name: Publish_py

on: [ workflow_dispatch ]

permissions:
  contents: read

jobs:
  pypi_publish:
    name: Publish (pypi.org)
    runs-on: ubuntu-latest
    env:
      CARGO_HOME: ${{ github.workspace }}/.cargo
      RUSTUP_HOME: ${{ github.workspace }}/.rustup
      RUSTUP_TOOLCHAIN: stable
    steps:
      - uses: actions/checkout@v6
        with:
          submodules: true
      - uses: actions/setup-python@v5
        with:
          python-version: 3.x

      - name: Restore cache
        uses: actions/cache/restore@v4
        with:
          path: |
            ~/.cache/pip
            ~/.cache/pip-wheel
            ~/.cache/sccache
            ~/.cache/cargo-xwin
            ${{ env.CARGO_HOME }}
            ~/.osxcross
          key: cache-ubuntu-maturin-cross-compile

      - name: Install build dependencies
        run: |
          # the stock clang on noble (18) is too old for the 2025+ MSVC STL that
          # cargo-xwin downloads (yvals_core.h: "error STL1000: expected Clang
          # 19.0.0 or newer"), so take the newest clang / lld / libclang / llvm
          # tools from apt.llvm.org (generic package names, nothing pinned)
          sudo apt update
          echo "deb [trusted=yes] https://apt.llvm.org/noble/ llvm-toolchain-noble main" | sudo tee /etc/apt/sources.list.d/llvm-toolchain-noble.list >/dev/null
          sudo apt update
          sudo apt install -y build-essential cmake clang lld libclang-dev llvm
          clang --version | head -1
          command -v clang clang-cl lld-link llvm-lib
        shell: bash

      - name: Install Rust
        run: |
          export PATH="$CARGO_HOME/bin:$PATH"
          if ! command -v rustup >/dev/null 2>&1; then
            curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
          fi
          rustup toolchain install stable --profile minimal
          rustup default stable
          echo "$CARGO_HOME/bin" >> "$GITHUB_PATH"
          cargo --version
        shell: bash

      - name: Install sccache and maturin
        run: |
          python -m pip install --upgrade pip maturin ziglang cargo-zigbuild
          # in case an older copy was cargo-installed into the CARGO_HOME cache,
          # prevent it from shadowing the pip-installed one
          rm -f "${CARGO_HOME:?}/bin/cargo-zigbuild" || true
          if ! command -v sccache >/dev/null 2>&1; then
            cargo install sccache || pip install sccache
          fi
        shell: bash

      - name: Install xwin
        run: |
          if ! command -v cargo-xwin >/dev/null 2>&1; then
            cargo install cargo-xwin || pip install cargo-xwin
            cargo xwin cache xwin
          fi
        shell: bash

      - name: Install osxcross
        run: |
          export PATH="$HOME/.osxcross/bin:$PATH"
          if [ ! -d "$HOME/.osxcross/bin" ]; then
            wget ${{ secrets.OSXCROSS_LINK }} -O osxcross.tar.gz
            tar -xzf osxcross.tar.gz -C ~/
            mv ~/osxcross ~/.osxcross
          fi
        shell: bash

      - name: Shim clang for ring's aarch64-windows build
        run: |
          # ring 0.17.14 forces a plain `clang` for its C build on
          # aarch64-pc-windows-msvc (its "must use Clang on Win AArch64"
          # workaround), while the CFLAGS injected by cargo-xwin carry
          # clang-cl-style `/imsvc <dir>` pairs that plain clang rejects.
          # This shim rewrites them to `-I <dir>` and execs the real clang
          # found further down PATH; all other invocations pass through
          # untouched, and tools with other names (clang-cl, lld-link) are not
          # affected.
          mkdir -p /root/ci-shims
          cat > /root/ci-shims/clang <<'EOF'
          #!/usr/bin/env bash
          args=()
          prev_imsvc=0
          for a in "$@"; do
            if [ "$prev_imsvc" = "1" ]; then
              args+=("-I$a")
              prev_imsvc=0
              continue
            fi
            case "$a" in
              /imsvc)   prev_imsvc=1 ;;
              /imsvc:*) args+=("-I${a#/imsvc:}") ;;
              *)        args+=("$a") ;;
            esac
          done
          self_dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
          real=""
          IFS=":" read -r -a _dirs <<< "$PATH"
          IFS=""
          for d in "${_dirs[@]}"; do
            [ "$d" = "$self_dir" ] && continue
            if [ -x "$d/clang" ]; then real="$d/clang"; break; fi
          done
          [ -n "$real" ] || real=/usr/bin/clang
          exec "$real" "${args[@]}"
          EOF
          chmod +x /root/ci-shims/clang
        shell: bash

      - name: Build wheels
        shell: bash
        run: |
          export PATH="$HOME/.osxcross/bin:$PATH"
          # the shim (for ring's forced plain `clang`) goes in front of the
          # llvm tools so clang-cl / lld-link (distinct names) still resolve to
          # the real toolchain; bindgen finds libclang via LIBCLANG_PATH
          LLVM_BIN=$(dirname "$(readlink -f "$(command -v clang)")")
          export PATH="/root/ci-shims:$LLVM_BIN:$PATH"
          export LIBCLANG_PATH="$(dirname "$LLVM_BIN")/lib"
          rm -rf dist
          maturin sdist --out dist -m ndbioimage/Cargo.toml

          rustup target add x86_64-apple-darwin
          maturin build --release --out dist --target x86_64-apple-darwin --zig --auditwheel repair -m ndbioimage/Cargo.toml
          rustup target add aarch64-apple-darwin
          maturin build --release --out dist --target aarch64-apple-darwin --zig --auditwheel repair -m ndbioimage/Cargo.toml

          rustup target add x86_64-unknown-linux-gnu
          # the x86_64-gnu build links the runner's host liblzma (lzma-sys),
          # which needs glibc symbols up to 2.34 - higher than the
          # manylinux_2_17 baseline
          maturin build --release --out dist --target x86_64-unknown-linux-gnu --zig --auditwheel repair --compatibility manylinux_2_34 -m ndbioimage/Cargo.toml
          rustup target add aarch64-unknown-linux-gnu
          maturin build --release --out dist --target aarch64-unknown-linux-gnu --zig --auditwheel repair --compatibility manylinux_2_34 -m ndbioimage/Cargo.toml
          rustup target add x86_64-unknown-linux-musl
          maturin build --release --out dist --target x86_64-unknown-linux-musl --zig --auditwheel repair -m ndbioimage/Cargo.toml
          rustup target add aarch64-unknown-linux-musl
          maturin build --release --out dist --target aarch64-unknown-linux-musl --zig --auditwheel repair -m ndbioimage/Cargo.toml

          rustup target add x86_64-pc-windows-msvc
          maturin build --release --out dist --target x86_64-pc-windows-msvc --auditwheel repair -m ndbioimage/Cargo.toml
          rustup target add aarch64-pc-windows-msvc
          maturin build --release --out dist --target aarch64-pc-windows-msvc --auditwheel repair -m ndbioimage/Cargo.toml

      - name: Store cache
        uses: actions/cache/save@v4
        with:
          path: |
            ~/.cache/pip
            ~/.cache/pip-wheel
            ~/.cache/sccache
            ~/.cache/cargo-xwin
            ${{ env.CARGO_HOME }}
            ~/.osxcross
          key: cache-ubuntu-maturin-cross-compile

      - name: Publish to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          password: ${{ secrets.PYPI_API_TOKEN }}
        env:
          GITHUB_WORKFLOW_REF: 1.10.1