python-tests.yml

name: Python Tests

on:
  pull_request:
  push:
    branches:
      - stable
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  python-lint:
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-python@v6
        with:
          python-version: "3.13"
      - name: Install ruff
        run: pip install ruff==0.15.10
      - name: ruff check
        run: ruff check
      - name: ruff format --check
        run: ruff format --check

  python-tests:
    needs: python-lint
    runs-on: ubuntu-24.04
    strategy:
      matrix:
        python-version:
          - "3.10"
          - "3.11"
          - "3.12"
          - "3.13"
          - "3.14"

    steps:
      - uses: actions/checkout@v7

      - name: Install Rust toolchain
        uses: actions-rust-lang/setup-rust-toolchain@v1

      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: ${{ matrix.python-version }}

      - name: Cache OpenSSL build
        uses: actions/cache@v6
        with:
          path: vendor/openssl/install
          key: openssl-3.3.2-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('scripts/build-openssl.sh') }}

      - name: Build custom OpenSSL
        run: ./scripts/build-openssl.sh

      - name: Create virtualenv
        run: python -m venv .venv

      - name: Build Python extension
        env:
          PYO3_USE_ABI3_FORWARD_COMPATIBILITY: "1"
        run: |
          source .venv/bin/activate
          # maturin 1.13+ installs `[dependency-groups]` via
          # `pip install --group`, which requires pip >= 25.1. The
          # Python versions shipped with actions/setup-python ship
          # older pip (23.x on 3.10); upgrade first so `develop`
          # doesn't fail on an unknown `--group` flag.
          pip install --upgrade pip
          pip install maturin
          maturin develop --release

      - name: Verify module
        run: |
          source .venv/bin/activate
          python -c "import blasthttp; print(f'blasthttp {blasthttp.__version__}')"

      - name: Install test dependencies
        run: |
          source .venv/bin/activate
          pip install 'pytest>=8' 'pytest-asyncio>=0.23'

      - name: Run Python tests
        run: |
          source .venv/bin/activate
          pytest tests/python/ -v

  version-check:
    needs: python-tests
    if: github.event_name == 'push' && github.ref == 'refs/heads/stable'
    runs-on: ubuntu-latest
    outputs:
      new_version: ${{ steps.check.outputs.new_version }}
    steps:
      - uses: actions/checkout@v7
      - name: Check if version already on PyPI
        id: check
        run: |
          VERSION=$(grep -m1 '^version' pyproject.toml | sed 's/.*"\(.*\)".*/\1/')
          echo "version=$VERSION"
          if curl -sf -o /dev/null "https://pypi.org/pypi/blasthttp/$VERSION/json"; then
            echo "new_version=no" >> "$GITHUB_OUTPUT"
            echo "Version $VERSION already on PyPI — skipping wheel builds"
          else
            echo "new_version=yes" >> "$GITHUB_OUTPUT"
            echo "Version $VERSION not on PyPI — will build and publish"
          fi

  linux-build:
    needs: version-check
    if: needs.version-check.outputs.new_version == 'yes'
    runs-on: ${{ matrix.platform.runner }}
    strategy:
      matrix:
        platform:
          - runner: ubuntu-24.04
            target: x86_64
          - runner: ubuntu-24.04
            target: x86
          - runner: ubuntu-24.04
            target: aarch64
          - runner: ubuntu-24.04
            target: armv7
          - runner: ubuntu-24.04
            target: s390x
          - runner: ubuntu-24.04
            target: ppc64le
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-python@v6
        with:
          python-version: 3.x
      - name: Build wheels
        uses: PyO3/maturin-action@v1
        env:
          PYO3_USE_ABI3_FORWARD_COMPATIBILITY: "1"
        with:
          target: ${{ matrix.platform.target }}
          args: --release --out dist -i python3.10 -i python3.11 -i python3.12 -i python3.13 -i python3.14
          sccache: ${{ !startsWith(github.ref, 'refs/tags/') }}
          manylinux: manylinux_2_28
          before-script-linux: |
            set -e
            # Install OpenSSL build dependencies
            if command -v apk >/dev/null 2>&1; then
              apk add --no-cache perl make gcc musl-dev linux-headers curl bash
            elif command -v yum >/dev/null 2>&1; then
              yum install -y perl-core 2>/dev/null || true
            elif command -v apt-get >/dev/null 2>&1; then
              apt-get update && apt-get install -y perl make gcc curl 2>/dev/null || true
            fi
            # Build custom OpenSSL with weak cipher support
            ./scripts/build-openssl.sh
            # Override target-specific OPENSSL_DIR env vars set by maturin containers
            # (openssl-sys checks <TARGET>_OPENSSL_DIR before OPENSSL_DIR)
            OPENSSL_INSTALL="$(pwd)/vendor/openssl/install"
            export OPENSSL_DIR="$OPENSSL_INSTALL"
            export OPENSSL_STATIC=1
            export OPENSSL_NO_VENDOR=1
            for var in $(env | grep '_OPENSSL_DIR=' | cut -d= -f1); do
              export "$var=$OPENSSL_INSTALL"
            done
      - name: Upload wheels
        uses: actions/upload-artifact@v7
        with:
          name: wheels-linux-${{ matrix.platform.target }}
          path: dist

  musllinux-build:
    needs: version-check
    if: needs.version-check.outputs.new_version == 'yes'
    runs-on: ${{ matrix.platform.runner }}
    strategy:
      matrix:
        platform:
          - runner: ubuntu-24.04
            target: x86_64
          - runner: ubuntu-24.04
            target: x86
          - runner: ubuntu-24.04
            target: aarch64
          - runner: ubuntu-24.04
            target: armv7
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-python@v6
        with:
          python-version: 3.x
      - name: Build wheels
        uses: PyO3/maturin-action@v1
        env:
          PYO3_USE_ABI3_FORWARD_COMPATIBILITY: "1"
        with:
          target: ${{ matrix.platform.target }}
          args: --release --out dist -i python3.10 -i python3.11 -i python3.12 -i python3.13 -i python3.14
          sccache: ${{ !startsWith(github.ref, 'refs/tags/') }}
          manylinux: musllinux_1_2
          before-script-linux: |
            set -e
            # Install OpenSSL build dependencies
            if command -v apk >/dev/null 2>&1; then
              apk add --no-cache perl make gcc musl-dev linux-headers curl bash
            elif command -v yum >/dev/null 2>&1; then
              yum install -y perl-core 2>/dev/null || true
            elif command -v apt-get >/dev/null 2>&1; then
              apt-get update && apt-get install -y perl make gcc curl 2>/dev/null || true
            fi
            # Build custom OpenSSL with weak cipher support
            ./scripts/build-openssl.sh
            # Override target-specific OPENSSL_DIR env vars set by maturin containers
            OPENSSL_INSTALL="$(pwd)/vendor/openssl/install"
            export OPENSSL_DIR="$OPENSSL_INSTALL"
            export OPENSSL_STATIC=1
            export OPENSSL_NO_VENDOR=1
            for var in $(env | grep '_OPENSSL_DIR=' | cut -d= -f1); do
              export "$var=$OPENSSL_INSTALL"
            done
      - name: Upload wheels
        uses: actions/upload-artifact@v7
        with:
          name: wheels-musllinux-${{ matrix.platform.target }}
          path: dist

  sdist-build:
    needs: version-check
    runs-on: ubuntu-latest
    if: needs.version-check.outputs.new_version == 'yes'
    steps:
      - uses: actions/checkout@v7
      - name: Build sdist
        uses: PyO3/maturin-action@v1
        with:
          command: sdist
          args: --out dist
      - name: Upload sdist
        uses: actions/upload-artifact@v7
        with:
          name: wheels-sdist
          path: dist

  release:
    name: Release
    needs:
      - linux-build
      - musllinux-build
      - sdist-build
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: write
      attestations: write
    steps:
      - uses: actions/download-artifact@v8
      - name: Generate artifact attestation
        if: ${{ !github.event.repository.private }}
        uses: actions/attest-build-provenance@v4
        with:
          subject-path: 'wheels-*/*'
      - name: Publish to PyPI
        uses: PyO3/maturin-action@v1
        env:
          MATURIN_PYPI_TOKEN: ${{ secrets.PYPI_API_TOKEN }}
        with:
          command: upload
          args: --non-interactive --skip-existing wheels-*/*