publish_wheels.yml

name: Build and Publish Wheels

on:
  pull_request:
  push:
    tags:
      - "v*"
  workflow_dispatch:
    inputs:
      repository:
        description: "Package index target"
        required: true
        default: testpypi
        type: choice
        options:
          - testpypi
          - pypi

permissions:
  contents: read
  id-token: write

jobs:
  build-wheels:
    name: Wheels (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-22.04, macos-14, macos-15-intel, windows-2022]
    steps:
      - name: Check out CEA
        uses: actions/checkout@v4
        with:
          submodules: recursive

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - name: Install build tools
        run: |
          python -m pip install --upgrade pip
          python -m pip install cibuildwheel build

      - name: Set up Fortran compiler (macOS)
        if: runner.os == 'macOS'
        run: |
          brew update
          brew install gcc@14

      - name: Set up Intel oneAPI Fortran (Windows)
        if: runner.os == 'Windows'
        uses: fortran-lang/setup-fortran@v1
        with:
          compiler: intel
          version: "2025.2"

      - name: Remove MinGW/MSYS paths (Windows)
        if: runner.os == 'Windows'
        shell: pwsh
        run: |
          $parts = $env:PATH -split ';'
          $clean = $parts | Where-Object { $_ -and ($_ -notmatch 'mingw') -and ($_ -notmatch 'msys') -and ($_ -notmatch 'strawberry') }
          "PATH=$($clean -join ';')" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append

      - name: Build wheels
        env:
          CIBW_BUILD: "cp311-* cp312-* cp313-* cp314-*"
          CIBW_BUILD_VERBOSITY: "1"
          CIBW_SKIP: "*-musllinux_*"
          CIBW_ARCHS_LINUX: "x86_64"
          CIBW_ARCHS_MACOS: ${{ matrix.os == 'macos-15-intel' && 'x86_64' || matrix.os == 'macos-14' && 'arm64' || 'x86_64 arm64' }}
          CIBW_ARCHS_WINDOWS: "AMD64"
          CIBW_BEFORE_ALL_LINUX: "yum -y install gcc-gfortran"
          CIBW_TEST_REQUIRES: "pytest"
          CIBW_TEST_COMMAND: "pytest {project}/source/bind/python/tests -m smoke"
          CIBW_TEST_ENVIRONMENT: "CEA_DATA_DIR={project}/data"
          CIBW_ENVIRONMENT_MACOS: ${{ matrix.os == 'macos-14' && 'FC=gfortran-14 MACOSX_DEPLOYMENT_TARGET=14.0' || 'FC=gfortran-14 MACOSX_DEPLOYMENT_TARGET=15.0' }}
          CIBW_ENVIRONMENT_WINDOWS: "FC=ifx CC=icx CXX=icx"
          CMAKE_ARGS: "-DCEA_BUILD_TESTING=OFF"
        run: |
          cibuildwheel --output-dir dist

      - name: Build sdist
        if: runner.os == 'Linux'
        run: |
          python -m build --sdist --outdir dist

      - name: Upload artifacts
        uses: actions/upload-artifact@v4
        with:
          name: dist-${{ matrix.os }}
          path: dist/*

  publish:
    name: Publish to PyPI
    needs: build-wheels
    runs-on: ubuntu-22.04
    if: startsWith(github.ref, 'refs/tags/v') || github.event_name == 'workflow_dispatch'
    permissions:
      contents: read
      id-token: write
    steps:
      - name: Download artifacts
        uses: actions/download-artifact@v4
        with:
          path: dist
          merge-multiple: true

      - name: Verify OIDC token availability
        shell: bash
        run: |
          if [ -z "${ACTIONS_ID_TOKEN_REQUEST_TOKEN:-}" ] || [ -z "${ACTIONS_ID_TOKEN_REQUEST_URL:-}" ]; then
            echo "OIDC token env vars are unavailable for this run."
            echo "ACTIONS_ID_TOKEN_REQUEST_TOKEN set: $([ -n "${ACTIONS_ID_TOKEN_REQUEST_TOKEN:-}" ] && echo yes || echo no)"
            echo "ACTIONS_ID_TOKEN_REQUEST_URL set: $([ -n "${ACTIONS_ID_TOKEN_REQUEST_URL:-}" ] && echo yes || echo no)"
            echo "Ensure workflow/job has 'id-token: write' and repository/org policy permits OIDC."
            exit 1
          fi

      - name: Publish to PyPI
        if: startsWith(github.ref, 'refs/tags/v') || (github.event_name == 'workflow_dispatch' && github.event.inputs.repository == 'pypi')
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          packages-dir: dist

      - name: Publish to TestPyPI
        if: github.event_name == 'workflow_dispatch' && github.event.inputs.repository == 'testpypi'
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          repository-url: https://test.pypi.org/legacy/
          packages-dir: dist