build.yaml

name: Build Status

on:
  push:
    branches:
      - main
    tags:
      - v*
    paths-ignore:
      - LICENSE
      - README.md
  pull_request:
    branches:
      - main
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  build:
    runs-on: ${{ matrix.os }}
    permissions:
      contents: read
      checks: write
      pull-requests: write

    strategy:
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]

    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          persist-credentials: false

      - name: Setup Python
        uses: actions-ext/python/setup@6e1b91a408ea89f49bc8aff8724f83826f7b5446
        with:
          version: "3.11"

      - name: Setup Rust
        uses: actions-ext/rust/setup@2db8e3e4c56beb7320c7d730bd2c2d6a6447bf6b

      # `make develop` compiles these from source otherwise, ~10 minutes a run.
      # These are the prebuilt binaries; the Makefile skips its own install when
      # they are already on PATH.
      - name: Install cargo tools
        uses: taiki-e/install-action@cb33e69fad06166ca28a42b2575e4dadabf62ee8  # v2.85.8
        with:
          tool: cargo-nextest,cargo-llvm-cov

      - name: Install dependencies
        run: make develop

      - name: Lint
        run: make lint

      - name: Checks
        run: make checks
        if: matrix.os == 'ubuntu-latest'

      # On Linux `make dist-rs` rebuilds this same release profile, and
      # cibuildwheel then rebuilds the tree again from scratch in the manylinux
      # container, so building here is a third compile and a third copy on disk.
      - name: Build
        run: make build
        if: matrix.os != 'ubuntu-latest'

      - name: Test
        run: make coverage

      - name: Upload test results (Python)
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
        with:
          name: test-results-${{ matrix.os }}
          path: '**/junit.xml'
        if: always()

      - name: Publish test results
        uses: EnricoMi/publish-unit-test-result-action@d0a4676d0e0b938bc201470d88276b7c74c712b3  # v2.24.0
        with:
          files: '**/junit.xml'
        if: matrix.os == 'ubuntu-latest'

      - name: Upload coverage
        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f  # v7.0.0
        with:
          token: ${{ secrets.CODECOV_TOKEN }}

      - name: Set up QEMU
        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8  # v4.2.0
        with:
          platforms: all
        if: runner.os == 'Linux' && runner.arch == 'X64'

      - name: Free disk space
        run: |
          sudo rm -rf /usr/local/lib/android /usr/share/dotnet /opt/ghc /usr/local/.ghcup /usr/share/swift
          df -h /
        shell: bash
        if: matrix.os == 'ubuntu-latest'

      # The wheel is compiled inside the manylinux container, which cannot see
      # the Swatinem/rust-cache the host steps use. pyproject points the
      # container's CARGO_HOME and CARGO_TARGET_DIR under /host, so this caches
      # both — the registry as well as the build artifacts, which is what
      # rust-cache does for the host and what makes the reuse actually land.
      # Keyed on the lockfiles; a toolchain bump still forces a rebuild, which
      # cargo handles by itself.
      - name: Cache cibuildwheel Rust build
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v6.1.0
        with:
          path: |
            /tmp/cibw-cargo-home
            /tmp/cibw-cargo-target
          key: cibw-cargo-${{ runner.os }}-${{ hashFiles('Cargo.lock', 'rust/Cargo.lock') }}
          restore-keys: |
            cibw-cargo-${{ runner.os }}-
        if: matrix.os == 'ubuntu-latest'

      - name: Build distributions (Linux)
        run: |
          rm -rf dist
          make dist-rs
          make dist-py-sdist
          rm -rf rust/target
          make dist-py-wheel
          make dist-check
          # The container writes these as root; hand them back so the cache save
          # can read them.
          sudo chown -R "$(id -u):$(id -g)" /tmp/cibw-cargo-home /tmp/cibw-cargo-target
          du -sh /tmp/cibw-cargo-home /tmp/cibw-cargo-target
        shell: bash
        if: matrix.os == 'ubuntu-latest'

      - name: Build distributions (macOS/Windows)
        run: |
          rm -rf dist
          make dist-py-wheel
          make dist-check
        shell: bash
        env:
          CIBW_ENVIRONMENT_MACOS: MACOSX_DEPLOYMENT_TARGET=11.0
        if: matrix.os != 'ubuntu-latest'

      - name: Test wheel
        uses: actions-ext/python/test-wheel@6e1b91a408ea89f49bc8aff8724f83826f7b5446
        with:
          module: nepenthe
        if: matrix.os == 'ubuntu-latest'

      - name: Test source distribution
        uses: actions-ext/python/test-sdist@6e1b91a408ea89f49bc8aff8724f83826f7b5446
        with:
          module: nepenthe
        if: matrix.os == 'ubuntu-latest'

      - name: Upload distributions
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
        with:
          name: dist-${{ matrix.os }}
          path: dist