build.yml

name: "release"
permissions: {contents: read}

on: {
    "push": {
        "branches": ["release"],
    }
}

jobs: {
    build: {
        "runs-on": "ubuntu-latest",
        "strategy": {
            "fail-fast": false,
            "matrix": {
                "architecture": ["x86_64", "x86"],
                "version": ["3.15", "3.14", "3.13", "3.12", "3.11", "3.10", "2.7",
                            "3.15t", "3.14t", "3.13t"],
            },
        },
        "continue-on-error": "${{ startsWith(matrix.version, '3.15') }}",
        "steps": [
            {
                "name": "Checkout code",
                "uses": "actions/checkout@v4",
            },
            {
                "name": "Set up Docker Buildx",
                "uses": "docker/setup-buildx-action@v3",
            },
            {
                "name": "Build docker image (with GHA layer cache)",
                "uses": "docker/build-push-action@v6",
                "with": {
                    "context": ".",
                    "file": "./${{ matrix.version }}/${{ matrix.architecture }}/Dockerfile",
                    "tags": "release-${{ github.ref_name }}:${{ matrix.version }}-${{ matrix.architecture }}",
                    "load": true,
                    "cache-from": "type=gha,scope=deplibs-${{ matrix.architecture }}-${{ matrix.version }}",
                    "cache-to": "type=gha,mode=max,scope=deplibs-${{ matrix.architecture }}-${{ matrix.version }}",
                },
            },
            {
                "name": "pip version",
                "run": "docker run --rm release-${{ github.ref_name }}:${{ matrix.version }}-${{ matrix.architecture }} /opt/python/bin/pip --version",
            },
            {
                "name": "Cross-version stdlib smoke",
                "run": "docker run --rm \
                    -v \"${{ github.workspace }}/ci/smoke_stdlib.py:/tmp/smoke_stdlib.py:ro\" \
                    release-${{ github.ref_name }}:${{ matrix.version }}-${{ matrix.architecture }} \
                    /opt/python/bin/python /tmp/smoke_stdlib.py",
            },
            {
                "name": "psutil compatibility smoke test (GIL Py3 only)",
                "if": "matrix.version != '2.7' && !endsWith(matrix.version, 't')",
                # x86 (i686) is soft-fail: PyPI ships no musllinux_1_2_i686
                # wheel for psutil, so pip falls back to source build inside
                # the final debian:latest image, uses the container's glibc
                # gcc, and produces a glibc-linked .so that fails to load in
                # our musl Python with `Error relocating ...: __sched_cpualloc:
                # symbol not found`. x86_64 is unaffected (musllinux_1_2_x86_64
                # wheel exists, our musl tag hook picks it).
                #
                # TODO(musl-toolchain): ship the /opt/musl cross-toolchain into
                # the final image under /opt/python/musl, then patch sysconfig
                # CC/CXX/LDSHARED to @STANDALONE_PYTHON_PREFIX@/musl/bin/
                # <arch>-linux-musl-gcc via the existing sentinel mechanism.
                # That lets pip source-build any package against our shipped
                # musl on both archs, removing the need for this soft-fail and
                # delivering a properly self-contained standalone Python.
                # Tracked as: ship-musl-cross-toolchain.
                "continue-on-error": "${{ matrix.architecture == 'x86' }}",
                "run": "docker run --rm \
                    -v \"${{ github.workspace }}/ci/smoke_psutil.py:/tmp/smoke_psutil.py:ro\" \
                    release-${{ github.ref_name }}:${{ matrix.version }}-${{ matrix.architecture }} \
                    sh -c 'apt-get update -y && apt-get install -y build-essential && /opt/python/bin/pip install --quiet --no-cache-dir psutil && /opt/python/bin/python /tmp/smoke_psutil.py'",
            },
            {
                "name": "tkinter smoke test (non-blocking — see TODO in build_tk.sh)",
                "continue-on-error": true,
                "run": "docker run --rm \
                    -v \"${{ github.workspace }}/ci/smoke_tkinter.py:/tmp/smoke_tkinter.py:ro\" \
                    release-${{ github.ref_name }}:${{ matrix.version }}-${{ matrix.architecture }} \
                    /opt/python/bin/python /tmp/smoke_tkinter.py",
            },
            {
                "name": "Save docker image as tar file",
                "run": "docker save release-${{ github.ref_name }}:${{ matrix.version }}-${{ matrix.architecture }} > release-${{ matrix.version }}-${{ matrix.architecture }}.tar",
            },
            {
                "name": "Figure out the /opt/python directory from the tar file",
                "run": "./ci/packing_release_tar.sh release-${{ matrix.version }}-${{ matrix.architecture }}.tar",
            },
            {
                "name": "Gzip to save space",
                "run": "sudo apt-get install gzip -y && gzip -9 build/release-${{ matrix.version }}-${{ matrix.architecture }}.tar",
            },
            {
                "name": "Release the tar file to artifacts",
                "uses": "actions/upload-artifact@v4",
                "with": {
                    "name": "release-${{ matrix.version }}-${{ matrix.architecture }}.tar.gz",
                    "path": "build/release-${{ matrix.version }}-${{ matrix.architecture }}.tar.gz",
                },
            },
        ],
    },
    release: {
        permissions: {contents: write},
        "runs-on": "ubuntu-latest",
        "needs": "build",
        "steps": [
            {
                "name": "Checkout code",
                "uses": "actions/checkout@v4",
            },
            {
                "name": "Create release tag",
                "run": "git config --local user.email 'ci@scc-net.tw' && \
                    git config --local user.name 'CI' && \
                    echo release-$(date '+%Y-%m-%d') > .release_tag && \
                    git tag $(cat .release_tag) && \
                    git push origin --tags",
                "env": {
                    "GITHUB_TOKEN": "${{ secrets.GITHUB_TOKEN }}",
                },
            },
            {
                # Without a pattern, download-artifact@v4 pulls everything in
                # the run — including the `*.dockerbuild` metadata artifacts
                # that docker/build-push-action@v6 auto-uploads per build
                # (20 of them at matrix fan-out). Those aren't release
                # payloads, and one flaky download in that set will fail the
                # entire step after 5 retries, blocking the release. Filter
                # to our own tarballs; ncipollo/release-action below only
                # globs `artifacts/*/*.tar.gz` anyway.
                "name": "Download release tar files",
                "uses": "actions/download-artifact@v4",
                "with": {
                    "path": "artifacts/",
                    "pattern": "release-*.tar.gz",
                },
            },
            {   "name": "Set env TAG_NAME",
                "run": "echo ::set-env name=TAG_NAME::$(cat .release_tag)",
                "env": {
                    "ACTIONS_ALLOW_UNSECURE_COMMANDS": "true",
                },
            },
            {
                "name": "Create GitHub release",
                "uses": ncipollo/release-action@v1,
                "with": {
                    "tag": "${{ env.TAG_NAME }}",
                    "artifacts": "artifacts/*/*.tar.gz",
                },
                "env": {
                    "GITHUB_TOKEN": "${{ secrets.GITHUB_TOKEN }}",
                    "TAG_NAME": "${{ env.TAG_NAME }}",
                },
            },
        ]
    }
}