build.yaml

name: Build Status

on:
  push:
    branches:
      - main
    tags:
      - v*
    paths-ignore:
      - LICENSE
      - README.md
  pull_request:
    branches:
      - main
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  build:
    name: build (${{ matrix.name }})
    runs-on: ${{ matrix.os }}
    permissions:
      contents: read
      checks: write
      pull-requests: write

    strategy:
      matrix:
        include:
          - name: ubuntu-latest
            dist_path: dist
            os: ubuntu-latest
            python: "3.11"
            target: native
          - name: ubuntu-24.04-arm
            dist_path: dist
            os: ubuntu-24.04-arm
            python: "3.11"
            target: native
          - name: macos-latest
            dist_path: dist
            os: macos-latest
            python: "3.11"
            target: native
          - name: windows-latest
            dist_path: dist
            os: windows-latest
            python: "3.11"
            target: native
          

    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          persist-credentials: false

      - name: Setup Python
        uses: actions-ext/python/setup@ec67f82b3bd863948308a41ecb9e70547cbb19c7
        with:
          version: ${{ matrix.python }}

      - name: Setup Rust
        uses: actions-ext/rust/setup@0f0b7c9ab3cdb6e9a1f79e2147974d6762ddafea

      # `make develop` compiles these from source otherwise, ~10 minutes a run.
      # These are the prebuilt binaries; the Makefile skips its own install when
      # they are already on PATH.
      - name: Install cargo tools
        uses: taiki-e/install-action@b6ff580856c41316412a0b9b60540fbc6f8c82cc  # v2.86.7
        with:
          tool: cargo-nextest,cargo-llvm-cov

      - name: Install dependencies
        run: make develop
        if: matrix.target == 'native'

      - name: Lint
        run: make lint
        if: matrix.target == 'native'

      - name: Checks
        run: make checks
        if: matrix.name == 'ubuntu-latest'

      # On Linux `make dist-rs` rebuilds this same release profile, and
      # cibuildwheel then rebuilds the tree again from scratch in the manylinux
      # container, so building here is a third compile and a third copy on disk.
      - name: Build
        run: make build
        if: matrix.target == 'native' && runner.os != 'Linux'

      # Coverage instrumentation forces a rebuild that shares nothing with the
      # cached ordinary build, so only the platform that uploads it pays for it.
      - name: Test
        run: make coverage
        if: matrix.name == 'ubuntu-latest'

      - name: Test
        run: make test
        if: matrix.target == 'native' && matrix.name != 'ubuntu-latest'

      - name: Build and test Pyodide wheel
        run: make test-pyodide
        if: matrix.target == 'pyodide'

      - name: Upload test results (Python)
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
        with:
          name: test-results-${{ matrix.name }}
          path: '**/junit.xml'
        if: always() && matrix.target == 'native'

      - name: Publish test results
        uses: EnricoMi/publish-unit-test-result-action@d0a4676d0e0b938bc201470d88276b7c74c712b3  # v2.24.0
        with:
          files: '**/junit.xml'
        if: matrix.name == 'ubuntu-latest'

      - name: Upload coverage
        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f  # v7.0.0
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
        if: matrix.name == 'ubuntu-latest'

      - name: Free disk space
        run: |
          sudo rm -rf /usr/local/lib/android /usr/share/dotnet /opt/ghc /usr/local/.ghcup /usr/share/swift
          df -h /
        shell: bash
        if: matrix.target == 'native' && runner.os == 'Linux'

      # The wheel is compiled inside the manylinux container, which cannot see
      # the Swatinem/rust-cache the host steps use. pyproject points the
      # container's CARGO_HOME and CARGO_TARGET_DIR under /host, so this caches
      # both — the registry as well as the build artifacts, which is what
      # rust-cache does for the host and what makes the reuse actually land.
      # Keyed on the lockfiles; a toolchain bump still forces a rebuild, which
      # cargo handles by itself.
      - name: Cache cibuildwheel Rust build
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v6.1.0
        with:
          path: |
            /tmp/cibw-cargo-home
            /tmp/cibw-cargo-target
          key: cibw-cargo-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('Cargo.lock', 'rust/Cargo.lock') }}
          restore-keys: |
            cibw-cargo-${{ runner.os }}-${{ runner.arch }}-
        if: matrix.target == 'native' && runner.os == 'Linux'

      - name: Build distributions (Linux x86_64)
        run: |
          rm -rf dist
          make dist-rs
          make dist-py-sdist
          make dist-py-wheel
          make dist-check
          # The container writes these as root; hand them back so the cache save
          # can read them.
          sudo chown -R "$(id -u):$(id -g)" /tmp/cibw-cargo-home /tmp/cibw-cargo-target
          du -sh /tmp/cibw-cargo-home /tmp/cibw-cargo-target
        shell: bash
        env:
          CIBW_ARCHS_LINUX: native
        if: matrix.name == 'ubuntu-latest'

      - name: Build distributions (Linux ARM64)
        run: |
          rm -rf dist
          make dist-py-wheel
          make dist-check
          # The container writes these as root; hand them back so the cache save
          # can read them.
          sudo chown -R "$(id -u):$(id -g)" /tmp/cibw-cargo-home /tmp/cibw-cargo-target
          du -sh /tmp/cibw-cargo-home /tmp/cibw-cargo-target
        shell: bash
        env:
          CIBW_ARCHS_LINUX: native
        if: matrix.name == 'ubuntu-24.04-arm'

      - name: Build distributions (macOS/Windows)
        run: |
          rm -rf dist
          make dist-py-wheel
          make dist-check
        shell: bash
        env:
          CIBW_ENVIRONMENT_MACOS: MACOSX_DEPLOYMENT_TARGET=11.0
        if: matrix.target == 'native' && runner.os != 'Linux'

      - name: Test wheel
        uses: actions-ext/python/test-wheel@ec67f82b3bd863948308a41ecb9e70547cbb19c7
        with:
          module: nepenthe
        if: matrix.target == 'native' && runner.os == 'Linux'

      - name: Test source distribution
        uses: actions-ext/python/test-sdist@ec67f82b3bd863948308a41ecb9e70547cbb19c7
        with:
          module: nepenthe
        if: matrix.name == 'ubuntu-latest'

      - name: Upload distributions
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
        with:
          name: dist-${{ matrix.name }}
          path: ${{ matrix.dist_path }}