python-release.yml

# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements.  See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership.  The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License.  You may obtain a copy of the License at
#
#   http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied.  See the License for the
# specific language governing permissions and limitations
# under the License.

# Publish the fluss Python binding to PyPI.
# Trigger: push tag only (e.g. v0.1.0).
# Pre-release tags (containing '-') publish to TestPyPI; release tags publish to PyPI.
#
# Auth: PyPI/TestPyPI Trusted Publishing (OIDC). The pyfluss publisher config on both
# indexes must name this repository and this workflow file; no secret is involved.

name: Release Python

on:
  push:
    tags:
      - "v*"  # Only version-like tags (e.g. v0.1.0, v0.1.0-rc1); avoids running on arbitrary tags

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event_name }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  version-check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: ./.github/actions/verify-tag-version

  sdist:
    runs-on: ubuntu-latest
    needs: [version-check]
    steps:
      - uses: actions/checkout@v6
      - name: Set Python release version
        shell: bash
        env:
          RELEASE_TAG: ${{ github.ref_name }}
        run: python tools/releasing/set_python_release_version.py "$RELEASE_TAG"

      - uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4
        with:
          toolchain: stable

      - name: Check generated binary licenses
        run: python fluss-rust/bindings/python/generate_binary_license.py --check

      - uses: PyO3/maturin-action@v1
        with:
          working-directory: fluss-rust/bindings/python
          command: sdist
          args: -o dist

      - name: Upload sdist
        uses: actions/upload-artifact@v7
        with:
          name: wheels-sdist
          path: fluss-rust/bindings/python/dist

  wheels:
    runs-on: ${{ matrix.os }}
    needs: [version-check]
    strategy:
      matrix:
        include:
          - { os: windows-latest, license-target: "x86_64-pc-windows-msvc" }
          - { os: macos-15-intel, target: "x86_64-apple-darwin", license-target: "x86_64-apple-darwin" }
          - { os: macos-15, target: "aarch64-apple-darwin", license-target: "aarch64-apple-darwin" }
          - { os: ubuntu-latest, target: "x86_64", license-target: "x86_64-unknown-linux-gnu" }
          - { os: ubuntu-latest, target: "aarch64", manylinux: "manylinux_2_28", license-target: "aarch64-unknown-linux-gnu" }
    steps:
      - uses: actions/checkout@v6
      - name: Set Python release version
        shell: bash
        env:
          RELEASE_TAG: ${{ github.ref_name }}
        run: python tools/releasing/set_python_release_version.py "$RELEASE_TAG"

      - uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4
        with:
          toolchain: stable

      - name: Generate licenses for this wheel target
        run: python fluss-rust/bindings/python/generate_binary_license.py --target "${{ matrix.license-target }}"

      - uses: PyO3/maturin-action@v1
        with:
          working-directory: fluss-rust/bindings/python
          target: ${{ matrix.target }}
          command: build
          args: --locked --release -o dist -i python3.9
          manylinux: ${{ matrix.manylinux || 'auto' }}
      - uses: PyO3/maturin-action@v1
        with:
          working-directory: fluss-rust/bindings/python
          target: ${{ matrix.target }}
          command: build
          args: --locked --release -o dist -i python3.10
          manylinux: ${{ matrix.manylinux || 'auto' }}
      - uses: PyO3/maturin-action@v1
        with:
          working-directory: fluss-rust/bindings/python
          target: ${{ matrix.target }}
          command: build
          args: --locked --release -o dist -i python3.11
          manylinux: ${{ matrix.manylinux || 'auto' }}
      - uses: PyO3/maturin-action@v1
        with:
          working-directory: fluss-rust/bindings/python
          target: ${{ matrix.target }}
          command: build
          args: --locked --release -o dist -i python3.12
          manylinux: ${{ matrix.manylinux || 'auto' }}

      - name: Upload wheels
        uses: actions/upload-artifact@v7
        with:
          name: wheels-${{ matrix.os }}-${{ matrix.target || 'native' }}
          path: |
            fluss-rust/bindings/python/dist/*.whl
            fluss-rust/bindings/python/LICENSE-bin
            fluss-rust/bindings/python/NOTICE-bin

  verify-license:
    name: Verify LICENSE and NOTICE
    runs-on: ubuntu-latest
    needs: [sdist, wheels]
    steps:
      - uses: actions/download-artifact@v8
        with:
          pattern: wheels-*
          merge-multiple: false
          path: artifacts

      # maturin ships these only when [project].license-files lists them.
      - name: Check the sdist and every wheel
        run: |
          SDIST=$(ls artifacts/wheels-sdist/*.tar.gz)
          PREFIX=$(basename "$SDIST" .tar.gz)
          for f in LICENSE NOTICE LICENSE-bin NOTICE-bin; do
            if [ -z "$(tar -xzOf "$SDIST" "${PREFIX}/${f}" 2>/dev/null)" ]; then
              echo "Error: ${f} is missing or empty at the root of ${SDIST}"
              exit 1
            fi
          done
          for whl in artifacts/wheels-*/dist/*.whl; do
            artifact_dir=$(dirname "$(dirname "$whl")")
            for f in LICENSE NOTICE LICENSE-bin NOTICE-bin; do
              if ! unzip -p "$whl" "*.dist-info/licenses/${f}" 2>/dev/null | grep . >/dev/null; then
                echo "Error: ${f} is missing or empty in ${whl}"
                exit 1
              fi
            done
            for f in LICENSE-bin NOTICE-bin; do
              if ! unzip -p "$whl" "*.dist-info/licenses/${f}" | diff -u "${artifact_dir}/${f}" -; then
                echo "Error: packaged ${f} differs from the generated file in ${whl}"
                exit 1
              fi
            done
          done

  release:
    name: Publish to PyPI
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write  # mint the short-lived PyPI/TestPyPI publish token
    needs: [version-check, sdist, wheels, verify-license]
    if: startsWith(github.ref, 'refs/tags/')
    steps:
      - uses: actions/download-artifact@v8
        with:
          pattern: wheels-*
          merge-multiple: false
          path: artifacts

      - name: Collect distributions for publishing
        run: |
          mkdir -p fluss-rust/bindings/python/dist
          cp artifacts/wheels-sdist/*.tar.gz artifacts/wheels-*/dist/*.whl fluss-rust/bindings/python/dist/

      - name: Publish to TestPyPI
        if: contains(github.ref, '-')
        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e
        with:
          repository-url: https://test.pypi.org/legacy/
          skip-existing: true
          packages-dir: fluss-rust/bindings/python/dist

      - name: Publish to PyPI
        if: ${{ !contains(github.ref, '-') }}
        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e
        with:
          skip-existing: true
          packages-dir: fluss-rust/bindings/python/dist