build-wheels.yml

name: Build wheels

on: [push, pull_request]

concurrency:
  group: ${{ github.ref }}-${{ github.workflow }}-${{ github.event_name }}-${{ github.ref == format('refs/heads/{0}', github.event.repository.default_branch) && github.sha || '' }}
  cancel-in-progress: true

jobs:
  build_wheels:
    name: Build wheel - ${{ matrix.cibw.build }} ${{ matrix.os.name }}
    runs-on: ${{ matrix.os.runs-on }}
    strategy:
      fail-fast: false
      matrix:
        os:
          - name: macOS
            runs-on: macos-10.14
            matrix: macos
          - name: Linux
            runs-on: ubuntu-latest
            matrix: linux
          - name: Windows
            runs-on: windows-latest
            matrix: windows
        cibw:
          # build just supported python versions at May 2023
          - build: cp27-*
            group: old
          - build: cp35-*
            group: old
          - build: cp36-*
            group: old
          - build: pp27-*
            group: old
          - build: pp36-*
            group: old
          - build: cp37-*
            group: new
          - build: cp38-*
            group: new
          - build: cp39-*
            group: new
          - build: cp310-*
            group: new
          - build: cp311-*
            group: new
          - build: cp312-*
            group: new
          - build: cp313-*
            group: new
          - build: pp27-*
            group: old
          - build: pp37-*
            group: new
          - build: pp38-*
            group: new
          - build: pp39-*
            group: new
          - build: pp310-*
            group: new
        exclude:
          - os:
              matrix: windows
            cibw:
              build: cp27-*
          - os:
              matrix: windows
            cibw:
              build: pp27-*

    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          submodules: 'recursive'

      - uses: actions/setup-python@v5
        name: Install Python
        with:
          python-version: '3.12'

      - name: Prepare python
        run: |
          python -m pip install --upgrade pip

      - name: Set up QEMU
        if: matrix.os.matrix == 'linux'
        uses: docker/setup-qemu-action@v1
        with:
          platforms: 'arm64'

      - name: Build source distribution with Ubuntu
        if: matrix.os.matrix == 'linux'
        run: |
          pip install build
          python -m build --sdist --outdir dist .

      - name: Build ${{ matrix.os.name }} wheels and test (old)
        uses: pypa/cibuildwheel@v1.12.0
        if: matrix.cibw.group == 'old'
        with:
          output-dir: dist
        env:
          CIBW_BUILD: ${{ matrix.cibw.build }}
          # Skip 32-bit builds // NO
          # CIBW_SKIP: '*-win32 *_i686'
          CIBW_MANYLINUX_I686_IMAGE: manylinux1
          CIBW_MANYLINUX_X86_64_IMAGE: manylinux1
          CIBW_MUSLLINUX_I686_IMAGE: musllinux_1_2
          CIBW_MUSLLINUX_X86_64_IMAGE: musllinux_1_2
          # Only build on x86 and arm64 for linux
          CIBW_ARCHS_LINUX: i686 x86_64
          CIBW_BEFORE_ALL_LINUX: >
            python -m pip install --upgrade pip
          # CIBW_ARCHS_MACOS: x86_64 arm64 universal2
          # Building two wheels for MacOS and skipping Universal
          CIBW_ARCHS_MACOS: x86_64
          # Skip testing Apple Silicon until there are GH runners
          CIBW_TEST_SKIP: '*_arm64 *_universal2:arm64'
          CIBW_BEFORE_ALL_MACOS: >
            python -m pip install --upgrade pip
          CIBW_ENVIRONMENT_MACOS: MACOSX_DEPLOYMENT_TARGET=10.14
          CIBW_BUILD_VERBOSITY_MACOS: 0
          CIBW_BEFORE_ALL_WINDOWS: >
            python -m pip install --upgrade pip
          CIBW_TEST_COMMAND: >
            python -m unittest discover -v -s {package}

      - name: Build ${{ matrix.os.name }} wheels and test (new)
        uses: joerick/cibuildwheel@v2.22.0
        if: matrix.cibw.group == 'new'
        with:
          output-dir: dist
        env:
          CIBW_BUILD: ${{ matrix.cibw.build }}
          # Skip 32-bit builds // NO
          # CIBW_SKIP: '*-win32 *_i686'
          CIBW_MANYLINUX_I686_IMAGE: manylinux2014
          CIBW_MANYLINUX_X86_64_IMAGE: manylinux2014
          CIBW_MANYLINUX_AARCH64_IMAGE: manylinux2014
          CIBW_MUSLLINUX_I686_IMAGE: musllinux_1_1
          CIBW_MUSLLINUX_X86_64_IMAGE: musllinux_1_1
          # Only build on x86 and arm64 for linux
          CIBW_ARCHS_LINUX: auto aarch64
          CIBW_BEFORE_ALL_LINUX: >
            python -m pip install --upgrade pip
          # CIBW_ARCHS_MACOS: x86_64 arm64 universal2
          # Building two wheels for MacOS and skipping Universal
          CIBW_ARCHS_MACOS: x86_64 arm64
          # Skip testing Apple Silicon until there are GH runners
          CIBW_TEST_SKIP: '*_arm64 *_universal2:arm64'
          CIBW_BEFORE_ALL_MACOS: >
            python -m pip install --upgrade pip
          CIBW_ENVIRONMENT_MACOS: MACOSX_DEPLOYMENT_TARGET=10.14
          CIBW_BUILD_VERBOSITY_MACOS: 0
          CIBW_BEFORE_ALL_WINDOWS: >
            python -m pip install --upgrade pip
          CIBW_TEST_COMMAND: >
            python -m unittest discover -v -s {package}

      - name: Upload artifacts
        uses: actions/upload-artifact@v3
        with:
          name: wheels
          path: ./dist

      - name: Test for secrets access
        id: check_secrets
        # If a third party makes a pull request
        # this allows automated steps below to be skipped
        # and leave a clean PR CI run
        shell: bash
        run: |
          unset HAS_SECRET
          unset HAS_SECRET_TEST
          if [ -n "$SECRET" ]; then HAS_SECRET='true' ; fi
          if [ -n "$SECRET_TEST" ]; then HAS_SECRET_TEST='true' ; fi
          echo ::set-output name=HAS_SECRET::${HAS_SECRET}
          echo ::set-output name=HAS_SECRET_TEST::${HAS_SECRET_TEST}
        env:
          SECRET: "${{ secrets.pypi_password }}"
          SECRET_TEST: "${{ secrets.test_pypi_password }}"

      - name: Install twine
        run: pip install twine

      - name: Publish distribution to PyPI
        if: >
         startsWith(github.event.ref, 'refs/tags') &&
         steps.check_secrets.outputs.HAS_SECRET
        env:
          # If the PR/Push has secret access
          # and PYPI_PASSWORD is in GH Secrets for this repo
          # and this is a tag, publish to PyPI
          TWINE_REPOSITORY_URL: https://upload.pypi.org/legacy/
          TWINE_USERNAME: "${{ secrets.pypi_username }}"
          TWINE_NON_INTERACTIVE: 1
          TWINE_PASSWORD: "${{ secrets.pypi_password }}"
        run: twine upload --non-interactive --skip-existing --verbose 'dist/*'

      - name: Publish distribution to Test PyPI
        if: steps.check_secrets.outputs.HAS_SECRET
        env:
          # If the PR/Push has secret access
          # and TEST_PYPI_PASSWORD is in GH Secrets for this repo
          # then publish each build to test PyPI
          TWINE_REPOSITORY_URL: https://test.pypi.org/legacy/
          TWINE_USERNAME: "${{ secrets.test_pypi_username }}"
          TWINE_NON_INTERACTIVE: 1
          TWINE_PASSWORD: "${{ secrets.test_pypi_password }}"
        run: twine upload --non-interactive --skip-existing --verbose 'dist/*'