python.yml

name: Python

permissions:
  contents: read

on:
  push:
    paths:
      - setup.py
      - pyproject.toml
      - 'python/**'
      - .github/workflows/python.yml
    tags-ignore:
  pull_request:
    paths:
      - setup.py
      - pyproject.toml
      - 'python/**'
  workflow_dispatch:
  release:
    types:
      - published

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  sdist:
    name: Source distribution
    runs-on: ubuntu-latest

    steps:
    - name: Clone repository
      uses: actions/checkout@v6
      with:
        fetch-depth: 0
        fetch-tags: true

    - name: Set up Python
      uses: actions/setup-python@v6
      with:
        python-version: "3.14"

    - name: Install Python build dependencies
      run: python -m pip install build

    - name: Build source distribution tarball
      run: |
        git config --global --add safe.directory "$GITHUB_WORKSPACE"
        ./genversion.sh >| VERSION
        python -m build --sdist

    - name: Upload source distribution
      uses: actions/upload-artifact@v7
      with:
        name: python-sdist
        path: dist/*.tar.gz
        retention-days: 14

  manylinux:
    name: Python ${{ matrix.version }} (Linux, ${{ matrix.platform.arch }})
    runs-on: ${{ matrix.platform.runs_on }}
    container: ${{ matrix.platform.container }}
    needs: [ sdist ]

    strategy:
      fail-fast: false
      matrix:
        version: [ "3.9", "3.10", "3.11", "3.12", "3.13", "3.14" ]
        platform:
          - arch: arm64
            runs_on: ubuntu-24.04-arm
            container: quay.io/pypa/manylinux_2_28_aarch64
          - arch: x86_64
            runs_on: ubuntu-24.04
            container: quay.io/pypa/manylinux_2_28_x86_64

    env:
      CMAKE_ARGS: -DCMAKE_BUILD_TYPE=Release
      PYTHON: python${{ matrix.version }}

    steps:
    - name: Install dependencies
      run: dnf install -y git krb5-devel libuuid-devel openssl-devel

    - name: Download source distribution
      uses: actions/download-artifact@v7
      with:
        name: python-sdist

    - name: Build binary wheel
      run: ${PYTHON} -m pip wheel --use-pep517 --verbose *.tar.gz

    - name: Fixup binary wheel
      run: auditwheel repair *.whl

    - name: Install binary wheel
      run: ${PYTHON} -m pip install wheelhouse/*.whl

    - name: Run post-installation tests
      run: |
        command -v ${PYTHON} && ${PYTHON} --version
        ${PYTHON} -m pip show xrootd
        ${PYTHON} -c 'import XRootD; print(XRootD)'
        ${PYTHON} -c 'import pyxrootd; print(pyxrootd)'
        ${PYTHON} -c 'from XRootD import client; help(client)'
        ${PYTHON} -c 'from XRootD import client; print(client.FileSystem("root://localhost"))'

    - name: Upload Artifacts
      uses: actions/upload-artifact@v7
      with:
        name: python-${{ matrix.version }}-linux-${{ matrix.platform.arch }}
        path: wheelhouse
        retention-days: 14

  macos:
    name: Python ${{ matrix.version }} (macOS, ${{ matrix.platform.arch }})
    runs-on: ${{ matrix.platform.runs_on }}
    needs: [ sdist ]

    strategy:
      fail-fast: false
      matrix:
        version: [ "3.9", "3.10", "3.11", "3.12", "3.13", "3.14" ]
        platform:
          - arch: arm64
            runs_on: macos-15
            host_platform: macosx-15.0-arm64
            openssl_prefix: /opt/homebrew/opt/openssl@3
          - arch: x86_64
            runs_on: macos-15-intel
            host_platform: macosx-15.0-x86_64
            openssl_prefix: /usr/local/opt/openssl@3

    env:
      CMAKE_ARGS: -DPython_FIND_UNVERSIONED_NAMES=FIRST -DCMAKE_BUILD_TYPE=Release
      CMAKE_PREFIX_PATH: ${{ matrix.platform.openssl_prefix }}
      HOMEBREW_NO_AUTO_UPDATE: "1"
      MACOSX_DEPLOYMENT_TARGET: "15.0"
      _PYTHON_HOST_PLATFORM: ${{ matrix.platform.host_platform }}

    steps:
    - name: Set up Python
      uses: actions/setup-python@v6
      with:
        python-version: ${{ matrix.version }}

    - name: Install dependencies with Homebrew
      run: brew install nlohmann-json

    - name: Install Python build dependencies
      run: python -m pip install build delocate

    - name: Download source distribution
      uses: actions/download-artifact@v7
      with:
        name: python-sdist

    - name: Build binary wheel
      run: python -m pip wheel --use-pep517 --verbose *.tar.gz

    - name: Fixup binary wheel
      run: delocate-wheel -w wheelhouse -v *.whl

    - name: Install binary wheel
      run: python -m pip install wheelhouse/*.whl

    - name: Run post-installation tests
      run: |
        command -v python && python --version
        python -m pip show xrootd
        python -c 'import XRootD; print(XRootD)'
        python -c 'import pyxrootd; print(pyxrootd)'
        python -c 'from XRootD import client; help(client)'
        python -c 'from XRootD import client; print(client.FileSystem("root://localhost"))'

    - name: Upload Artifacts
      uses: actions/upload-artifact@v7
      with:
        name: python-${{ matrix.version }}-macos-${{ matrix.platform.arch }}
        path: wheelhouse
        retention-days: 14

  pypi:
    if: ${{ github.event_name == 'release' && github.repository_owner == 'xrootd' }}
    name: Publish to PyPI
    needs: [ macos, manylinux ]
    runs-on: ubuntu-latest
    environment: pypi
    permissions:
      attestations: write
      contents: read
      id-token: write

    steps:
    - name: Download Artifacts
      uses: actions/download-artifact@v7
      with:
        path: dist
        pattern: python-*
        merge-multiple: true

    - name: Publish to PyPI
      uses: pypa/gh-action-pypi-publish@release/v1