build.yml

name: build

on:
  push:
    tags:
      - v*
    branches:
      - master
  pull_request:
    branches:
      - master

concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}
  cancel-in-progress: true

env:
  STABLE_PYTHON_VERSION: "3.12"
  HATCH_VERBOSE: 1
  CIBW_BUILD_FRONTEND: build

jobs:
  build-sdit:
    name: Build source distribution

    if: github.event_name == 'push' || ! github.event.pull_request.draft
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
        with:
          # Fetch all tags
          fetch-depth: 0

      - name: Set up Python
        uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c # v5
        with:
          python-version: ${{ env.STABLE_PYTHON_VERSION }}

      - name: Install hatch
        run: pip install --upgrade hatch

      - name: Create source distribution
        run: |
          hatch build --target sdist

      - name: Upload sdist
        uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3
        with:
          name: wheels
          path: ./dist/*.tar.*
          if-no-files-found: error

  build-x86_64:
    name: Build wheels on ${{ matrix.os }} (x86, 64-bit)

    if: github.event_name == 'push' || ! github.event.pull_request.draft
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            archs: x86_64
          - os: macos-latest
            archs: x86_64
          - os: windows-latest
            archs: AMD64

    steps:
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
        with:
          # Fetch all tags
          fetch-depth: 0

      - name: Create wheels
        uses: pypa/cibuildwheel@fff9ec32ed25a9c576750c91e06b410ed0c15db7 # v2.16.2
        env:
          CIBW_ARCHS: ${{ matrix.archs }}

      - name: Upload wheels
        uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3
        with:
          name: wheels
          path: ./wheelhouse/*.whl
          if-no-files-found: error

  build-arm64:
    name: Build wheels on ${{ matrix.os }} (arm64)

    # As this requires emulation, it's not worth running on PRs
    if: >-
      github.event_name == 'push' &&
      startsWith(github.event.ref, 'refs/tags')
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            archs: aarch64
          - os: macos-latest
            archs: arm64

    steps:
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
        with:
          # Fetch all tags
          fetch-depth: 0

      - name: Set up QEMU
        if: matrix.os == 'ubuntu-latest'
        uses: docker/setup-qemu-action@68827325e0b33c7199eb31dd4e31fbe9023e06e3 # v3
        with:
          platforms: arm64

      - name: Create wheels
        uses: pypa/cibuildwheel@fff9ec32ed25a9c576750c91e06b410ed0c15db7 # v2.16.2
        env:
          CIBW_ARCHS: ${{ matrix.archs }}

      - name: Upload wheels
        uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3
        with:
          name: wheels
          path: ./wheelhouse/*.whl
          if-no-files-found: error

  check:
    name: Check wheels

    runs-on: ubuntu-latest

    needs:
      - build-x86_64
      - build-arm64

    steps:
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
      - name: Setup Python
        uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c # v5
        with:
          python-version: ${{ env.STABLE_PYTHON_VERSION }}

      - uses: actions/download-artifact@7a1cd3216ca9260cd8022db641d960b1db4d1be4 # v4
        with:
          name: wheels
          path: wheelhouse

      - run: |
          pipx run twine check --strict wheelhouse/*

  publish:
    name: Publish wheels

    if: github.event_name == 'push' && startsWith(github.event.ref, 'refs/tags/v')
    runs-on: ubuntu-latest
    environment: pypi

    needs: [check]

    permissions:
      # Required for trusted publishing
      id-token: write

    steps:
      - uses: actions/download-artifact@7a1cd3216ca9260cd8022db641d960b1db4d1be4 # v4
        with:
          name: wheels
          path: wheels

      - name: Push build artifacts to PyPI
        uses: pypa/gh-action-pypi-publish@2f6f737ca5f74c637829c0f5c3acd0e29ea5e8bf # v1.8.11
        with:
          skip-existing: true
          password: ${{ secrets.PYPI_TOKEN }}
          packages-dir: wheels