kingfisher/.github/workflows/pypi.yml

name: pypi-wheels

on:
  workflow_call:
    inputs:
      tag:
        description: "Release tag to package (e.g., v1.2.3)"
        required: true
        type: string
  workflow_dispatch:
    inputs:
      tag:
        description: "Release tag to package (e.g., v1.2.3). Leave blank to use the latest release."
        required: false
        type: string

permissions: {}

jobs:
  build-wheels:
    name: Build PyPI wheels
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
    steps:
      - name: Determine version/tag
        id: version
        shell: bash
        env:
          INPUT_TAG: ${{ inputs.tag || github.event.inputs.tag || '' }}
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail
          if [[ -z "${INPUT_TAG}" ]]; then
            set +e
            TAG="$(gh release view --repo "${GITHUB_REPOSITORY}" --json tagName -q .tagName)"
            gh_status=$?
            set -e
            if [[ ${gh_status} -ne 0 || -z "${TAG}" ]]; then
              echo "No tag provided and failed to determine latest release tag (gh release view exit status: ${gh_status})" >&2
              exit 1
            fi
          else
            TAG="${INPUT_TAG}"
          fi
          if [[ ! "${TAG}" =~ ^v[0-9A-Za-z._+-]+$ ]]; then
            echo "Invalid tag format: ${TAG}" >&2
            exit 1
          fi
          VERSION="${TAG#v}"
          echo "tag=${TAG}" >> "$GITHUB_OUTPUT"
          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"

      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
        with:
          ref: ${{ steps.version.outputs.tag }}

      - name: Download release assets
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          mkdir -p release-assets
          gh release download "${{ steps.version.outputs.tag }}" \
            -p "kingfisher-*.tgz" \
            -p "kingfisher-*.zip" \
            -D release-assets

      - name: Extract binaries
        shell: bash
        run: |
          set -euo pipefail
          mkdir -p extracted
          for archive in release-assets/*; do
            name=$(basename "$archive")
            dir="extracted/${name%.*}"
            mkdir -p "$dir"
            case "$archive" in
              *.tgz)
                tar -xzf "$archive" -C "$dir"
                ;;
              *.zip)
                unzip -q "$archive" -d "$dir"
                ;;
              *)
                echo "Unknown archive: $archive" >&2
                exit 1
                ;;
            esac
          done

          mkdir -p extracted/bin
          for bin in $(find extracted -type f \( -name "kingfisher" -o -name "kingfisher.exe" \)); do
            chmod +x "$bin" || true
          done

      - name: Install build tooling
        run: "python -m pip install --upgrade --only-binary :all: --require-hashes -r .github/requirements/pypi-build.txt"

      - name: Build wheels
        shell: bash
        run: |
          set -euo pipefail
          version="${{ steps.version.outputs.version }}"

          linux_x64=$(find extracted -type f -name "kingfisher" | grep -m1 "linux-x64")
          linux_arm64=$(find extracted -type f -name "kingfisher" | grep -m1 "linux-arm64")
          mac_x64=$(find extracted -type f -name "kingfisher" | grep -m1 "darwin-x64")
          mac_arm64=$(find extracted -type f -name "kingfisher" | grep -m1 "darwin-arm64")
          win_x64=$(find extracted -type f -name "kingfisher.exe" | grep -m1 "windows-x64")
          win_arm64=$(find extracted -type f -name "kingfisher.exe" | grep -m1 "windows-arm64")

          scripts/build-pypi-wheel.sh \
            --binary "$linux_x64" \
            --version "$version" \
            --plat-name manylinux_2_17_x86_64.musllinux_1_2_x86_64

          scripts/build-pypi-wheel.sh \
            --binary "$linux_arm64" \
            --version "$version" \
            --plat-name manylinux_2_17_aarch64.musllinux_1_2_aarch64

          scripts/build-pypi-wheel.sh \
            --binary "$mac_x64" \
            --version "$version" \
            --plat-name macosx_10_9_x86_64

          scripts/build-pypi-wheel.sh \
            --binary "$mac_arm64" \
            --version "$version" \
            --plat-name macosx_11_0_arm64

          scripts/build-pypi-wheel.sh \
            --binary "$win_x64" \
            --version "$version" \
            --plat-name win_amd64

          scripts/build-pypi-wheel.sh \
            --binary "$win_arm64" \
            --version "$version" \
            --plat-name win_arm64

      - name: Verify all wheels are platform-specific
        shell: bash
        run: |
          set -euo pipefail
          if ls dist-pypi/*-py3-none-any.whl >/dev/null 2>&1; then
            echo "::error::Refusing to publish: pure-Python wheel found in dist-pypi/." >&2
            ls -la dist-pypi/ >&2
            exit 1
          fi
          echo "Wheels to publish:"
          ls -la dist-pypi/

      - name: Publish to PyPI (Trusted Publishing)
        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # release/v1
        with:
          packages-dir: dist-pypi
          verbose: true
          attestations: false