release.yml

name: Ion Python Release

on:
  release:
    types: [ released ]

jobs:
  test:
    if: startsWith(github.ref, 'refs/tags/')
    runs-on: ubuntu-latest
    strategy:
      matrix:
        python-version: ['3.9', '3.10', '3.11', '3.12', '3.13', 'pypy-3.10']
    steps:
      - uses: actions/checkout@v4
      - name: Set up python
        uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python-version }}

      - name: Create a virtual environment
        run: git submodule init && git submodule update && python3 -m venv ./venv && . venv/bin/activate
      - run: python -m pip install build
      - run: python -m build .
      - run: python -m pip install -e '.[test]'
      - run: py.test --ignore tests/test_benchmark_cli.py --ignore tests/test_benchmark_spec.py

  source-distribution:
    if: startsWith(github.ref, 'refs/tags/')
    name: Source distribution
    runs-on: ubuntu-latest
    needs: [test]
    strategy:
      matrix:
        python-version: [ '3.10' ]
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: true

      - name: Build sdist
        run: python -m pip install build && python -m build -s

      - name: Upload source to Github
        uses: actions/upload-artifact@v4
        with:
          name: dist-source
          path: ./dist/amazon_ion-*.tar.gz

      - uses: aws-actions/configure-aws-credentials@v4
        with:
          role-skip-session-tagging: true
          aws-region: us-west-2
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          role-to-assume: ${{ secrets.AWS_ROLE_TO_ASSUME }}
          role-external-id: ${{ secrets.AWS_ROLE_EXTERNAL_ID }}
          role-duration-seconds: 900

      - name: Upload source to s3
        run: |
          zip ion-python-source ./dist/amazon_ion-*.tar.gz
          aws s3 mv ion-python-source.zip ${{ secrets.AWS_SOURCE_BUCKET_URL }} --acl bucket-owner-full-control

  build-wheels:
    name: Build wheels on ${{ matrix.os }}
    if: startsWith(github.ref, 'refs/tags/')
    needs: [test]
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: true
      matrix:
        include:
          # See https://cibuildwheel.readthedocs.io/en/stable/options/#build-skip for more details.
          - os: macos-26-intel
            arch: x86_64
            cibw_arch: "x86_64"
          - os: macos-latest
            arch: arm64
            cibw_arch: "arm64"
          - os: windows-latest
            cibw_arch: "AMD64"
          - os: ubuntu-latest
            cibw_arch: "i686 x86_64 aarch64"

    steps:
      - uses: actions/checkout@v4
        with:
          submodules: true

      # ion-c derives its version via `git describe --tags --match "v*"`. Submodule
      # checkouts don't fetch tags, so without this the version macros expand to empty
      # and ion_version.c fails to compile ("expected expression before ';' token").
      - name: Fetch ion-c tags
        run: git -C src/ion-c fetch --tags --unshallow

      - name: Set up QEMU for Linux Builds
        if: runner.os == 'Linux'
        uses: docker/setup-qemu-action@v3
        with:
          platforms: all

      - name: Build Wheels
        uses: pypa/cibuildwheel@v3.2.0
        env:
          # See the following for the status of python versions (ie. what's EoL'd, security only, etc):
          # https://devguide.python.org/versions/
          #
          # At the time of writing, anything older than 3.9 is end-of-life.
          CIBW_BUILD: "cp39-* cp310-* cp311-* cp312-* cp313-*"
          CIBW_ARCHS: ${{ matrix.cibw_arch }}
          CIBW_ARCHS_LINUX: ${{ matrix.cibw_arch }}

      - name: Upload wheels to Github
        uses: actions/upload-artifact@v4
        with:
          name: dist-${{ matrix.os }}
          path: ./wheelhouse/*.whl

  upload-distributions:
    name: Release distributions to PyPI
    runs-on: [ubuntu-latest]
    needs: [build-wheels, source-distribution]
    permissions:
      id-token: write # Needed for PyPi trusted publishing
    steps:
      - uses: actions/download-artifact@v4
        with:
          pattern: dist-*
          path: ./dist
          merge-multiple: true

      - name: Publish Package to PyPI
        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # release/v1.13.0

      - name: Install the released wheels from PYPI
        run: |
          sleep 300s

          for (( i=0; i<3; i++ ))
          do
            v=""

            if ! (pip install --only-binary :all: "amazon.ion==${GITHUB_REF##*/v}") then
              echo "Unable to install the desired version"
              sleep 120s
              continue
            fi

            v=$( pip show amazon.ion | grep Version | head -1 )
            break
          done

          if [[ $v != "Version: ${GITHUB_REF##*/v}" ]]
          then
            echo "Exiting because unable to install the new version from PYPI"
            exit 1
          fi

      - name: Install the released sdist from PYPI
        # Non-blocking for now: a from-source build failure reports but does not
        # fail the release. Remove this once the sdist build is proven reliable.
        continue-on-error: true
        run: |
          # Use a clean venv and --no-binary :all: so pip ignores the published
          # wheels and builds the C extension from the source distribution. This
          # verifies the sdist on PyPI is actually buildable from source.
          python -m venv /tmp/sdist-venv
          . /tmp/sdist-venv/bin/activate

          v=""

          for (( i=0; i<3; i++ ))
          do
            if ! (pip install --no-binary :all: --no-cache-dir "amazon.ion==${GITHUB_REF##*/v}") then
              echo "Unable to build/install the desired version from sdist"
              sleep 120s
              continue
            fi

            v=$( pip show amazon.ion | grep Version | head -1 )
            break
          done

          if [[ $v != "Version: ${GITHUB_REF##*/v}" ]]
          then
            echo "Exiting because unable to install the new version from sdist on PYPI"
            exit 1
          fi