gn-dist/.github/workflows/build.yaml at d790875fd4eaf79011cffaf833a3c0b19551d68e · pypdfium2-team/gn-dist · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
# SPDX-FileCopyrightText: 2026 geisserml <geisserml@gmail.com>
# SPDX-License-Identifier: BSD-3-Clause

name: Build
on:
  workflow_dispatch:
    inputs:
      cibw_py_ver:
        type: string
        default: 'cp314'
      publish:
        type: boolean
        default: false

jobs:

  build:
    strategy:
      fail-fast: false
      matrix:
        cibw_os: ["manylinux", "musllinux"]
        cibw_arch: ["x86_64", "i686", "aarch64", "armv7l", "ppc64le", "s390x", "riscv64", "loongarch64"]

    uses: ./.github/workflows/build_one.yaml
    with:
      os: ${{ (matrix.cibw_arch == 'aarch64' || matrix.cibw_arch == 'armv7l') && 'ubuntu-24.04-arm' || 'ubuntu-latest' }}
      cibw_os: ${{ matrix.cibw_os }}
      cibw_arch: ${{ matrix.cibw_arch }}
      cibw_py_ver: ${{ inputs.cibw_py_ver }}


  sdist:
    runs-on: ubuntu-latest
    steps:

      - name: Check out the repo
        uses: actions/checkout@v6
        with:
          persist-credentials: false

      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: '3.14'
          pip-install: build setuptools

      - name: Package sdist
        run: python3 -m build -sxn

      - name: Upload sdist
        uses: actions/upload-artifact@v7
        with:
          path: ./dist/*.tar.gz
          name: sdist


  publish:
    needs: [build, sdist]
    if: ${{ inputs.publish && !cancelled() && !contains(needs.*.result, 'failure') }}
    runs-on: ubuntu-latest

    environment: release  # PyPI upload via "trusted publishing"
    permissions:
      id-token: write      # PyPI upload via "trusted publishing", and GH attestation
      attestations: write  # GH attestation
      contents: write      # tag push

    steps:

      - name: Check out repository
        uses: actions/checkout@v6
        with:
          persist-credentials: true  # needed for push

      - name: Determine version
        id: get_version
        run: |
          VERSION=$(python3 ./utils/get_version.py)
          echo "Determined version $VERSION"
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"

      - name: Download sdist
        uses: actions/download-artifact@v8
        with:
          path: dist/
          name: sdist

      - name: Download wheels
        uses: actions/download-artifact@v8
        with:
          path: dist/
          merge-multiple: true
          pattern: cibw-*

      - name: Isolate non-PyPI builds
        run: |
          mkdir gh_only
          mv dist/*linux_*_loongarch64*.whl gh_only/

      - name: Apply and push repository changes
        run: |
          git config user.email "geisserml@gmail.com"
          git config user.name "geisserml"
          git tag -a "$NEW_VERSION" -m "Autorelease"
          git push --tags
        env:
          NEW_VERSION: ${{ steps.get_version.outputs.version }}

      - name: Publish to TestPyPI
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          repository-url: https://test.pypi.org/legacy/
          packages-dir: dist/
          attestations: false
          verbose: true

      - name: Attest build provenance
        id: provenance
        uses: actions/attest-build-provenance@v4
        with:
          subject-path: 'dist/*, gh_only/*'

      - name: Rename provenance file
        run: mv "$SRC_PATH" gn-attestation.json
        env:
          SRC_PATH: ${{ steps.provenance.outputs.bundle-path }}

      - name: Publish to GitHub
        uses: ncipollo/release-action@v1
        with:
          immutableCreate: true
          artifacts: 'dist/*.whl,gh_only/*.whl,dist/*.tar.gz,gn-attestation.json'
          token: ${{ secrets.GITHUB_TOKEN }}
          tag: ${{ steps.get_version.outputs.version }}
          prerelease: ${{ contains(steps.get_version.outputs.version, 'b') }}

      - name: Publish to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          packages-dir: dist/