cd.yml

name: CD

on:
  workflow_dispatch:
  release:
    types:
      - published
  schedule:
    - cron: "0 0 * * 1"

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  FORCE_COLOR: 3
  CIBW_BUILD_FRONTEND: "build"
  CIBW_BUILD: "cp312-*"
  CIBW_SKIP: "pp* *musllinux*"

jobs:
  sdist:
    name: sdist
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
        with:
          python-version: 3.12

      - name: Build source distribution
        run: pipx run build --sdist --outdir dist/

      - uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
        with:
          name: source_distribution
          path: dist
          if-no-files-found: error

  windows_amd64_wheels:
    name: amd64-windows
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0
        with:
          go-version: "1.23.5"
          cache: false

      - name: Install MinGW compiler(s)
        run: choco install mingw

      - uses: pypa/cibuildwheel@ee63bf16da6cddfb925f542f2c7b59ad50e93969 # v2.22.0
        with:
          package-dir: .
          output-dir: wheelhouse
        env:
          CIBW_ARCHS_WINDOWS: AMD64
          CIBW_BEFORE_BUILD_WINDOWS: "pip install delvewheel"
          CIBW_REPAIR_WHEEL_COMMAND_WINDOWS: delvewheel repair -w {dest_dir} {wheel}
          CIBW_TEST_COMMAND: |
            hugo version
            hugo env --logLevel debug

      - name: Upload wheels
        uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
        with:
          name: wheels_windows_amd64
          path: ./wheelhouse/*.whl
          if-no-files-found: error

  windows_arm64_wheels: # Not tested
    name: arm64-windows
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0
        with:
          go-version: "1.23.5"
          cache: false
          check-latest: true

      - uses: mlugg/setup-zig@a67e68dc5c8281d9608136d3d7ca1b282213e4ac # v1.2.1
        with:
          version: 0.13.0
          use-cache: false

      - name: Build binary distribution (wheel) on Windows (arm64)
        # We need to use cibuildwheel because it has experimental support for cross-compiling
        # to arm64 and setup-python does not have arm64 support on Windows right now
        uses: pypa/cibuildwheel@ee63bf16da6cddfb925f542f2c7b59ad50e93969 # v2.22.0
        with:
          package-dir: .
          output-dir: wheelhouse
        # Cross-compile for arm64 target via Zig toolchain
        env:
          USE_ZIG: "1"
          GOOS: windows
          GOARCH: arm64
          CIBW_BUILD: "cp312-*"
          CIBW_ARCHS_WINDOWS: ARM64
          CIBW_BEFORE_BUILD_WINDOWS: "pip install delvewheel"
          CIBW_REPAIR_WHEEL_COMMAND_WINDOWS: delvewheel repair -w {dest_dir} {wheel}
          CIBW_TEST_SKIP: "*-win_arm64"

      - name: Upload wheels
        uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
        with:
          name: wheels_windows_arm64
          path: ./wheelhouse/*.whl
          if-no-files-found: error

  windows_i686_wheels:
    name: i686-windows
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0
        with:
          go-version: "1.23.5"
          cache: false

      - uses: mlugg/setup-zig@a67e68dc5c8281d9608136d3d7ca1b282213e4ac # v1.2.1
        with:
          version: 0.13.0

        # Note: cibuildwheel will manage installing 32-bit Python on Windows. We
        # do not need to do that manually unless we use setup-python instead.
      - name: Build binary distribution (wheel) on Windows (i686)
        uses: pypa/cibuildwheel@ee63bf16da6cddfb925f542f2c7b59ad50e93969 # v2.22.0
        with:
          package-dir: .
          output-dir: wheelhouse
        # Cross-compile for i686 target via Zig toolchain
        env:
          USE_ZIG: "1"
          GOOS: windows
          GOARCH: 386
          CIBW_BUILD: "cp312-*"
          CIBW_ARCHS_WINDOWS: x86
          CIBW_BEFORE_BUILD_WINDOWS: "pip install delvewheel"
          CIBW_REPAIR_WHEEL_COMMAND_WINDOWS: delvewheel repair -w {dest_dir} {wheel}
          CIBW_TEST_COMMAND: |
            hugo version
            hugo env --logLevel debug

      - name: Upload wheels
        uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
        with:
          name: wheels_windows_i686
          path: ./wheelhouse/*.whl
          if-no-files-found: error

  linux_amd64_wheels:
    name: amd64-manylinux
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: pypa/cibuildwheel@ee63bf16da6cddfb925f542f2c7b59ad50e93969 # v2.22.0
        with:
          package-dir: .
          output-dir: wheelhouse
        env:
          CIBW_ARCHS_LINUX: x86_64
          CIBW_BEFORE_ALL_LINUX: |
            tarball="go1.23.5.linux-amd64.tar.gz"
            curl -LJO https://golang.org/dl/$tarball
            mkdir $HOME/go_installed/
            tar -C $HOME/go_installed/ -xzf $tarball
            export PATH=$PATH:$HOME/go_installed/go/bin >> ~/.bashrc
            export PATH=$PATH:$HOME/go_installed/go/bin >> ~/.bash_profile
            go version
          CIBW_ENVIRONMENT_LINUX: PATH=$PATH:$HOME/go_installed/go/bin
          CIBW_TEST_COMMAND: |
            hugo version
            hugo env --logLevel debug

      - name: Upload wheels
        uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
        with:
          name: wheels_linux_amd64
          path: ./wheelhouse/*.whl
          if-no-files-found: error

  linux_arm64_wheels:
    name: arm64-manylinux
    runs-on: ubuntu-22.04-arm
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: pypa/cibuildwheel@ee63bf16da6cddfb925f542f2c7b59ad50e93969 # v2.22.0
        with:
          package-dir: .
          output-dir: wheelhouse
        env:
          CIBW_ARCHS_LINUX: aarch64
          CIBW_BEFORE_ALL_LINUX: |
            tarball="go1.23.5.linux-arm64.tar.gz"
            curl -LJO https://golang.org/dl/$tarball
            mkdir $HOME/go_installed/
            tar -C $HOME/go_installed/ -xzf $tarball
            export PATH=$PATH:$HOME/go_installed/go/bin >> ~/.bashrc
            export PATH=$PATH:$HOME/go_installed/go/bin >> ~/.bash_profile
            go version
          CIBW_ENVIRONMENT_LINUX: PATH=$PATH:$HOME/go_installed/go/bin
          CIBW_TEST_COMMAND: |
            hugo version
            hugo env --logLevel debug

      - name: Upload wheels
        uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
        with:
          name: wheels_linux_aarch64
          path: ./wheelhouse/*.whl
          if-no-files-found: error

  linux_s390x_wheels:
    name: s390x-manylinux
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: docker/setup-qemu-action@49b3bc8e6bdd4a60e6116a5414239cba5943d3cf # v3.2.0
        with:
          platforms: all
          # This should be temporary
          # xref https://github.com/docker/setup-qemu-action/issues/188
          # xref https://github.com/tonistiigi/binfmt/issues/215
          image: tonistiigi/binfmt:qemu-v8.1.5

      - name: Build binary distribution (wheel) on Linux (s390x)
        uses: pypa/cibuildwheel@ee63bf16da6cddfb925f542f2c7b59ad50e93969 # v2.22.0
        with:
          package-dir: .
          output-dir: wheelhouse
        env:
          CIBW_ARCHS_LINUX: s390x
          CIBW_BEFORE_ALL_LINUX: |
            tarball="go1.23.4.linux-s390x.tar.gz"
            curl -LJO https://golang.org/dl/$tarball
            mkdir $HOME/go_installed/
            tar -C $HOME/go_installed/ -xzf $tarball
            export PATH=$PATH:$HOME/go_installed/go/bin >> ~/.bashrc
            export PATH=$PATH:$HOME/go_installed/go/bin >> ~/.bash_profile
            go version
          CIBW_ENVIRONMENT_LINUX: PATH=$PATH:$HOME/go_installed/go/bin
          CIBW_TEST_COMMAND: |
            hugo version
            hugo env --logLevel debug

      - name: Upload wheels
        uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
        with:
          name: wheels_linux_s390x
          path: ./wheelhouse/*.whl
          if-no-files-found: error

  linux_ppc64le_wheels:
    name: ppc64le-manylinux
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: docker/setup-qemu-action@49b3bc8e6bdd4a60e6116a5414239cba5943d3cf # v3.2.0
        with:
          platforms: all
          # This should be temporary
          # xref https://github.com/docker/setup-qemu-action/issues/188
          # xref https://github.com/tonistiigi/binfmt/issues/215
          image: tonistiigi/binfmt:qemu-v8.1.5

      - name: Build binary distribution (wheel) on Linux (ppc64le)
        uses: pypa/cibuildwheel@ee63bf16da6cddfb925f542f2c7b59ad50e93969 # v2.22.0
        with:
          package-dir: .
          output-dir: wheelhouse
        env:
          CIBW_ARCHS_LINUX: ppc64le
          CIBW_BEFORE_ALL_LINUX: |
            tarball="go1.23.4.linux-ppc64le.tar.gz"
            curl -LJO https://golang.org/dl/$tarball
            mkdir $HOME/go_installed/
            tar -C $HOME/go_installed/ -xzf $tarball
            export PATH=$PATH:$HOME/go_installed/go/bin >> ~/.bashrc
            export PATH=$PATH:$HOME/go_installed/go/bin >> ~/.bash_profile
            go version
          CIBW_ENVIRONMENT_LINUX: PATH=$PATH:$HOME/go_installed/go/bin
          CIBW_TEST_COMMAND: |
            hugo version
            hugo env --logLevel debug

      - name: Upload wheels
        uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
        with:
          name: wheels_linux_ppc64le
          path: ./wheelhouse/*.whl
          if-no-files-found: error

  macos_amd64_wheels:
    name: amd64-macos
    runs-on: macos-13
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0
        with:
          go-version: "1.23.5"
          cache: false
          check-latest: true

      - uses: pypa/cibuildwheel@ee63bf16da6cddfb925f542f2c7b59ad50e93969 # v2.22.0
        with:
          package-dir: .
          output-dir: wheelhouse
        env:
          CIBW_ARCHS_MACOS: x86_64
          CIBW_TEST_COMMAND: |
            hugo version
            hugo env --logLevel debug

      - name: Upload wheels
        uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
        with:
          name: wheels_macos_x86_64
          path: ./wheelhouse/*.whl
          if-no-files-found: error

  macos_arm64_wheels:
    name: arm64-macos
    runs-on: macos-14
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0
        with:
          go-version: "1.23.5"
          cache: false
          check-latest: true

      - uses: pypa/cibuildwheel@ee63bf16da6cddfb925f542f2c7b59ad50e93969 # v2.22.0
        with:
          package-dir: .
          output-dir: wheelhouse
        env:
          CIBW_ARCHS_MACOS: arm64
          CIBW_TEST_COMMAND: |
            hugo version
            hugo env --logLevel debug

      - name: Upload wheels
        uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
        with:
          name: wheels_macos_arm64
          path: ./wheelhouse/*.whl
          if-no-files-found: error

  publish:
    needs:
      [
        sdist,
        windows_amd64_wheels,
        windows_arm64_wheels,
        windows_i686_wheels,
        macos_amd64_wheels,
        macos_arm64_wheels,
        linux_amd64_wheels,
        linux_arm64_wheels,
        linux_s390x_wheels,
        linux_ppc64le_wheels,
      ]

    name: Publish to PyPI or TestPyPI
    environment: release
    permissions:
      # Required by OIDC to publish to PyPI and by Sigstore to sign artifacts
      id-token: write
      # Required to upload artifacts to a GitHub release identifier
      contents: write
      # For GHA Attestations
      attestations: write
    runs-on: ubuntu-latest
    if: github.event_name == 'release' && github.event.action == 'published'

    steps:
      - name: Download all artifacts
        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
        with:
          path: upload/
          merge-multiple: true

      - uses: pypa/gh-action-pypi-publish@67339c736fd9354cd4f8cb0b744f2b82a74b5c70 # v1.12.3
        if: github.event_name == 'release' && github.event.action == 'published'
        with:
          # Comment this line out to publish to PyPI
          # repository-url: https://test.pypi.org/legacy/
          packages-dir: upload

      - name: Sign artifacts with Sigstore
        uses: sigstore/gh-action-sigstore-python@f514d46b907ebcd5bedc05145c03b69c1edd8b46 # v3.0.0
        with:
          inputs: >-
            ./upload/*.whl
            ./upload/*.tar.gz

      - name: Generate artifact attestation(s)
        uses: actions/attest-build-provenance@7668571508540a607bdfd90a87a560489fe372eb # v2.1.0
        with:
          subject-path: |
            upload/*.whl
            upload/*.tar.gz

      - name: Publish to GitHub Releases
        # Wait for https://github.com/softprops/action-gh-release/issues/556 to be resolved
        # before bumping to v2.2.0.
        uses: softprops/action-gh-release@01570a1f39cb168c169c802c3bceb9e93fb10974 # v2.1.0
        if: github.event_name == 'release' && github.event.action == 'published'
        with:
          # This will contain not only the wheel and sdist, but also the signature files
          # generated by the Sigstore action
          files: upload/*