martin/.github/workflows/python-release.yml at main · maplibre/martin · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
name: Python release

on:
  pull_request:
    paths:
      - '.github/workflows/python-release.yml'
      - 'cog-tiles/**'
      - 'cog-tiles-py/**'
  # release-plz drafts the `python-cog-tiles-v*` release and release.yml publishes it with the app token
  release:
    types: [ published ]
  workflow_dispatch:

defaults:
  run:
    shell: bash

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  wheels:
    name: Wheel ${{ matrix.platform.runner }} ${{ matrix.python }}
    if: github.event_name != 'release' || startsWith(github.event.release.tag_name, 'python-cog-tiles-v')
    runs-on: ${{ matrix.platform.runner }}
    timeout-minutes: 60
    strategy:
      fail-fast: false
      matrix:
        # 3.14 builds the abi3 wheel for CPython 3.11 to 3.14
        # 3.15t builds the abi3t wheel for every CPython from 3.15 on, free-threaded or not
        python: [ '3.14', '3.15t' ]
        platform:
          - { runner: ubuntu-24.04, target: x86_64 }
          - { runner: ubuntu-24.04-arm, target: aarch64 }
          - { runner: macos-15-intel, target: x86_64 }
          - { runner: macos-latest, target: aarch64 }
          - { runner: windows-latest, target: x64 }
    steps:
      - name: Checkout sources
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with: { persist-credentials: false }
      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with: { python-version: '${{ matrix.python }}' }
      - name: Build the wheel
        uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
        with:
          target: ${{ matrix.platform.target }}
          args: --release --out dist --locked --compatibility pypi --interpreter python${{ matrix.python }} --manifest-path cog-tiles-py/Cargo.toml
          sccache: false
          manylinux: '2_28'
      - name: Import the wheel
        run: |
          python -m pip install --find-links dist cog-tiles
          python -W error -c "import cog_tiles"
      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: wheels-${{ matrix.platform.runner }}-${{ matrix.python }}
          path: dist

  sdist:
    name: Source distribution
    if: github.event_name != 'release' || startsWith(github.event.release.tag_name, 'python-cog-tiles-v')
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - name: Checkout sources
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with: { persist-credentials: false }
      - name: Build the sdist
        uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
        with:
          command: sdist
          args: --out dist --manifest-path cog-tiles-py/Cargo.toml
      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: wheels-sdist
          path: dist

  # PyPI trusted publisher: project `cog-tiles`, repository maplibre/martin,
  # workflow `python-release.yml`, environment `pypi`.
  publish:
    name: Publish to PyPI
    needs: [ wheels, sdist ]
    if: github.event_name == 'release' && startsWith(github.event.release.tag_name, 'python-cog-tiles-v')
    runs-on: ubuntu-latest
    timeout-minutes: 15
    environment:
      name: pypi
      url: https://pypi.org/p/cog-tiles
    permissions:
      id-token: write
      attestations: write
    steps:
      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with: { pattern: 'wheels-*', path: 'dist', merge-multiple: true }
      - name: Generate SLSA build provenance attestation
        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
        with: { subject-path: 'dist/*' }
      - name: Install uv
        uses: astral-sh/setup-uv@18d369b23da25a81e9458561248e1aafff6a70fa # v10.3.1
        with: { enable-cache: false }
      - name: Publish to PyPI
        run: uv publish --trusted-publishing always dist/*