python-wheels.yml

name: Python Wheels

on:
  push:
    tags:
      - "v*"

permissions:
  contents: read

jobs:
  version:
    name: Resolve Version
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    outputs:
      version: ${{ steps.version.outputs.version }}
      is_release: ${{ steps.version.outputs.is_release }}
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Resolve package version
        id: version
        shell: bash
        run: |
          set -euo pipefail
          CARGO_VERSION=$(cargo metadata --no-deps --format-version 1 \
            | jq -r '.packages[] | select(.name == "servofetch-py") | .version')
          echo "version=$CARGO_VERSION" >> "$GITHUB_OUTPUT"

          if [[ "${GITHUB_REF}" == refs/tags/v* ]]; then
            TAG_VERSION="${GITHUB_REF_NAME#v}"
            if [[ "$TAG_VERSION" != "$CARGO_VERSION" ]]; then
              echo "::error::Tag $GITHUB_REF_NAME does not match servofetch-py version $CARGO_VERSION"
              exit 1
            fi
            echo "is_release=true" >> "$GITHUB_OUTPUT"
          else
            echo "is_release=false" >> "$GITHUB_OUTPUT"
          fi

  build-wheels:
    name: Build ${{ matrix.python-version }}
    needs: [version]
    runs-on: ubuntu-24.04
    timeout-minutes: 120
    permissions:
      contents: read
      id-token: write
    strategy:
      fail-fast: false
      matrix:
        python-version: ["3.14"]
        # python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]
    env:
      RUST_BACKTRACE: 1
      CARGO_INCREMENTAL: 0
      SCCACHE_GHA_ENABLED: "true"
      RUSTC_WRAPPER: sccache
      CCACHE: sccache
      TARGET: x86_64-unknown-linux-gnu
      VERSION: ${{ needs.version.outputs.version }}
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
        with:
          toolchain: "1.95.0"
          targets: x86_64-unknown-linux-gnu

      - uses: actions/setup-python@v6
        with:
          python-version: ${{ matrix.python-version }}

      # zizmor: ignore[cache-poisoning] -- no untrusted cache restore; sccache stores compiler artifacts only.
      - uses: mozilla-actions/sccache-action@9e7fa8a12102821edf02ca5dbea1acd0f89a2696 # v0.0.10

      - name: Install system dependencies (Linux)
        if: runner.os == 'Linux'
        run: |
          sudo apt-get update
          sudo apt-get install -y cmake clang llvm pkg-config libfontconfig-dev libfreetype-dev \
            libssl-dev libglib2.0-dev libegl1-mesa-dev \
            xvfb libegl1 libgles2 libgl1-mesa-dri mesa-utils \
            libfontconfig1 libfreetype6 libharfbuzz0b libx11-6 libxcb1 libxcb-render0 libxcb-shape0 libxcb-xfixes0

      - name: Install maturin
        shell: bash
        run: |
          python -m pip install --upgrade pip
          python -m pip install "maturin>=1.13,<2"

      - name: Build wheel
        shell: bash
        run: |
          python -m maturin build --release --locked --target "$TARGET" \
            --interpreter python --out dist --compatibility linux

      - name: Upload wheel artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: wheels-linux-x86_64-py${{ matrix.python-version }}
          path: dist/*.whl
          if-no-files-found: error
          retention-days: 7

  publish-release:
    name: Publish Release
    if: needs.version.outputs.is_release == 'true'
    needs: [version, build-wheels]
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    permissions:
      contents: write
    env:
      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      REPO: ${{ github.repository }}
      TAG: ${{ github.ref_name }}
    steps:
      - name: Download wheel artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          pattern: wheels-*
          path: artifacts

      - name: Upload wheels to release
        shell: bash
        run: |
          set -euo pipefail
          find artifacts -name '*.whl' -print0 |
            while IFS= read -r -d '' wheel; do
              gh release upload "$TAG" "$wheel" --repo "$REPO"
            done

      - name: Mark release as non-draft
        run: gh release edit "$TAG" --repo "$REPO" --draft=false