open-standards/.github/workflows/wai-quantum-py-release.yml

name: wai-quantum for Python, release wheels

# On a tag wai-quantum-cli-v<version> (the command line's release), builds the Python
# package's wheels (wai/wai-quantum-py) and attaches them to the same forge release,
# each with its SHA-256. One abi3 wheel per platform serves every Python from 3.9 on:
#   macOS      arm64 and x86_64 (the x86_64 one cross-built on the Apple-silicon runner);
#   Linux      x86_64 and arm64, manylinux2014 (glibc 2.17), linked with zig so the
#              runner's newer glibc does not leak into the wheel;
#   Windows    x86_64.
# Each wheel that runs on its runner is installed alone on Python 3.9 in a fresh venv
# and runs tests/smoke.py before it is attached. Nothing is published to a package
# index.
#
# Uploads go to the forge directly over the private network (FORGE_API), never through
# the public tunnel. A runner that is down leaves its platform's wheel missing: the
# release lists what each build attached.

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

on:
  push:
    tags: ['wai-quantum-cli-v*']

permissions:
  contents: write

env:
  CARGO_TERM_COLOR: always
  FORGE_API: http://100.64.224.0:3400/api/v1
  FORGE_REPO: Transaction-Science/open-standards
  MATURIN_VERSION: 1.15.0
  ZIG_VERSION: 0.16.0

jobs:
  version:
    name: the tag is the command line's version
    runs-on: linux
    outputs:
      version: ${{ steps.v.outputs.version }}
    steps:
      - uses: actions/checkout@v5
      - id: v
        shell: bash
        run: |
          set -euo pipefail
          v="${GITHUB_REF_NAME#wai-quantum-cli-v}"
          crate="$(sed -n 's/^version = "\(.*\)"$/\1/p' wai/wai-quantum-cli/Cargo.toml | head -1)"
          [ "$v" = "$crate" ] || { echo "::error::the tag says $v, wai-quantum-cli/Cargo.toml says $crate"; exit 1; }
          echo "the Python package: $(sed -n 's/^version = "\(.*\)"$/\1/p' wai/wai-quantum-py/Cargo.toml | head -1)"
          echo "version=$v" >> "$GITHUB_OUTPUT"

  macos:
    name: macOS · ${{ matrix.triple }}
    needs: version
    runs-on: macos
    timeout-minutes: 60
    strategy:
      fail-fast: false
      max-parallel: 1
      matrix:
        triple: [aarch64-apple-darwin, x86_64-apple-darwin]
    steps:
      - uses: actions/checkout@v5
      # launchd's PATH omits cargo and uv on the macOS host runner.
      - name: Put cargo and uv on PATH
        shell: bash
        run: |
          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
      - name: Build, check and hash
        shell: bash
        run: |
          set -euo pipefail
          command -v uv >/dev/null 2>&1 || curl -LsSf https://astral.sh/uv/install.sh | sh
          export PATH="$HOME/.local/bin:$PATH"
          t="${{ matrix.triple }}"
          rustup target add "$t"
          tools="$RUNNER_TEMP/tools"; dist="$RUNNER_TEMP/dist"; rm -rf "$tools" "$dist"
          uv venv -q --python 3.12 "$tools"
          uv pip install -q --python "$tools/bin/python" "maturin==$MATURIN_VERSION"
          (cd wai/wai-quantum-py && nice -n 10 "$tools/bin/maturin" build --release --locked --target "$t" -o "$dist")
          whl="$(ls "$dist"/wai_quantum-*.whl)"
          if [ "$t" = "$(rustc -vV | sed -n 's/^host: //p')" ]; then
            py="$RUNNER_TEMP/py39"; rm -rf "$py"
            uv venv -q --python 3.9 "$py"
            uv pip install -q --python "$py/bin/python" --no-deps "$whl"
            (cd "$RUNNER_TEMP" && "$py/bin/python" -I "$GITHUB_WORKSPACE/wai/wai-quantum-py/tests/smoke.py")
          fi
          (cd "$dist" && for f in *.whl; do shasum -a 256 "$f" > "$f.sha256"; done; ls -l)
      - name: Attach to the release
        shell: bash
        env:
          FORGE_TOKEN: ${{ github.token }}
        run: bash wai/wai-quantum-cli/release/publish.sh "$GITHUB_REF_NAME" "wai-quantum ${{ needs.version.outputs.version }}" "$RUNNER_TEMP"/dist/*

  linux:
    name: Linux · ${{ matrix.triple }}
    needs: version
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 60
    strategy:
      fail-fast: false
      matrix:
        include:
          - runner: linux
            triple: x86_64-unknown-linux-gnu
          - runner: linux-arm64
            triple: aarch64-unknown-linux-gnu
    steps:
      - uses: actions/checkout@v5
      - name: Install Rust 1.98.0 and uv
        shell: bash
        run: |
          export PATH="$HOME/.local/bin:$HOME/.cargo/bin:$PATH"
          command -v rustup >/dev/null 2>&1 || \
            curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal --default-toolchain 1.98.0
          rustup toolchain install 1.98.0 --profile minimal
          rustup default 1.98.0
          rustup target add "${{ matrix.triple }}"
          command -v uv >/dev/null 2>&1 || curl -LsSf https://astral.sh/uv/install.sh | sh
          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
      - name: Build (manylinux2014, with zig), check and hash
        shell: bash
        run: |
          set -euo pipefail
          t="${{ matrix.triple }}"
          tools="$RUNNER_TEMP/tools"; dist="$RUNNER_TEMP/dist"; rm -rf "$tools" "$dist"
          uv venv -q --python 3.12 "$tools"
          uv pip install -q --python "$tools/bin/python" "maturin==$MATURIN_VERSION" "ziglang==$ZIG_VERSION"
          export PATH="$tools/bin:$PATH"
          (cd wai/wai-quantum-py && maturin build --release --locked --zig --compatibility manylinux2014 --target "$t" -o "$dist")
          whl="$(ls "$dist"/wai_quantum-*.whl)"
          case "$whl" in *manylinux2014*) ;; *) echo "::error::not a manylinux2014 wheel: $whl"; exit 1 ;; esac
          py="$RUNNER_TEMP/py39"; rm -rf "$py"
          uv venv -q --python 3.9 "$py"
          uv pip install -q --python "$py/bin/python" --no-deps "$whl"
          (cd "$RUNNER_TEMP" && "$py/bin/python" -I "$GITHUB_WORKSPACE/wai/wai-quantum-py/tests/smoke.py")
          (cd "$dist" && for f in *.whl; do sha256sum "$f" > "$f.sha256"; done; ls -l)
      - name: Attach to the release
        shell: bash
        env:
          FORGE_TOKEN: ${{ github.token }}
        run: bash wai/wai-quantum-cli/release/publish.sh "$GITHUB_REF_NAME" "wai-quantum ${{ needs.version.outputs.version }}" "$RUNNER_TEMP"/dist/*

  windows:
    name: Windows · x86_64-pc-windows-msvc
    needs: version
    runs-on: windows
    timeout-minutes: 60
    env:
      CI: ""
    steps:
      - uses: actions/checkout@v5
      - name: Build, check and hash
        shell: pwsh
        run: |
          $ErrorActionPreference = 'Stop'
          Remove-Item Env:CI -ErrorAction SilentlyContinue
          if (-not (Get-Command uv -ErrorAction SilentlyContinue)) {
            powershell -ExecutionPolicy Bypass -c "irm https://astral.sh/uv/install.ps1 | iex"
            $env:Path = "$env:USERPROFILE\.local\bin;$env:Path"
          }
          $tools = Join-Path $env:RUNNER_TEMP 'tools'
          $dist = Join-Path $env:RUNNER_TEMP 'dist'
          $py39 = Join-Path $env:RUNNER_TEMP 'py39'
          Remove-Item $tools, $dist, $py39 -Recurse -Force -ErrorAction Ignore
          uv venv -q --python 3.12 $tools
          if ($LASTEXITCODE -ne 0) { throw "no venv for the build tools" }
          uv pip install -q --python "$tools\Scripts\python.exe" "maturin==$env:MATURIN_VERSION"
          if ($LASTEXITCODE -ne 0) { throw "maturin did not install" }
          Push-Location wai\wai-quantum-py
          & "$tools\Scripts\maturin.exe" build --release --locked --target x86_64-pc-windows-msvc -o $dist
          if ($LASTEXITCODE -ne 0) { throw "the wheel did not build" }
          Pop-Location
          $whl = (Get-ChildItem $dist -Filter 'wai_quantum-*.whl').FullName
          uv venv -q --python 3.9 $py39
          uv pip install -q --python "$py39\Scripts\python.exe" --no-deps $whl
          if ($LASTEXITCODE -ne 0) { throw "the wheel did not install" }
          Push-Location $env:RUNNER_TEMP
          & "$py39\Scripts\python.exe" -I (Join-Path $env:GITHUB_WORKSPACE 'wai\wai-quantum-py\tests\smoke.py')
          if ($LASTEXITCODE -ne 0) { throw "the smoke checks failed" }
          Pop-Location
          foreach ($f in Get-ChildItem $dist -Filter '*.whl') {
            $h = (Get-FileHash $f.FullName -Algorithm SHA256).Hash.ToLower()
            Set-Content -NoNewline -Path "$($f.FullName).sha256" -Value "$h  $($f.Name)`n"
          }
      - name: Attach to the release
        shell: pwsh
        env:
          FORGE_TOKEN: ${{ github.token }}
        run: |
          $ErrorActionPreference = 'Stop'
          $H = @{ Authorization = "token $env:FORGE_TOKEN" }
          $base = "$env:FORGE_API/repos/$env:FORGE_REPO/releases"
          $tag = $env:GITHUB_REF_NAME
          $rel = $null
          for ($i = 0; $i -lt 6 -and -not $rel; $i++) {
            try { $rel = Invoke-RestMethod -Headers $H -Uri "$base/tags/$tag" } catch {
              try { Invoke-RestMethod -Headers $H -Method Post -Uri $base -ContentType 'application/json' -Body (@{ tag_name = $tag; name = "wai-quantum ${{ needs.version.outputs.version }}" } | ConvertTo-Json) | Out-Null } catch {}
              Start-Sleep -Seconds 3
            }
          }
          if (-not $rel) { throw "no release for $tag" }
          foreach ($f in Get-ChildItem (Join-Path $env:RUNNER_TEMP 'dist')) {
            foreach ($a in (Invoke-RestMethod -Headers $H -Uri "$base/$($rel.id)/assets" | Where-Object { $_.name -eq $f.Name })) {
              Invoke-RestMethod -Headers $H -Method Delete -Uri "$base/$($rel.id)/assets/$($a.id)" | Out-Null
            }
            curl.exe -fsS -H "Authorization: token $env:FORGE_TOKEN" -X POST "$base/$($rel.id)/assets?name=$($f.Name)" -F "attachment=@$($f.FullName);type=application/octet-stream" -o NUL -w "uploaded $($f.Name): http %{http_code}`n"
            if ($LASTEXITCODE -ne 0) { throw "the upload of $($f.Name) failed" }
          }