soth/.github/workflows/python-wheels.yml at main · soth-ai/soth · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
name: python-wheels

# Builds wheels for `soth` (the soth-py PyO3 binding) across the
# supported platform/arch matrix. Triggered on:
#   - push to main / sdk-* branches
#   - pull requests touching the binding
#   - manual workflow_dispatch (for ad-hoc verification)
#
# Wheels are abi3-py310 — one wheel per platform×arch covers
# Python 3.10+, so the matrix is 5 jobs (not 5×N-Python-versions).
#
# This workflow does NOT publish to PyPI. Publication is a separate
# release workflow that gates on artifacts uploaded here.

on:
  # Release-gate only. 5-target wheel matrix (3 on macos-14 / windows-
  # latest) is expensive enough that running it on every PR burned
  # hours on bindings tweaks that didn't change generated wheels.
  # Same rationale as node-binaries.yml — per-arch matrices are
  # release-publication readiness, not PR smoke signal.
  push:
    tags:
      - 'v*'
  workflow_dispatch:
    inputs:
      ref:
        description: 'Branch or commit SHA to test'
        required: false
        type: string

concurrency:
  group: python-wheels-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  build:
    name: ${{ matrix.platform.os }} / ${{ matrix.platform.target }}
    runs-on: ${{ matrix.platform.runs-on }}
    strategy:
      fail-fast: false
      matrix:
        platform:
          # Linux x86_64 — manylinux2014 via cibuildwheel
          - { os: linux, runs-on: ubuntu-latest, target: x86_64-unknown-linux-gnu, manylinux: '2014' }
          # Linux aarch64 — same manylinux base, cross via QEMU
          - { os: linux, runs-on: ubuntu-latest, target: aarch64-unknown-linux-gnu, manylinux: '2014' }
          # macOS Intel — cross-built from the Apple Silicon runner.
          # GitHub's macos-13 Intel pool is heavily oversubscribed; jobs
          # routinely sit queued past the queue timeout. macos-14's Xcode
          # SDK ships both arm64 and x86_64 sysroots so this is a
          # first-class native cross via `rustup target add`.
          - { os: macos, runs-on: macos-14, target: x86_64-apple-darwin, manylinux: '' }
          # macOS Apple Silicon
          - { os: macos, runs-on: macos-14, target: aarch64-apple-darwin, manylinux: '' }
          # Windows
          - { os: windows, runs-on: windows-latest, target: x86_64-pc-windows-msvc, manylinux: '' }

    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-python@v5
        with:
          python-version: '3.12'

      - name: Set up QEMU (for aarch64 cross)
        if: matrix.platform.target == 'aarch64-unknown-linux-gnu'
        uses: docker/setup-qemu-action@v3
        with:
          platforms: arm64

      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.platform.target }}

      - uses: Swatinem/rust-cache@v2
        with:
          key: py-${{ matrix.platform.target }}
          # Restrict cache to the binding's manifest path so other
          # workspace changes don't invalidate this job's cache too
          # aggressively.
          workspaces: |
            bindings/soth-py

      - name: Build wheel
        uses: PyO3/maturin-action@v1
        with:
          target: ${{ matrix.platform.target }}
          args: --release --out dist
          # When manylinux is set, maturin runs inside the manylinux
          # docker image so wheels are universally compatible.
          manylinux: ${{ matrix.platform.manylinux }}
          # For aarch64 we override maturin-action's default of the
          # Debian-based `ghcr.io/rust-cross/manylinux2014-cross:aarch64`
          # image. That image's cross-gcc fails to predefine __ARM_ARCH,
          # which breaks ring 0.17.x's bundled ARM assembly. Pin the
          # native manylinux2014_aarch64 image instead and let the QEMU
          # binfmt setup (above) emulate it on the x86_64 host. Slower,
          # but uses a native aarch64 toolchain so ring builds cleanly.
          container: ${{ matrix.platform.target == 'aarch64-unknown-linux-gnu' && 'quay.io/pypa/manylinux2014_aarch64' || '' }}
          working-directory: bindings/soth-py
          # `extension-module` is required for the actual abi3 wheel
          # (workspace `cargo build` builds without it; only the wheel
          # path enables Python-runtime-supplied symbols).
          rust-toolchain: stable
          docker-options: ${{ matrix.platform.os == 'linux' && '-e PYO3_CROSS_LIB_DIR=/opt/python/cp310-cp310/lib' || '' }}
          before-script-linux: |
            # Both the native manylinux2014 image (x86_64) and the
            # native manylinux2014_aarch64 image are CentOS-based and
            # use yum. Keep an apt-get fallback in case maturin-action
            # ever defaults to the Debian-based cross image again.
            set -e
            if command -v yum >/dev/null 2>&1; then
              yum install -y openssl-devel pkgconfig
            elif command -v apt-get >/dev/null 2>&1; then
              apt-get update
              apt-get install -y libssl-dev pkg-config
            else
              echo "no supported package manager (yum or apt-get) found" >&2
              exit 1
            fi

      - name: Inspect wheel
        if: matrix.platform.os != 'windows'
        run: ls -la bindings/soth-py/dist/

      - name: Inspect wheel (windows)
        if: matrix.platform.os == 'windows'
        run: dir bindings\soth-py\dist\

      - name: Smoke test wheel (native arches only)
        # x86_64-apple-darwin is now cross-built from an arm64 macos-14
        # host, which can't `import` an x86_64 extension module. Skip
        # the smoke step there; the load-bearing test is the eventual
        # PyPI consumer install on a real Intel Mac.
        if: matrix.platform.target == 'x86_64-unknown-linux-gnu' || matrix.platform.target == 'aarch64-apple-darwin' || matrix.platform.target == 'x86_64-pc-windows-msvc'
        shell: bash
        run: |
          python -m pip install --upgrade pip
          python -m pip install --find-links bindings/soth-py/dist soth
          python -c "import soth; print('soth', soth.__version__)"

      - uses: actions/upload-artifact@v4
        with:
          name: soth-py-${{ matrix.platform.target }}
          path: bindings/soth-py/dist/*.whl
          if-no-files-found: error
          retention-days: 14

  sdist:
    # Source distribution — built once on Linux. Required so customers
    # on unsupported platforms can build from source as a fallback.
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: '3.12'
      - uses: dtolnay/rust-toolchain@stable
      - name: Build sdist
        uses: PyO3/maturin-action@v1
        with:
          command: sdist
          args: --out dist
          working-directory: bindings/soth-py
      - uses: actions/upload-artifact@v4
        with:
          name: soth-py-sdist
          path: bindings/soth-py/dist/*.tar.gz
          if-no-files-found: error
          retention-days: 14