name: Publish_py on: [ workflow_dispatch ] permissions: contents: read jobs: pypi_publish: name: Publish (pypi.org) runs-on: ubuntu-latest env: CARGO_HOME: ${{ github.workspace }}/.cargo RUSTUP_HOME: ${{ github.workspace }}/.rustup RUSTUP_TOOLCHAIN: stable steps: - uses: actions/checkout@v6 with: submodules: true - uses: actions/setup-python@v5 with: python-version: 3.x - name: Restore cache uses: actions/cache/restore@v4 with: path: | ~/.cache/pip ~/.cache/pip-wheel ~/.cache/sccache ~/.cache/cargo-xwin ${{ env.CARGO_HOME }} ~/.osxcross key: cache-ubuntu-maturin-cross-compile - name: Install build dependencies run: | # the stock clang on noble (18) is too old for the 2025+ MSVC STL that # cargo-xwin downloads (yvals_core.h: "error STL1000: expected Clang # 19.0.0 or newer"), so take a newer clang toolchain from apt.llvm.org. # apt.llvm.org sometimes half-publishes a new version, in which case the # unversioned meta packages become uninstallable ("clang: Depends: # clang-NN ... not installable"); so pick the newest versioned set that # actually resolves (a dry-run checks the whole dependency closure) - # nothing is hardcoded, this tracks the newest working release. sudo apt update echo "deb [trusted=yes] https://apt.llvm.org/noble/ llvm-toolchain-noble main" | sudo tee /etc/apt/sources.list.d/llvm-toolchain-noble.list >/dev/null sudo apt update sudo apt install -y build-essential cmake NEWEST="" for name in $(apt-cache search '^clang-[0-9]+$' | awk '{print $1}' | sort -rV); do v=${name#clang-} if sudo apt-get install --dry-run -y "clang-$v" "llvm-$v" "lld-$v" "libclang-$v-dev" >/dev/null 2>&1; then NEWEST=$v break fi done [ -n "$NEWEST" ] || { echo "no installable clang toolchain found in apt.llvm.org" >&2; exit 1; } echo "using clang/llvm toolchain $NEWEST" sudo apt install -y "clang-$NEWEST" "llvm-$NEWEST" "lld-$NEWEST" "libclang-$NEWEST-dev" # expose the toolchain's own bin/lib dirs (clang, clang-cl, lld-link, # llvm-lib, libclang) to the later steps echo "LLVM_BIN=/usr/lib/llvm-$NEWEST/bin" >> "$GITHUB_ENV" echo "LIBCLANG_PATH=/usr/lib/llvm-$NEWEST/lib" >> "$GITHUB_ENV" export PATH="/usr/lib/llvm-$NEWEST/bin:$PATH" clang --version | head -1 command -v clang clang-cl lld-link llvm-lib shell: bash - name: Install Rust run: | export PATH="$CARGO_HOME/bin:$PATH" if ! command -v rustup >/dev/null 2>&1; then curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y fi rustup toolchain install stable --profile minimal rustup default stable echo "$CARGO_HOME/bin" >> "$GITHUB_PATH" cargo --version shell: bash - name: Install sccache and maturin run: | python -m pip install --upgrade pip maturin ziglang cargo-zigbuild # in case an older copy was cargo-installed into the CARGO_HOME cache, # prevent it from shadowing the pip-installed one rm -f "${CARGO_HOME:?}/bin/cargo-zigbuild" || true if ! command -v sccache >/dev/null 2>&1; then cargo install sccache || pip install sccache fi shell: bash - name: Install xwin run: | if ! command -v cargo-xwin >/dev/null 2>&1; then cargo install cargo-xwin || pip install cargo-xwin cargo xwin cache xwin fi shell: bash - name: Install osxcross run: | export PATH="$HOME/.osxcross/bin:$PATH" if [ ! -d "$HOME/.osxcross/bin" ]; then wget ${{ secrets.OSXCROSS_LINK }} -O osxcross.tar.gz tar -xzf osxcross.tar.gz -C ~/ mv ~/osxcross ~/.osxcross fi shell: bash - name: Shim clang for ring's aarch64-windows build run: | # ring 0.17.14 forces a plain `clang` for its C build on # aarch64-pc-windows-msvc (its "must use Clang on Win AArch64" # workaround), while the CFLAGS injected by cargo-xwin carry # clang-cl-style `/imsvc ` pairs that plain clang rejects. # This shim rewrites them to `-I ` and execs the real clang # found further down PATH; all other invocations pass through # untouched, and tools with other names (clang-cl, lld-link) are not # affected. mkdir -p /root/ci-shims cat > /root/ci-shims/clang <<'EOF' #!/usr/bin/env bash args=() prev_imsvc=0 for a in "$@"; do if [ "$prev_imsvc" = "1" ]; then args+=("-I$a") prev_imsvc=0 continue fi case "$a" in /imsvc) prev_imsvc=1 ;; /imsvc:*) args+=("-I${a#/imsvc:}") ;; *) args+=("$a") ;; esac done self_dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd) real="" IFS=":" read -r -a _dirs <<< "$PATH" IFS="" for d in "${_dirs[@]}"; do [ "$d" = "$self_dir" ] && continue if [ -x "$d/clang" ]; then real="$d/clang"; break; fi done [ -n "$real" ] || real=/usr/bin/clang exec "$real" "${args[@]}" EOF chmod +x /root/ci-shims/clang shell: bash - name: Build wheels shell: bash run: | export PATH="$HOME/.osxcross/bin:$PATH" # LLVM_BIN and LIBCLANG_PATH were set by the "Install build # dependencies" step; put the shim (for ring's forced plain `clang`) # in front of the toolchain so clang-cl / lld-link (distinct names) # still resolve to the real toolchain export PATH="/root/ci-shims:$LLVM_BIN:$PATH" rm -rf dist maturin sdist --out dist -m ndbioimage/Cargo.toml rustup target add x86_64-apple-darwin maturin build --release --out dist --target x86_64-apple-darwin --zig --auditwheel repair -m ndbioimage/Cargo.toml rustup target add aarch64-apple-darwin maturin build --release --out dist --target aarch64-apple-darwin --zig --auditwheel repair -m ndbioimage/Cargo.toml rustup target add x86_64-unknown-linux-gnu # the x86_64-gnu build links the runner's host liblzma (lzma-sys), # which needs glibc symbols up to 2.34 - higher than the # manylinux_2_17 baseline maturin build --release --out dist --target x86_64-unknown-linux-gnu --zig --auditwheel repair --compatibility manylinux_2_34 -m ndbioimage/Cargo.toml rustup target add aarch64-unknown-linux-gnu maturin build --release --out dist --target aarch64-unknown-linux-gnu --zig --auditwheel repair --compatibility manylinux_2_34 -m ndbioimage/Cargo.toml rustup target add x86_64-unknown-linux-musl maturin build --release --out dist --target x86_64-unknown-linux-musl --zig --auditwheel repair -m ndbioimage/Cargo.toml rustup target add aarch64-unknown-linux-musl maturin build --release --out dist --target aarch64-unknown-linux-musl --zig --auditwheel repair -m ndbioimage/Cargo.toml rustup target add x86_64-pc-windows-msvc maturin build --release --out dist --target x86_64-pc-windows-msvc --auditwheel repair -m ndbioimage/Cargo.toml rustup target add aarch64-pc-windows-msvc maturin build --release --out dist --target aarch64-pc-windows-msvc --auditwheel repair -m ndbioimage/Cargo.toml - name: Store cache uses: actions/cache/save@v4 with: path: | ~/.cache/pip ~/.cache/pip-wheel ~/.cache/sccache ~/.cache/cargo-xwin ${{ env.CARGO_HOME }} ~/.osxcross key: cache-ubuntu-maturin-cross-compile - name: Publish to PyPI uses: pypa/gh-action-pypi-publish@release/v1 with: password: ${{ secrets.PYPI_API_TOKEN }} env: GITHUB_WORKFLOW_REF: 1.10.1