python-wheels.yml

# This file is based on the version
# autogenerated by maturin v1.8.3
#
# To recreate it, run:
#
#     uv run maturin generate-ci github > .github/workflows/python-wheels.yml
#
# And merge the changes into this file.
name: Python wheels 🐍

on:
  push:
    # Run when a release tag is created,
    # and push the wheels to pypi
    tags:
      - "hugr-py-v**"
    # Run the build process on pushes to main,
    # skip the publish step
    branches:
      - main
  # Allow manual runs
  #
  # If the target is a release tag,
  # publish the wheels to pypi
  workflow_dispatch:

permissions:
  contents: read

env:
  MODULE_DIR: hugr-py
  # Pinned version for the uv package manager
  UV_VERSION: "0.9.5"
  UV_FROZEN: 1
  PYTHON_VERSION: "3.14"
  # Nightly version of rust used to build the wasm wheels
  RUST_NIGHTLY_VERSION: "nightly-2026-05-28"

jobs:
  # Check if the tag matches the package name,
  # or if the workflow is running on a non-release event.
  check-tag:
    name: Check tag and temporarily mark the release as draft
    runs-on: ubuntu-latest
    outputs:
      run: ${{ steps.check-tag.outputs.run }}
    permissions:
      # Used to mark the release as draft
      contents: write
    steps:
      - uses: actions/checkout@v7
      - name: Check tag
        id: check-tag
        run: |
          echo "run=$SHOULD_RUN" >> $GITHUB_OUTPUT
        env:
          SHOULD_RUN: ${{ github.ref_type != 'tag' || ( github.ref_type == 'tag' && startsWith(github.ref, 'refs/tags/hugr-py-v') ) }}

      - name: Temporarily mark the release as draft
        if: ${{ github.ref_type == 'tag' && startsWith(github.ref, 'refs/tags/hugr-py-v') }}
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          gh release view ${{ github.ref_name }}
          if [ $? -ne 0 ]; then
            echo "No release found for tag ${{ github.ref_name }}"
            exit 1
          fi
          # Make the GitHub release a draft until the package has been published to PyPI
          gh release edit ${{ github.ref_name }} --draft=true

  linux:
    needs: check-tag
    if: ${{ needs.check-tag.outputs.run == 'true' }}
    runs-on: ${{ matrix.platform.runner }}
    strategy:
      matrix:
        platform:
          - runner: ubuntu-latest
            target: x86_64
            manylinux: "manylinux_2_28"
          - runner: ubuntu-latest
            target: x86
            manylinux: "manylinux_2_28"
          - runner: ubuntu-latest
            target: aarch64
            manylinux: "manylinux_2_28"
          - runner: ubuntu-latest
            target: armv7
            manylinux: "manylinux_2_28"
          - runner: ubuntu-latest
            target: s390x
            manylinux: "manylinux_2_28"
          - runner: ubuntu-latest
            target: ppc64le
            manylinux: "manylinux_2_28"
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-python@v6
        with:
          python-version: "3.10"
      - name: Build wheels
        uses: PyO3/maturin-action@v1
        with:
          target: ${{ matrix.platform.target }}
          args: --profile release-py --strip --out ../dist
          sccache: "true"
          manylinux: ${{ matrix.platform.manylinux }}
          working-directory: ${{ env.MODULE_DIR }}
      - name: Build free-threaded wheels
        uses: PyO3/maturin-action@v1
        with:
          target: ${{ matrix.platform.target }}
          args: --profile release-py --strip --out ../dist -i python3.14t
          sccache: "true"
          manylinux: ${{ matrix.platform.manylinux }}
          working-directory: ${{ env.MODULE_DIR }}
      - name: Upload wheels
        uses: actions/upload-artifact@v7
        with:
          name: wheels-linux-${{ matrix.platform.target }}
          path: dist

  musllinux:
    needs: check-tag
    if: ${{ needs.check-tag.outputs.run == 'true' }}
    runs-on: ${{ matrix.platform.runner }}
    strategy:
      matrix:
        platform:
          - runner: ubuntu-latest
            target: x86_64
          - runner: ubuntu-latest
            target: x86
          - runner: ubuntu-latest
            target: aarch64
          - runner: ubuntu-latest
            target: armv7
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-python@v6
        with:
          python-version: "3.10"
      - name: Build wheels
        uses: PyO3/maturin-action@v1
        with:
          target: ${{ matrix.platform.target }}
          args: --profile release-py --strip --out ../dist
          sccache: "true"
          manylinux: musllinux_1_2
          working-directory: ${{ env.MODULE_DIR }}
      - name: Build free-threaded wheels
        uses: PyO3/maturin-action@v1
        with:
          target: ${{ matrix.platform.target }}
          args: --profile release-py --strip --out ../dist -i python3.14t
          sccache: "true"
          manylinux: musllinux_1_2
          working-directory: ${{ env.MODULE_DIR }}
      - name: Upload wheels
        uses: actions/upload-artifact@v7
        with:
          name: wheels-musllinux-${{ matrix.platform.target }}
          path: dist

  windows:
    needs: check-tag
    if: ${{ needs.check-tag.outputs.run == 'true' }}
    runs-on: ${{ matrix.platform.runner }}
    strategy:
      matrix:
        platform:
          - runner: windows-latest
            target: x64
          - runner: windows-latest
            target: x86
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-python@v6
        with:
          python-version: "3.10"
          architecture: ${{ matrix.platform.target }}
      - name: Build wheels
        uses: PyO3/maturin-action@v1
        with:
          target: ${{ matrix.platform.target }}
          args: --profile release-py --strip --out ../dist
          sccache: "true"
          working-directory: ${{ env.MODULE_DIR }}
      - name: Upload wheels
        uses: actions/upload-artifact@v7
        with:
          name: wheels-windows-${{ matrix.platform.target }}
          path: dist

  macos:
    needs: check-tag
    if: ${{ needs.check-tag.outputs.run == 'true' }}
    runs-on: ${{ matrix.platform.runner }}
    strategy:
      matrix:
        platform:
          - runner: macos-15-intel
            target: x86_64
          - runner: macos-14
            target: aarch64
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-python@v6
        with:
          python-version: "3.10"
      - name: Build wheels
        uses: PyO3/maturin-action@v1
        with:
          target: ${{ matrix.platform.target }}
          args: --profile release-py --strip --out ../dist --find-interpreter
          sccache: "true"
          working-directory: ${{ env.MODULE_DIR }}
      - name: Build free-threaded wheels
        uses: PyO3/maturin-action@v1
        with:
          target: ${{ matrix.platform.target }}
          args: --profile release-py --strip --out ../dist -i python3.14t
          sccache: "true"
          working-directory: ${{ env.MODULE_DIR }}
      - name: Upload wheels
        uses: actions/upload-artifact@v7
        with:
          name: wheels-macos-${{ matrix.platform.target }}
          path: dist

  sdist:
    needs: check-tag
    if: ${{ needs.check-tag.outputs.run == 'true' }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - name: Build sdist
        uses: PyO3/maturin-action@v1
        with:
          command: sdist
          args: --out ../dist
          working-directory: ${{ env.MODULE_DIR }}
      - name: Upload sdist
        uses: actions/upload-artifact@v7
        with:
          name: wheels-sdist
          path: dist

  wasm:
    needs: check-tag
    if: ${{ needs.check-tag.outputs.run == 'true' }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-python@v6
        with:
          python-version: ${{ env.PYTHON_VERSION }}
      - name: Install nightly Rust toolchain
        uses: dtolnay/rust-toolchain@master
        with:
          toolchain: ${{ env.RUST_NIGHTLY_VERSION }}
      - name: Add required rust targets and components
        run: |
          rustup override set ${{ env.RUST_NIGHTLY_VERSION }}
          rustup target add wasm32-unknown-emscripten
          rustup component add rust-src --toolchain ${{ env.RUST_NIGHTLY_VERSION }}-x86_64-unknown-linux-gnu
      - name: Install Node.js for emsdk
        uses: actions/setup-node@v6
        with:
          node-version: "18"
      - name: Setup emsdk manually
        # Ideally this should match both the version used by rustc and the pyodide ABI.
        # See <https://doc.rust-lang.org/beta/rustc/platform-support/wasm32-unknown-emscripten.html>
        # and <https://github.com/pyodide/pyodide/blob/main/docs/development/abi.md>
        # Pyodide `0.28` and `0.29` use 4.0.9
        # We fix a rustc version compatible with it.
        run: |
          git clone --depth 1 https://github.com/emscripten-core/emsdk.git
          cd emsdk
          ./emsdk install 5.0.3
          ./emsdk activate 5.0.3
      - name: Set up uv
        uses: astral-sh/setup-uv@v7
        with:
          version: ${{ env.UV_VERSION }}
          enable-cache: true

      # Emscripten's ABI is unstable, so we pass `-Zbuild-std` to rebuild Rust
      # std with the specific emscripten version we are using, as indicated in
      # <https://doc.rust-lang.org/beta/rustc/platform-support/wasm32-unknown-emscripten.html#emscripten-abi-compatibility>
      - name: Build wasm wheels
        run: |
          source ../emsdk/emsdk_env.sh
          uvx maturin build \
            -Z build-std \
            --release \
            -i python${{ env.PYTHON_VERSION }} \
            --target wasm32-unknown-emscripten \
            -o ../dist \
            -v
        working-directory: ${{ env.MODULE_DIR }}
        env:
          CARGO_BUILD_TARGET: wasm32-unknown-emscripten
          TARGET: wasm32-unknown-emscripten
          CFLAGS: -fPIC
          CXXFLAGS: -fPIC

      - name: Upload wheels
        uses: actions/upload-artifact@v7
        with:
          name: wheels-wasm-${{ matrix.platform.target }}
          path: dist

  release:
    name: Release
    runs-on: ubuntu-latest
    needs: [linux, musllinux, windows, macos, sdist, wasm]
    if: ${{ github.ref_type == 'tag' && startsWith(github.ref, 'refs/tags/hugr-py-v') }}
    permissions:
      # Use to sign the release artifacts
      id-token: write
      # Used to upload release artifacts
      contents: write
      # Used to generate artifact attestation
      attestations: write
    steps:
      - uses: actions/checkout@v7

      - name: Check if the tag has an associated release
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          gh release view ${{ github.ref_name }}
          if [ $? -ne 0 ]; then
            echo "No release found for tag ${{ github.ref_name }}"
            exit 1
          fi
      - uses: actions/download-artifact@v8
      - name: Generate artifact attestation
        uses: actions/attest@v4
        with:
          subject-path: "wheels-*/*"
      - name: Publish to PyPI
        uses: PyO3/maturin-action@v1
        env:
          MATURIN_PYPI_TOKEN: ${{ secrets.PYPI_PUBLISH }}
        with:
          command: upload
          # Pypi doesn't support wasm wheels, so we skip them here.
          args: --non-interactive --skip-existing wheels-linux-*/* wheels-musllinux-*/* wheels-windows-*/* wheels-macos-*/* wheels-sdist/*
      - name: Upload wheels to the release and un-draft it
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          # Upload wheels to the release assets
          gh release upload ${{ github.ref_name }} wheels-*/*
          # Un-draft the release on GitHub now that the package has been published to PyPI
          gh release edit ${{ github.ref_name }} --draft=false