name: CI

on:
  push:
    branches:
      - main
    tags:
      - '*'
  pull_request:
  workflow_dispatch:
  release:
    types:
      - published

permissions:
  contents: read

jobs:
  sdist:
    runs-on: ubuntu-latest
    name: sdists
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Install the latest version of uv
        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
        with:
          enable-cache: false

      - name: Make sdist (rfc3161_client)
        run: uv build --sdist

      - name: Upload sdist
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: rfc3161-sdist
          path: dist/rfc3161_client*

  linux:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        platform:
          - target: x86_64
          - target: x86
          - target: aarch64
          - target: armv7
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: 3.x

      - name: Build wheels
        uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
        with:
          target: ${{ matrix.platform.target }}
          args: --release --out dist --find-interpreter
          manylinux: auto
          before-script-linux: |
            if command -v yum 2>&1 >/dev/null
            then
              yum update
              yum install -y perl-core cpanminus devtoolset-10-libatomic-devel
              # Workaround for OpenSSL not building on Centos 7 (manylinux2014)
              # Remove once `openssl-src` builds OpenSSL > 3.3.2 by default
              # Ref: https://github.com/openssl/openssl/pull/25367#issuecomment-2327177830
              cpanm --verbose --notest install Sub::Util
            fi

      - name: Upload wheels
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: wheels-linux-${{ matrix.platform.target }}
          path: dist

  musllinux:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        platform:
          - target: x86_64
          - target: x86
          - target: aarch64
          - target: armv7
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: 3.x

      - name: Build wheels
        uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
        with:
          target: ${{ matrix.platform.target }}
          args: --release --out dist --find-interpreter
          manylinux: musllinux_1_2

      - name: Upload wheels
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: wheels-musllinux-${{ matrix.platform.target }}
          path: dist

  windows:
    needs: [sdist]
    runs-on: windows-latest
    strategy:
      fail-fast: false
      matrix:
        WINDOWS:
          - {ARCH: 'x86', WINDOWS: 'win32', RUST_TRIPLE: 'i686-pc-windows-msvc'}
          - {ARCH: 'x64', WINDOWS: 'win64', RUST_TRIPLE: 'x86_64-pc-windows-msvc'}
    name: ${{ matrix.WINDOWS.WINDOWS }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: rfc3161-sdist

      - name: Install the latest version of uv
        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
        with:
          enable-cache: false

      # We cannot use `uv python install` because it doesn't allow to install python
      # version for another architecture
      - name: Setup python
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: 3.x
          architecture: ${{ matrix.WINDOWS.ARCH }}

      - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
        with:
          toolchain: stable
          target: ${{ matrix.WINDOWS.RUST_TRIPLE }}

      - uses: dawidd6/action-download-artifact@b6e2e70617bc3265edd6dab6c906732b2f1ae151 # v21
        with:
          repo: pyca/infra
          workflow: build-windows-openssl.yml
          branch: main
          workflow_conclusion: success
          name: "openssl-${{ matrix.WINDOWS.WINDOWS }}"
          path: "C:/openssl-${{ matrix.WINDOWS.WINDOWS }}/"
          github_token: ${{ secrets.GITHUB_TOKEN }}

      - name: Configure OpenSSL
        run: |
            echo "OPENSSL_DIR=C:/openssl-${{ matrix.WINDOWS.WINDOWS }}" >> $GITHUB_ENV
            echo "OPENSSL_STATIC=1" >> $GITHUB_ENV
            echo "OPENSSL_NO_VENDOR=1" >> $GITHUB_ENV
        shell: bash

      - run: mkdir wheelhouse
      - name: Build wheel
        run: |
          uv build --wheel rfc3161*.tar.gz -o wheelhouse/
        shell: bash

      - name: Test Install
        run: uv run --with wheelhouse/rfc3161_client*.whl python -c "import rfc3161_client"
        shell: bash

      - name: Upload wheels
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: "wheels-windows-${{ matrix.WINDOWS.ARCH }}"
          path: wheelhouse

  macos:
    runs-on: ${{ matrix.platform.runner }}
    strategy:
      matrix:
        platform:
          - runner: macos-15-intel
            target: x86_64
          - runner: macos-15
            target: aarch64
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: 3.x

      - name: Build wheels
        # Build OpenSSL from source (the `vendored` Cargo feature) so the
        # wheel statically links it.
        uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
        with:
          target: ${{ matrix.platform.target }}
          args: --release --out dist --find-interpreter

      - name: Upload wheels
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: wheels-macos-${{ matrix.platform.target }}
          path: dist


  publish:
    name: Publish Python distributions to PyPI
    runs-on: ubuntu-latest
    if: github.event_name == 'release' && github.event.action == 'published'
    needs: [linux, musllinux, windows, macos, sdist]
    environment:
      name: pypi
      url: https://pypi.org/p/rfc3161-client
    permissions:
      # Used to sign the release's artifacts with sigstore-python.
      # Used to publish to PyPI with Trusted Publishing.
      id-token: write
    steps:
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          path: dist/
          merge-multiple: true

      - name: Publish distributions
        uses: pypa/gh-action-pypi-publish@ba38be9e461d3875417946c167d0b5f3d385a247 # v1.14.1
