# Based on `maturin generate-ci github`, then trimmed:
#   - runs on tags only (the generated version rebuilt every wheel on every PR)
#   - dropped linux x86/armv7/s390x/ppc64le and windows x86/aarch64 targets
# Re-add a target by copying a matrix entry; nothing else needs to change.
#
# Publishing uses PyPI trusted publishing, so there is no API token to store.
# It requires a one-time publisher registered on PyPI for this repo + release.yml.
name: Release

on:
  push:
    tags:
      - 'v*'
  workflow_dispatch:  # builds wheels without publishing, for a dry run

permissions:
  contents: read

jobs:
  linux:
    runs-on: ubuntu-22.04
    strategy:
      matrix:
        target: [x86_64, aarch64]
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-python@v6
        with:
          python-version: "3.9"
      - name: Build wheels
        uses: PyO3/maturin-action@v1
        with:
          target: ${{ matrix.target }}
          args: --release --out dist --find-interpreter
          sccache: ${{ !startsWith(github.ref, 'refs/tags/') }}
          manylinux: auto
      - uses: actions/upload-artifact@v6
        with:
          name: wheels-linux-${{ matrix.target }}
          path: dist

  macos:
    runs-on: ${{ matrix.runner }}
    strategy:
      matrix:
        include:
          - runner: macos-15-intel
            target: x86_64
          - runner: macos-latest
            target: aarch64
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-python@v6
        with:
          python-version: "3.9"
      - name: Build wheels
        uses: PyO3/maturin-action@v1
        with:
          target: ${{ matrix.target }}
          args: --release --out dist --find-interpreter
          sccache: ${{ !startsWith(github.ref, 'refs/tags/') }}
      - uses: actions/upload-artifact@v6
        with:
          name: wheels-macos-${{ matrix.target }}
          path: dist

  windows:
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-python@v6
        with:
          python-version: "3.13"
          architecture: x64
      - name: Build wheels
        uses: PyO3/maturin-action@v1
        with:
          target: x64
          args: --release --out dist --find-interpreter
          sccache: ${{ !startsWith(github.ref, 'refs/tags/') }}
      - uses: actions/upload-artifact@v6
        with:
          name: wheels-windows-x64
          path: dist

  sdist:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - name: Build sdist
        uses: PyO3/maturin-action@v1
        with:
          command: sdist
          args: --out dist
      - uses: actions/upload-artifact@v6
        with:
          name: wheels-sdist
          path: dist

  release:
    name: Release
    runs-on: ubuntu-latest
    needs: [linux, macos, windows, sdist]
    permissions:
      id-token: write     # trusted publishing + signing
      contents: write     # upload release artifacts
      attestations: write # artifact attestation
    steps:
      - uses: actions/download-artifact@v7
      - name: Generate artifact attestation
        uses: actions/attest@v4
        with:
          subject-path: 'wheels-*/*'
      - name: Install uv
        if: ${{ startsWith(github.ref, 'refs/tags/') }}
        uses: astral-sh/setup-uv@v7
      - name: Publish to PyPI
        if: ${{ startsWith(github.ref, 'refs/tags/') }}
        run: uv publish --trusted-publishing always 'wheels-*/*'