: aarch64 }
          - { os: macos-26,         label: macosx-arm64,      arch: arm64 }
          - { os: macos-26-intel,   label: macosx-x86_64,     arch: x86_64 }
    runs-on: ${{ matrix.os }}

    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false

      # ref pins the recipe content the cache key is computed from.
      - uses: compiler-research/ci-workflows/actions/setup-recipe@main
        id: llvm
        with:
          recipe: llvm-wheel
          version: '21.1.8'
          os: ${{ matrix.os }}
          arch: ${{ matrix.arch }}
          ref: 02f380b2e46746cd1c948c085894b8594a867fba

      - name: Stage the toolchain at /opt/llvm
        env:
          RECIPE_PATH: ${{ steps.llvm.outputs.path }}
        run: sudo mv "$RECIPE_PATH" /opt/llvm

      # The inverse of test-sdist's full-run condition: plain PRs and
      # main pushes build one python; schedule, dispatch, tags, and PRs
      # labeled build-wheels fall through to pyproject's full list.
      - name: Build one python unless a full run is requested
        if: >-
          ${{ !(github.event_name == 'schedule'
          || github.event_name == 'workflow_dispatch'
          || startsWith(github.ref, 'refs/tags/')
          || contains(github.event.pull_request.labels.*.name, 'build-wheels')) }}
        run: echo 'CIBW_BUILD=cp314-*' >> "$GITHUB_ENV"

      - uses: pypa/cibuildwheel@v4.2.0

      - name: Assert the build left the checkout clean
        run: git diff --exit-code

      - name: Check the wheels against the content allowlist
        run: python3 .github/wheel_contents_check.py wheelhouse/*.whl

      - uses: actions/upload-artifact@v7
        with:
          name: wheels-${{ matrix.label }}
          path: wheelhouse/*.whl
          if-no-files-found: error

  # Relocation: each wheel installs and runs the full suite away from its
  # build machine. The linux image starts bare (g++ because the JIT reads
  # the host's C++ standard library headers). The label guard reaches
  # this job through needs.
  test-relocation:
    name: test relocation (${{ matrix.label }})
    needs: wheels
    strategy:
      fail-fast: false
      matrix:
        include: *platforms
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false

      - uses: actions/download-artifact@v8
        with:
          name: wheels-${{ matrix.label }}
          path: dist

      - name: Install the cp314 wheel and run the suite on python:3.14-slim
        if: runner.os == 'Linux'
        run: |
          docker run --rm -v "$PWD":/src -w /src -e PYTHONSAFEPATH=1 \
              -e DEBIAN_FRONTEND=noninteractive python:3.14-slim bash -ec '
              apt-get -qq update && apt-get -qq -y install g++ make libeigen3-dev libboost-dev
              pip install dist/cppjit-*cp314*.whl -r requirements.txt
              bash .github/wheel_test.sh'

      - uses: actions/setup-python@v7
        if: runner.os == 'macOS'
        with:
          python-version: '3.14'

      - name: Install the cp314 wheel and run the suite
        if: runner.os == 'macOS'
        env:
          PYTHONSAFEPATH: '1'
        run: |
          brew install eigen boost
          pip install dist/cppjit-*cp314*.whl -r requirements.txt
          bash .github/wheel_test.sh

  sdist:
    name: sdist
    if: *label-guard
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false

      - run: pipx run build --sdist

      - name: Check the sdist metadata
        run: pipx run twine check dist/*.tar.gz

      - uses: actions/upload-artifact@v7
        with:
          name: sdist
          path: dist/*.tar.gz
          if-no-files-found: error

  # Build from the sdist and run the full suite against the install.
  # PR source-build coverage lives in ci.yml; this job rides the full
  # runs (schedule/tag/dispatch and the build-wheels label).
  test-sdist:
    name: test sdist (build + full suite)
    needs: sdist
    if: >-
      ${{ github.event_name == 'schedule'
      || github.event_name == 'workflow_dispatch'
      || startsWith(github.ref, 'refs/tags/')
      || contains(github.event.pull_request.labels.*.name, 'build-wheels') }}
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false

      - uses: actions/setup-python@v7
        with:
          python-version: '3.12'

      - uses: compiler-research/ci-workflows/actions/setup-recipe@main
        id: llvm
        with:
          recipe: llvm-wheel
          version: '21.1.8'
          os: ubuntu-24.04
          arch: x86_64
          ref: 02f380b2e46746cd1c948c085894b8594a867fba

      - uses: actions/download-artifact@v8
        with:
          name: sdist
          path: dist

      - name: Install the test suite's native deps
        run: sudo apt-get -q update && sudo apt-get -y install libeigen3-dev libboost-dev

      - name: Build and install from the sdist with the test requirements
        env:
          RECIPE_PATH: ${{ steps.llvm.outputs.path }}
        run: >
          python -m pip install dist/cppjit-*.tar.gz -v
          --config-settings=cmake.define.LLVM_DIR="$RECIPE_PATH/lib/cmake/llvm"
          --config-settings=cmake.define.Clang_DIR="$RECIPE_PATH/lib/cmake/clang"
          -r requirements.txt

      - name: Run the test suite against the sdist install
        run: bash .github/wheel_test.sh