release-python.yml

name: Release Python

on:
  push:
    tags:
      - "v*"
  workflow_dispatch: # manual trigger for testing wheel builds (won't publish without a v* tag)

permissions:
  contents: read
  id-token: write

jobs:
  validate-version:
    name: Validate tag matches Cargo.toml
    runs-on: ubuntu-latest
    if: startsWith(github.ref, 'refs/tags/v')
    steps:
      - uses: actions/checkout@v6
      - name: Check version consistency
        run: |
          TAG_VERSION="${GITHUB_REF#refs/tags/v}"
          CARGO_VERSION=$(python3 -c "import tomllib; print(tomllib.load(open('Cargo.toml','rb'))['workspace']['package']['version'])")
          if [ "$TAG_VERSION" != "$CARGO_VERSION" ]; then
            echo "::error::Tag version (v${TAG_VERSION}) does not match Cargo.toml version (${CARGO_VERSION})"
            exit 1
          fi
          echo "Version check passed: v${CARGO_VERSION}"

  build-webapp:
    name: Build web app
    runs-on: ubuntu-latest
    needs: [validate-version]
    if: always() && (needs.validate-version.result == 'success' || needs.validate-version.result == 'skipped')
    steps:
      - uses: actions/checkout@v6
      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: wasm32-unknown-unknown
      - name: Install wasm-pack
        run: curl https://rustwasm.github.io/wasm-pack/installer/init.sh -sSf | sh
      - uses: oven-sh/setup-bun@v2
      - name: Install app dependencies
        run: bun install
        working-directory: app
      - name: Build WASM module
        run: bun run build:wasm
        working-directory: app
      - name: Build app
        run: bun run build
        working-directory: app
      - name: Bundle webapp into Python package
        run: cp -r app/dist python/rosette/_webapp
      - uses: actions/upload-artifact@v4
        with:
          name: webapp-bundle
          path: python/rosette/_webapp/

  build-linux:
    name: Build Linux (${{ matrix.target }})
    runs-on: ${{ matrix.runner }}
    needs: [validate-version, build-webapp]
    if: always() && (needs.validate-version.result == 'success' || needs.validate-version.result == 'skipped') && needs.build-webapp.result == 'success'
    strategy:
      matrix:
        include:
          - target: x86_64-unknown-linux-gnu
            runner: ubuntu-latest
          - target: aarch64-unknown-linux-gnu
            runner: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: actions/download-artifact@v4
        with:
          name: webapp-bundle
          path: python/rosette/_webapp/
      - uses: docker/setup-qemu-action@v3
        if: matrix.target == 'aarch64-unknown-linux-gnu'
        with:
          platforms: arm64
      - uses: PyO3/maturin-action@v1
        with:
          target: ${{ matrix.target }}
          args: --release --out dist --interpreter 3.11 3.12 3.13
          manylinux: auto
      - uses: actions/upload-artifact@v4
        with:
          name: wheels-linux-${{ matrix.target }}
          path: dist

  build-macos:
    name: Build macOS (aarch64)
    runs-on: macos-14
    needs: [validate-version, build-webapp]
    if: always() && (needs.validate-version.result == 'success' || needs.validate-version.result == 'skipped') && needs.build-webapp.result == 'success'
    steps:
      - uses: actions/checkout@v6
      - uses: actions/download-artifact@v4
        with:
          name: webapp-bundle
          path: python/rosette/_webapp/
      - uses: PyO3/maturin-action@v1
        with:
          target: aarch64-apple-darwin
          args: --release --out dist --interpreter 3.11 3.12 3.13
      - uses: actions/upload-artifact@v4
        with:
          name: wheels-macos-aarch64
          path: dist

  build-windows:
    name: Build Windows (x86_64)
    runs-on: windows-latest
    needs: [validate-version, build-webapp]
    if: always() && (needs.validate-version.result == 'success' || needs.validate-version.result == 'skipped') && needs.build-webapp.result == 'success'
    steps:
      - uses: actions/checkout@v6
      - uses: actions/download-artifact@v4
        with:
          name: webapp-bundle
          path: python/rosette/_webapp/
      - uses: PyO3/maturin-action@v1
        with:
          target: x86_64-pc-windows-msvc
          args: --release --out dist --interpreter 3.11 3.12 3.13
      - uses: actions/upload-artifact@v4
        with:
          name: wheels-windows-x86_64
          path: dist

  publish:
    name: Publish to PyPI
    runs-on: ubuntu-latest
    if: startsWith(github.ref, 'refs/tags/v')
    needs:
      - build-linux
      - build-macos
      - build-windows
    # Trusted publishing: configure at https://pypi.org/manage/project/librosette/settings/publishing/
    environment: pypi
    permissions:
      id-token: write
    steps:
      - uses: actions/download-artifact@v4
        with:
          pattern: wheels-*
          merge-multiple: true
          path: dist
      - name: List wheels
        run: ls -lh dist/
      - uses: pypa/gh-action-pypi-publish@release/v1

  github-release:
    name: Create GitHub Release
    runs-on: ubuntu-latest
    if: startsWith(github.ref, 'refs/tags/v')
    needs: [publish]
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v6
      - name: Extract changelog for this version
        id: changelog
        run: |
          VERSION="${GITHUB_REF#refs/tags/v}"
          # Extract the section for this version from CHANGELOG.md
          # Matches from "## [X.Y.Z]" to the next "## [" or end of file
          # Uses string match (index) instead of regex to avoid metacharacter issues
          NOTES=$(awk -v ver="$VERSION" '
            $0 ~ "^## \\[" ver "\\]" { found=1; next }
            /^## \[/ { if (found) exit }
            found { print }
          ' CHANGELOG.md)
          if [ -z "$NOTES" ]; then
            NOTES="Release v${VERSION}"
          fi
          # Write to file to preserve newlines (printf is safer than echo)
          printf '%s\n' "$NOTES" > release-notes.md
      - name: Create release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          TAG="${GITHUB_REF#refs/tags/}"
          gh release create "$TAG" \
            --title "$TAG" \
            --notes-file release-notes.md \
            --latest