build.yml

name: Build & Smoke

on:
  pull_request:
  push:
    branches: [main]
  workflow_dispatch:

permissions:
  contents: read

jobs:
  tests:
    name: Tests
    runs-on: ubuntu-latest
    services:
      postgres:
        image: postgres:16
        env:
          POSTGRES_DB: duroxide
          POSTGRES_PASSWORD: postgres
        ports:
          - 5432:5432
        options: >-
          --health-cmd "pg_isready -U postgres -d duroxide"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
    env:
      DATABASE_URL: postgresql://postgres:postgres@localhost:5432/duroxide
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.12"
      - name: Install configured Rust toolchain
        run: |
          test -f rust-toolchain.toml
          rustup show active-toolchain
          rustc --version
      - name: Install package and test dependencies
        run: |
          python -m venv .venv
          .venv/bin/python -m pip install --upgrade pip
          .venv/bin/python -m pip install --editable ".[dev]"
      - name: Run tests
        run: .venv/bin/python -m pytest -v

  # ── macOS (ARM64 + x86_64) ─────────────────────────────────
  macos:
    runs-on: macos-latest
    strategy:
      matrix:
        target: [aarch64-apple-darwin, x86_64-apple-darwin]
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.12"
      - name: Require Rust toolchain configuration
        run: test -f rust-toolchain.toml
      - name: Build wheel
        uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
        with:
          target: ${{ matrix.target }}
          args: --release --out dist
          sccache: "true"
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: wheels-macos-${{ matrix.target }}
          path: dist/*.whl

  # ── Linux (x86_64 + aarch64, manylinux) ───────────────────
  linux:
    strategy:
      matrix:
        include:
          - os: ubuntu-latest
            target: x86_64-unknown-linux-gnu
          - os: ubuntu-24.04-arm
            target: aarch64-unknown-linux-gnu
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.12"
      - name: Require Rust toolchain configuration
        run: test -f rust-toolchain.toml
      - name: Build wheel
        uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
        with:
          target: ${{ matrix.target }}
          args: --release --out dist --interpreter python3.12
          manylinux: "2_28"
          before-script-linux: |
            # Install OpenSSL dev headers for native-tls (replaces ring/rustls)
            if command -v dnf > /dev/null; then
              dnf install -y openssl-devel pkgconfig
            elif command -v yum > /dev/null; then
              yum install -y openssl-devel pkgconfig
            elif command -v apt-get > /dev/null; then
              apt-get update && apt-get install -y libssl-dev pkg-config
            fi
            # maturin_2_28 images expose pythons at /opt/python/*/bin but not on PATH
            ln -sf /opt/python/cp312-cp312/bin/python3 /usr/local/bin/python3 || true
          sccache: "true"
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: wheels-linux-${{ matrix.target }}
          path: dist/*.whl

  # ── Windows (x86_64) ─────────────────────────────────────────
  windows:
    runs-on: windows-latest
    strategy:
      matrix:
        target: [x86_64-pc-windows-msvc]
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.12"
      - name: Require Rust toolchain configuration
        shell: bash
        run: test -f rust-toolchain.toml
      - name: Build wheel
        uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
        with:
          target: ${{ matrix.target }}
          args: --release --out dist
          sccache: "true"
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: wheels-windows-${{ matrix.target }}
          path: dist/*.whl

  # ── Source distribution ─────────────────────────────────────
  sdist:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Require Rust toolchain configuration
        run: test -f rust-toolchain.toml
      - name: Build sdist
        uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
        with:
          command: sdist
          args: --out dist
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: wheels-sdist
          path: dist/*.tar.gz

  # ── Packaging smoke: install wheel into fresh venv on real OSes ──
  smoke-local:
    name: Smoke (local) ${{ matrix.os }} py${{ matrix.python }}
    needs: [macos, linux, windows]
    env:
      PIP_ONLY_BINARY: duroxide
    strategy:
      fail-fast: false
      matrix:
        os:
          - ubuntu-latest
          - ubuntu-24.04-arm
          - macos-14       # arm64
          - macos-15-intel # x64
          - windows-latest
        python: ["3.9", "3.10", "3.11", "3.12", "3.13", "3.14"]
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: ${{ matrix.python }}
      - name: Download wheels
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          pattern: wheels-*
          merge-multiple: true
          path: wheels
      - name: List wheels
        shell: bash
        run: |
          ls -lh wheels/
          shopt -s nullglob
          wheels=(wheels/*.whl)
          if (( ${#wheels[@]} == 0 )); then
            echo "::error::No wheel artifacts found"
            exit 1
          fi
          for wheel in "${wheels[@]}"; do
            [[ "$wheel" == *-cp39-abi3-*.whl ]] || {
              echo "::error file=$wheel::Expected a cp39-abi3 wheel"
              exit 1
            }
          done
      - name: Run smoke (local wheel)
        if: runner.os != 'Windows'
        env:
          WHEEL_DIR:    ${{ github.workspace }}/wheels
          SMOKE_SCRIPT: ${{ github.workspace }}/ci/smoke/smoke.py
        run: bash ci/smoke/run-local.sh
      - name: Run smoke (local wheel, Windows)
        if: runner.os == 'Windows'
        shell: pwsh
        env:
          WHEEL_DIR:    ${{ github.workspace }}/wheels
          SMOKE_SCRIPT: ${{ github.workspace }}/ci/smoke/smoke.py
        run: pwsh ci/smoke/run-local.ps1