release.yml

name: Release

on:
  push:
    tags:
      - "v*"
  workflow_dispatch:

permissions:
  contents: read

jobs:
  # Build Rust binaries and shared library.
  # x86_64 is pinned to ubuntu-22.04 (glibc 2.35) so release binaries run on
  # older distros (Ubuntu 22.04+, Debian 12+, RHEL 9+). aarch64 builds on
  # ubuntu-24.04-arm (glibc 2.39) — the runner matches the rest of CI; older
  # aarch64 distros can build from source until a 22.04-arm runner is wired in.
  build:
    name: Build (${{ matrix.target }})
    runs-on: ${{ matrix.runs-on }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - target: x86_64-unknown-linux-gnu
            runs-on: ubuntu-22.04
          - target: aarch64-unknown-linux-gnu
            runs-on: ubuntu-24.04-arm
    steps:
      - uses: actions/checkout@v4

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}

      - name: Build
        run: cargo build --release --target ${{ matrix.target }}

      - name: Package
        run: |
          mkdir -p dist
          cp target/${{ matrix.target }}/release/sandlock dist/ 2>/dev/null || true
          cp target/${{ matrix.target }}/release/libsandlock_ffi.so dist/ 2>/dev/null || true
          tar -czf sandlock-${{ matrix.target }}.tar.gz -C dist .

      - name: Upload
        uses: actions/upload-artifact@v4
        with:
          name: sandlock-${{ matrix.target }}
          path: sandlock-${{ matrix.target }}.tar.gz

  # Build Python sdist (includes setup.py that builds Rust on install)
  sdist:
    name: Build Python sdist
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - name: Build sdist
        working-directory: python
        run: |
          pip install build
          python -m build --sdist .

      - name: Upload sdist
        uses: actions/upload-artifact@v4
        with:
          name: sdist
          path: python/dist/*.tar.gz

  # Build pre-compiled wheels so users don't need a Rust toolchain.
  # Each arch builds natively (x86_64 on ubuntu-latest, aarch64 on the ARM
  # runner) — avoids QEMU emulation, which is ~5–10× slower for Rust builds.
  wheels:
    name: Build wheels (${{ matrix.arch }})
    runs-on: ${{ matrix.runs-on }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - arch: x86_64
            runs-on: ubuntu-latest
          - arch: aarch64
            runs-on: ubuntu-24.04-arm
    steps:
      - uses: actions/checkout@v4

      - name: Build wheels
        uses: pypa/cibuildwheel@v2.22
        with:
          package-dir: python
          output-dir: wheelhouse
        env:
          CIBW_BUILD: "cp310-manylinux* cp311-manylinux* cp312-manylinux* cp313-manylinux*"
          CIBW_ARCHS_LINUX: ${{ matrix.arch }}
          CIBW_BEFORE_ALL_LINUX: >
            curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y &&
            echo 'export PATH="$HOME/.cargo/bin:$PATH"' >> ~/.bashrc
          CIBW_ENVIRONMENT_LINUX: 'PATH="$HOME/.cargo/bin:$PATH"'

      - name: Upload wheels
        uses: actions/upload-artifact@v4
        with:
          name: wheels-${{ matrix.arch }}
          path: wheelhouse/*.whl

  # Test
  test:
    name: Test (py${{ matrix.python }})
    needs: build
    runs-on: ubuntu-latest
    strategy:
      matrix:
        python: ["3.10", "3.11", "3.12"]
    steps:
      - uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python }}

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Install and test
        working-directory: python
        run: |
          pip install pytest
          pip install -e .
          pytest tests/ -v

  # Publish Rust crates to crates.io
  publish-crates:
    name: Publish to crates.io
    needs: [build, test]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Publish crates
        env:
          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
        run: |
          cargo publish -p sandlock-core
          cargo publish -p sandlock-ffi
          cargo publish -p sandlock-cli

  # Publish Python package to PyPI
  publish-pypi:
    name: Publish to PyPI
    needs: [sdist, wheels, test]
    runs-on: ubuntu-latest
    environment: pypi
    permissions:
      id-token: write
    steps:
      - name: Download sdist
        uses: actions/download-artifact@v4
        with:
          name: sdist
          path: dist/

      - name: Download wheels
        uses: actions/download-artifact@v4
        with:
          pattern: wheels-*
          path: dist/
          merge-multiple: true

      - name: Publish to PyPI
        env:
          TWINE_USERNAME: __token__
          TWINE_PASSWORD: ${{ secrets.PYPI_TOKEN }}
        run: |
          pip install twine
          twine upload dist/*

  # Create GitHub Release with Rust binaries
  github-release:
    name: GitHub Release
    needs: [build, test]
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - name: Download artifacts
        uses: actions/download-artifact@v4
        with:
          path: artifacts/

      - name: Create Release
        uses: softprops/action-gh-release@v2
        with:
          files: artifacts/**/*.tar.gz
          generate_release_notes: true