CI.yml

name: CI

on:
  push:
    branches:
      - main
    tags:
      - '*'
  pull_request:
  workflow_dispatch:
  release:
    types:
      - published

permissions:
  contents: read

jobs:
  sdist:
    runs-on: ubuntu-latest
    name: sdists
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Install the latest version of uv
        uses: astral-sh/setup-uv@eac588ad8def6316056a12d4907a9d4d84ff7a3b # v7.3.0
        with:
          enable-cache: false

      - name: Make sdist (rfc3161_client)
        run: uv build --sdist

      - name: Upload sdist
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          name: rfc3161-sdist
          path: dist/rfc3161_client*

  linux:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        platform:
          - target: x86_64
          - target: x86
          - target: aarch64
          - target: armv7
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: 3.x

      - name: Build wheels
        uses: PyO3/maturin-action@b1bd829e37fef14c63f19162034228a2f3dc1021 # v1.50.0
        with:
          target: ${{ matrix.platform.target }}
          args: --release --out dist --find-interpreter
          manylinux: auto
          before-script-linux: |
            if command -v yum 2>&1 >/dev/null
            then
              yum update
              yum install -y perl-core cpanminus devtoolset-10-libatomic-devel
              # Workaround for OpenSSL not building on Centos 7 (manylinux2014)
              # Remove once `openssl-src` builds OpenSSL > 3.3.2 by default
              # Ref: https://github.com/openssl/openssl/pull/25367#issuecomment-2327177830
              cpanm --verbose --notest install Sub::Util
            fi

      - name: Upload wheels
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          name: wheels-linux-${{ matrix.platform.target }}
          path: dist

  musllinux:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        platform:
          - target: x86_64
          - target: x86
          - target: aarch64
          - target: armv7
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: 3.x

      - name: Build wheels
        uses: PyO3/maturin-action@b1bd829e37fef14c63f19162034228a2f3dc1021 # v1.50.0
        with:
          target: ${{ matrix.platform.target }}
          args: --release --out dist --find-interpreter
          manylinux: musllinux_1_2

      - name: Upload wheels
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          name: wheels-musllinux-${{ matrix.platform.target }}
          path: dist

  windows:
    needs: [sdist]
    runs-on: windows-latest
    strategy:
      fail-fast: false
      matrix:
        WINDOWS:
          - {ARCH: 'x86', WINDOWS: 'win32', RUST_TRIPLE: 'i686-pc-windows-msvc'}
          - {ARCH: 'x64', WINDOWS: 'win64', RUST_TRIPLE: 'x86_64-pc-windows-msvc'}
    name: ${{ matrix.WINDOWS.WINDOWS }}
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
        with:
          name: rfc3161-sdist

      - name: Install the latest version of uv
        uses: astral-sh/setup-uv@eac588ad8def6316056a12d4907a9d4d84ff7a3b # v7.3.0
        with:
          enable-cache: false

      # We cannot use `uv python install` because it doesn't allow to install python
      # version for another architecture
      - name: Setup python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: 3.x
          architecture: ${{ matrix.WINDOWS.ARCH }}

      - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
        with:
          toolchain: stable
          target: ${{ matrix.WINDOWS.RUST_TRIPLE }}

      - uses: dawidd6/action-download-artifact@5c98f0b039f36ef966fdb7dfa9779262785ecb05 # v14
        with:
          repo: pyca/infra
          workflow: build-windows-openssl.yml
          branch: main
          workflow_conclusion: success
          name: "openssl-${{ matrix.WINDOWS.WINDOWS }}"
          path: "C:/openssl-${{ matrix.WINDOWS.WINDOWS }}/"
          github_token: ${{ secrets.GITHUB_TOKEN }}

      - name: Configure OpenSSL
        run: |
            echo "OPENSSL_DIR=C:/openssl-${{ matrix.WINDOWS.WINDOWS }}" >> $GITHUB_ENV
            echo "OPENSSL_STATIC=1" >> $GITHUB_ENV
            echo "OPENSSL_NO_VENDOR=1" >> $GITHUB_ENV
        shell: bash

      - run: mkdir wheelhouse
      - name: Build wheel
        run: |
          uv build --wheel rfc3161*.tar.gz -o wheelhouse/
        shell: bash

      - name: Test Install
        run: uv run --with wheelhouse/rfc3161_client*.whl python -c "import rfc3161_client"
        shell: bash

      - name: Upload wheels
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          name: "wheels-windows-${{ matrix.WINDOWS.ARCH }}"
          path: wheelhouse

  macos:
    runs-on: ${{ matrix.platform.runner }}
    strategy:
      matrix:
        platform:
          - runner: macos-15-intel
            target: x86_64
          - runner: macos-15
            target: aarch64
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: 3.x

      - name: Build wheels
        uses: PyO3/maturin-action@b1bd829e37fef14c63f19162034228a2f3dc1021 # v1.50.0
        env:
          # Do not build OpenSSL on MacOS, since it's already installed
          # and we don't need to cross-compile.
          OPENSSL_NO_VENDOR: 1
        with:
          target: ${{ matrix.platform.target }}
          args: --release --out dist --find-interpreter

      - name: Upload wheels
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          name: wheels-macos-${{ matrix.platform.target }}
          path: dist


  publish:
    name: Publish Python distributions to PyPI
    runs-on: ubuntu-latest
    if: github.event_name == 'release' && github.event.action == 'published'
    needs: [linux, musllinux, windows, macos, sdist]
    environment:
      name: pypi
      url: https://pypi.org/p/rfc3161-client
    permissions:
      # Used to sign the release's artifacts with sigstore-python.
      # Used to publish to PyPI with Trusted Publishing.
      id-token: write
    steps:
      - uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
        with:
          path: dist/
          merge-multiple: true

      - name: Publish distributions
        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0