CI.yml

# This file is autogenerated by maturin v1.8.3
# To update, run:
#     maturin generate-ci github
#
# Customized for trusted publishing (OIDC-based)
name: CI

on:
  workflow_dispatch:

permissions:
  contents: read

jobs:
  # ----------------------------------------
  # Build wheels for Linux
  # ----------------------------------------
  linux:
    name: Build Linux Wheels
    runs-on: ${{ matrix.platform.runner }}
    strategy:
      matrix:
        platform:
          - runner: ubuntu-latest
            target: x86_64
          #- runner: ubuntu-22.04
          #  target: x86_64
        python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python-version }}
      - name: Build wheels
        uses: PyO3/maturin-action@v1
        with:
          args: --release --out dist --interpreter python
      - name: Validate wheels after building
        run: |
          for file in dist/*.whl; do
            echo "Checking $file"
            python -m zipfile -t "$file" || { echo "Invalid wheel: $file"; exit 1; }
          done
      - name: Print checksums
        run: sha256sum dist/*.whl
      - name: Upload wheels
        uses: actions/upload-artifact@v4
        with:
          name: wheels-linux-${{ matrix.platform.runner }}-${{ matrix.python-version }}
          path: dist

  # ----------------------------------------
  # Build wheels for Windows
  # ----------------------------------------
  windows:
    name: Build Windows Wheels
    runs-on: windows-latest
    strategy:
      matrix:
        python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python-version }}
      - name: Build wheels
        uses: PyO3/maturin-action@v1
        with:
          args: --release --out dist --interpreter python
      - name: Validate wheels after building
        shell: pwsh
        run: |
          Get-ChildItem -Path dist -Filter *.whl | ForEach-Object {
            Write-Host "Checking $($_.FullName)"
            python -m zipfile -t $_.FullName
            if ($LASTEXITCODE -ne 0) {
              Write-Error "Invalid wheel: $($_.FullName)"
              exit 1
            }
          }  
      - name: Print checksums
        shell: cmd
        run: |
          for %%f in (dist\*.whl) do (
            echo =====================================
            echo Checksum for %%f:
            CertUtil -hashfile %%f SHA256
          )
      - name: Upload wheels
        uses: actions/upload-artifact@v4
        with:
          name: wheels-windows-${{ matrix.python-version }}
          path: dist

  # ----------------------------------------
  # Build wheels for macOS
  # ----------------------------------------
  macos:
    name: Build macOS Wheels
    runs-on: macos-latest
    strategy:
      matrix:
        python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python-version }}
      - name: Build wheels
        uses: PyO3/maturin-action@v1
        with:
          args: --release --out dist --interpreter python
      - name: Validate wheels after building
        run: |
          for file in dist/*.whl; do
            echo "Checking $file"
            python -m zipfile -t "$file" || { echo "Invalid wheel: $file"; exit 1; }
          done
      - name: Print checksums
        run: shasum -a 256 dist/*.whl
      - name: Upload wheels
        uses: actions/upload-artifact@v4
        with:
          name: wheels-macos-${{ matrix.python-version }}
          path: dist

  # ----------------------------------------
  # Build source distribution (sdist)
  # ----------------------------------------
  sdist:
    name: Build Source Distribution
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Build sdist
        uses: PyO3/maturin-action@v1
        with:
          command: sdist
          args: --out dist
      - name: Upload sdist
        uses: actions/upload-artifact@v4
        with:
          name: sdist-artifact
          path: dist

  # ----------------------------------------
  # Release: Publish to PyPI with OIDC-based Trusted Publisher
  # ----------------------------------------
  release:
    name: Publish to PyPI
    runs-on: ubuntu-latest
    if: ${{ github.event_name == 'workflow_dispatch' }}
    needs: [linux, windows, macos, sdist]
    environment: pypi  # Trusted publishing environment
    permissions:
      id-token: write  # Required for OIDC-based publishing
      contents: write
      attestations: write
    steps:
      - uses: actions/download-artifact@v4
        with:
          path: dist
          #merge-multiple: false
          merge-multiple: true

      - name: List distributions before upload
        #run: ls -lh dist/**/*.whl
        run: ls -lh dist/*.whl

      - name: List and verify artifacts
        #run: |
        #  ls -lh dist/**/*.whl
        #  file dist/**/*.whl
        run: |
          ls -lh dist/*.whl
          file dist/*.whl

      - name: List and verify all artifacts
        run: |
          echo "Distributions in dist/"
          find dist -type f
          echo "Inspecting file types:"
          file dist/* 2>/dev/null || true
          
      - name: Validate wheels
        #run: |
        #  for file in dist/**/*.whl; do
        #    echo "Checking $file"
        #    python -m zipfile -t "$file" || { echo "Invalid wheel: $file"; exit 1; }
        #  done
        run: |
          for file in dist/*.whl; do
            echo "Checking $file"
            python -m zipfile -t "$file" || { echo "Invalid wheel: $file"; exit 1; }
          done

      - name: Publish to PyPI (trusted publisher)
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          packages-dir: dist