build-binaries.yml

# Build basedpython wheels on all platforms.
#
# Builds the combined `basedpython` wheels (each containing both the `by` and
# `buff` binaries) for PyPI. basedpython publishes wheels only — the standalone
# per-platform binary archives, install-tests, and docker image that upstream
# ruff ships are intentionally dropped (they were wired to the old `ruff` binary
# name; re-enable them by shipping `by`/`buff` once that work is done — see
# ROADMAP).
#
# Assumed to run as a subworkflow of .github/workflows/release.yml; specifically, as a local
# artifacts job within `cargo-dist`.
name: "Build binaries"

on:
  workflow_call:
    inputs:
      plan:
        required: true
        type: string
  pull_request:
    paths:
      # When we change pyproject.toml, we want to ensure that the maturin builds still work.
      - pyproject.toml
      # And when we change this workflow itself...
      - .github/workflows/build-binaries.yml
      - scripts/build_ruff_pgo.py

concurrency:
  group: build-binaries-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

permissions: {}

env:
  PACKAGE_NAME: basedpython
  PYTHON_VERSION: "3.13"
  CARGO_INCREMENTAL: 0
  CARGO_NET_RETRY: 10
  CARGO_TERM_COLOR: always
  RUSTUP_MAX_RETRIES: 10

jobs:
  sdist:
    if: ${{ !contains(github.event.pull_request.labels.*.name, 'no-build') }}
    runs-on: ${{ github.repository == 'astral-sh/ruff' && 'depot-ubuntu-24.04-4' || 'ubuntu-latest' }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          submodules: recursive
          persist-credentials: false
      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: ${{ env.PYTHON_VERSION }}
      - name: "Prep README.md"
        run: python scripts/transform_readme.py --target pypi
      - name: "Build sdist"
        uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
        with:
          maturin-version: v1.14.1
          command: sdist
          args: --out dist
      - name: "Upload sdist"
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: wheels-sdist
          path: dist

  macos-x86_64:
    if: ${{ !contains(github.event.pull_request.labels.*.name, 'no-build') }}
    runs-on: ${{ github.repository == 'astral-sh/ruff' && 'namespace-profile-macos-15' || 'macos-15' }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          submodules: recursive
          persist-credentials: false
      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: ${{ env.PYTHON_VERSION }}
          architecture: x64
      - name: "Prep README.md"
        run: python scripts/transform_readme.py --target pypi
      - name: "Build wheels - x86_64"
        uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
        with:
          maturin-version: v1.14.1
          target: x86_64
          args: --release --locked --out dist --compatibility pypi
        env:
          # Use Rust's bundled Mach-O LLD, which supports ICF.
          # ICF reduces the macOS x86_64 ruff binary size by ~1.5%.
          RUSTFLAGS: "-C linker=rust-lld -C linker-flavor=ld64.lld -C link-arg=--icf=safe"
      - name: "Upload wheels"
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: wheels-macos-x86_64
          path: dist

  macos-aarch64:
    if: ${{ !contains(github.event.pull_request.labels.*.name, 'no-build') }}
    runs-on: ${{ github.repository == 'astral-sh/ruff' && 'namespace-profile-macos-15' || 'macos-15' }}
    env:
      # Use Rust's bundled Mach-O LLD, which supports ICF.
      # ICF reduces the macOS aarch64 ruff binary size by ~0.8%.
      RUSTFLAGS: "-C linker=rust-lld -C linker-flavor=ld64.lld -C link-arg=--icf=safe"
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          submodules: recursive
          persist-credentials: false
      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: ${{ env.PYTHON_VERSION }}
          architecture: arm64
      - name: "Install LLVM profiling tools"
        run: rustup component add llvm-tools-preview
      - name: "Train PGO Ruff"
        run: |
          python scripts/build_ruff_pgo.py \
            --target aarch64-apple-darwin \
            --target-dir "${{ github.workspace }}/target/ruff-pgo" \
            --train-only
      - name: "Prep README.md"
        run: python scripts/transform_readme.py --target pypi
      - name: "Build wheels - aarch64"
        uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
        with:
          maturin-version: v1.14.1
          target: aarch64
          args: --release --locked --out dist --compatibility pypi
        env:
          RUSTFLAGS: "${{ env.RUSTFLAGS }} -Cprofile-use=${{ github.workspace }}/target/ruff-pgo/ruff.profdata"
          # Apple Clang cannot consume profile data from rustc's LLVM version.
          CFLAGS: "-fno-profile-generate -fno-profile-use"
          CXXFLAGS: "-fno-profile-generate -fno-profile-use"
      - name: "Upload wheels"
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: wheels-aarch64-apple-darwin
          path: dist

  windows:
    if: ${{ !contains(github.event.pull_request.labels.*.name, 'no-build') }}
    runs-on: ${{ github.repository == 'astral-sh/ruff' && 'namespace-profile-windows-2022-x86-64-16x32' || 'windows-latest' }}
    strategy:
      matrix:
        platform:
          - target: x86_64-pc-windows-msvc
            arch: x64
          - target: i686-pc-windows-msvc
            arch: x86
          - target: aarch64-pc-windows-msvc
            arch: x64
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          submodules: recursive
          persist-credentials: false
      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: ${{ env.PYTHON_VERSION }}
          architecture: ${{ matrix.platform.arch }}
      - name: "Install LLVM profiling tools"
        if: ${{ matrix.platform.target == 'x86_64-pc-windows-msvc' }}
        run: rustup component add llvm-tools-preview
      - name: "Train PGO Ruff"
        if: ${{ matrix.platform.target == 'x86_64-pc-windows-msvc' }}
        shell: bash
        run: |
          export RUSTFLAGS="${RUSTFLAGS:+${RUSTFLAGS} }-C target-feature=+crt-static"

          python scripts/build_ruff_pgo.py \
            --target "${{ matrix.platform.target }}" \
            --target-dir "${{ github.workspace }}/target/ruff-pgo" \
            --train-only

          echo "RUSTFLAGS=${RUSTFLAGS:+${RUSTFLAGS} }-Cprofile-use=${{ github.workspace }}/target/ruff-pgo/ruff.profdata" >> "$GITHUB_ENV"
      - name: "Prep README.md"
        run: python scripts/transform_readme.py --target pypi
      - name: "Build wheels"
        uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
        with:
          maturin-version: v1.14.1
          target: ${{ matrix.platform.target }}
          args: --release --locked --out dist --compatibility pypi
        env:
          # aarch64 build fails, see https://github.com/PyO3/maturin/issues/2110
          XWIN_VERSION: 16
      - name: "Verify static Windows runtime"
        if: ${{ matrix.platform.target == 'x86_64-pc-windows-msvc' }}
        shell: bash
        run: |
          LLVM_READOBJ="$(rustc --print sysroot)/lib/rustlib/${{ matrix.platform.target }}/bin/llvm-readobj.exe"
          IMPORTS_FILE="$RUNNER_TEMP/ruff-coff-imports.txt"
          # the wheel is built from `crates/basedpython`, which is its own cargo workspace, so
          # its binaries land beside that manifest rather than in the repository's `target`
          "$LLVM_READOBJ" --coff-imports "crates/basedpython/target/${{ matrix.platform.target }}/release/buff.exe" > "$IMPORTS_FILE"

          if grep -Eiq 'vcruntime[[:digit:]_]*\.dll|api-ms-win-crt-' "$IMPORTS_FILE"; then
            echo "Ruff must not dynamically link the Visual C++ runtime" >&2
            exit 1
          fi
      - name: "Upload wheels"
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: wheels-${{ matrix.platform.target }}
          path: dist

  linux:
    if: ${{ !contains(github.event.pull_request.labels.*.name, 'no-build') }}
    runs-on: ${{ github.repository != 'astral-sh/ruff' && 'ubuntu-latest' || (matrix.target == 'x86_64-unknown-linux-gnu' && 'depot-ubuntu-24.04-8' || 'depot-ubuntu-24.04-4') }}
    strategy:
      matrix:
        target:
          - x86_64-unknown-linux-gnu
          - i686-unknown-linux-gnu
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          submodules: recursive
          persist-credentials: false
      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: ${{ env.PYTHON_VERSION }}
          architecture: x64
      - name: "Install LLVM profiling tools"
        if: ${{ matrix.target == 'x86_64-unknown-linux-gnu' }}
        run: rustup component add llvm-tools-preview
      - name: "Train PGO Ruff"
        if: ${{ matrix.target == 'x86_64-unknown-linux-gnu' }}
        run: |
          python scripts/build_ruff_pgo.py \
            --target "${{ matrix.target }}" \
            --target-dir "${{ github.workspace }}/target/ruff-pgo" \
            --train-only

          echo "RUSTFLAGS=${RUSTFLAGS:+${RUSTFLAGS} }-Cprofile-use=${{ github.workspace }}/target/ruff-pgo/ruff.profdata" >> "$GITHUB_ENV"
      - name: "Prep README.md"
        run: python scripts/transform_readme.py --target pypi
      - name: "Build wheels"
        uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
        with:
          maturin-version: v1.14.1
          target: ${{ matrix.target }}
          manylinux: 2_17
          args: --release --locked --out dist --compatibility pypi
      - name: "Upload wheels"
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: wheels-${{ matrix.target }}
          path: dist

  # `linux-aarch64` is new from upstream and is the one job with no runner the fork can
  # reach: it asks for depot's ARM machines, which basedpython does not have, so it sits
  # queued forever rather than failing. Disabled until there is an ARM runner to give it.
  # It also carries the binary-archive steps this workflow's header says the fork drops.
  #  linux-aarch64:
  #    if: ${{ !contains(github.event.pull_request.labels.*.name, 'no-build') }}
  #    runs-on: depot-ubuntu-24.04-arm-8
  #    env:
  #      # see https://github.com/astral-sh/ruff/issues/3791
  #      # and https://github.com/gnzlbg/jemallocator/issues/170#issuecomment-1503228963
  #      JEMALLOC_SYS_WITH_LG_PAGE: "16"
  #    steps:
  #      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
  #        with:
  #          submodules: recursive
  #          persist-credentials: false
  #      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
  #        with:
  #          python-version: ${{ env.PYTHON_VERSION }}
  #      - name: "Install LLVM profiling tools"
  #        run: rustup component add llvm-tools-preview
  #      - name: "Train PGO Ruff"
  #        run: |
  #          python scripts/build_ruff_pgo.py \
  #            --target aarch64-unknown-linux-gnu \
  #            --target-dir "${{ github.workspace }}/target/ruff-pgo" \
  #            --train-only
  #
  #          echo "RUSTFLAGS=${RUSTFLAGS:+${RUSTFLAGS} }-Cprofile-use=${{ github.workspace }}/target/ruff-pgo/ruff.profdata" >> "$GITHUB_ENV"
  #      - name: "Prep README.md"
  #        run: python scripts/transform_readme.py --target pypi
  #      - name: "Build wheels"
  #        uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
  #        with:
  #          maturin-version: v1.14.1
  #          target: aarch64-unknown-linux-gnu
  #          manylinux: 2_17
  #          docker-options: -e JEMALLOC_SYS_WITH_LG_PAGE=16
  #          args: --release --locked --out dist --compatibility pypi
  #      - name: "Test wheel"
  #        run: |
  #          pip install dist/"${PACKAGE_NAME}"-*.whl --force-reinstall
  #          "${MODULE_NAME}" --help
  #          python -m "${MODULE_NAME}" --help
  #      - name: "Upload wheels"
  #        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
  #        with:
  #          name: wheels-aarch64-unknown-linux-gnu
  #          path: dist
  #      - name: "Archive binary"
  #        shell: bash
  #        run: |
  #          set -euo pipefail
  #
  #          TARGET=aarch64-unknown-linux-gnu
  #          ARCHIVE_NAME=ruff-$TARGET
  #          ARCHIVE_FILE=$ARCHIVE_NAME.tar.gz
  #
  #          mkdir -p $ARCHIVE_NAME
  #          # `crates/basedpython` is its own cargo workspace, so the wheel's binaries are there
  #          cp crates/basedpython/target/$TARGET/release/buff $ARCHIVE_NAME/buff
  #          tar czvf $ARCHIVE_FILE $ARCHIVE_NAME
  #          shasum -a 256 $ARCHIVE_FILE > $ARCHIVE_FILE.sha256
  #      - name: "Upload binary"
  #        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
  #        with:
  #          name: artifacts-aarch64-unknown-linux-gnu
  #          path: |
  #            *.tar.gz
  #            *.sha256

  linux-cross:
    if: ${{ !contains(github.event.pull_request.labels.*.name, 'no-build') }}
    runs-on: ${{ github.repository == 'astral-sh/ruff' && 'depot-ubuntu-24.04-4' || 'ubuntu-latest' }}
    strategy:
      matrix:
        platform:
          - target: armv7-unknown-linux-gnueabihf
            arch: armv7
            manylinux: 2_17
          - target: s390x-unknown-linux-gnu
            arch: s390x
            manylinux: 2_17
          - target: powerpc64le-unknown-linux-gnu
            arch: ppc64le
            manylinux: 2_17
            # see https://github.com/astral-sh/ruff/issues/10073
            maturin_docker_options: -e JEMALLOC_SYS_WITH_LG_PAGE=16
          - target: arm-unknown-linux-musleabihf
            # Use the cross container, but tag as `linux_armv6l`
            manylinux: auto
            arch: arm
          - target: riscv64gc-unknown-linux-gnu
            arch: riscv64
            # Minimum manylinux target for riscv64
            manylinux: 2_31

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          submodules: recursive
          persist-credentials: false
      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: ${{ env.PYTHON_VERSION }}
      - name: "Prep README.md"
        run: python scripts/transform_readme.py --target pypi
      - name: "Build wheels"
        uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
        with:
          maturin-version: v1.14.1
          target: ${{ matrix.platform.target }}
          manylinux: ${{ matrix.platform.manylinux }}
          docker-options: ${{ matrix.platform.maturin_docker_options }}
          args: --release --locked --out dist --compatibility pypi
      - name: "Upload wheels"
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: wheels-${{ matrix.platform.target }}
          path: dist

  musllinux:
    if: ${{ !contains(github.event.pull_request.labels.*.name, 'no-build') }}
    runs-on: ${{ github.repository == 'astral-sh/ruff' && 'depot-ubuntu-24.04-4' || 'ubuntu-latest' }}
    strategy:
      matrix:
        target:
          - x86_64-unknown-linux-musl
          - i686-unknown-linux-musl
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          submodules: recursive
          persist-credentials: false
      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: ${{ env.PYTHON_VERSION }}
          architecture: x64
      - name: "Prep README.md"
        run: python scripts/transform_readme.py --target pypi
      - name: "Build wheels"
        uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
        with:
          maturin-version: v1.14.1
          target: ${{ matrix.target }}
          manylinux: musllinux_1_2
          args: --release --locked --out dist --compatibility pypi
      - name: "Upload wheels"
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: wheels-${{ matrix.target }}
          path: dist

  musllinux-cross:
    if: ${{ !contains(github.event.pull_request.labels.*.name, 'no-build') }}
    runs-on: ${{ github.repository == 'astral-sh/ruff' && 'depot-ubuntu-24.04-4' || 'ubuntu-latest' }}
    strategy:
      matrix:
        platform:
          - target: aarch64-unknown-linux-musl
            arch: aarch64
            maturin_docker_options: -e JEMALLOC_SYS_WITH_LG_PAGE=16
          - target: armv7-unknown-linux-musleabihf
            arch: armv7

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          submodules: recursive
          persist-credentials: false
      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: ${{ env.PYTHON_VERSION }}
      - name: "Prep README.md"
        run: python scripts/transform_readme.py --target pypi
      - name: "Build wheels"
        uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
        with:
          maturin-version: v1.14.1
          target: ${{ matrix.platform.target }}
          manylinux: musllinux_1_2
          args: --release --locked --out dist --compatibility pypi
          docker-options: ${{ matrix.platform.maturin_docker_options }}
      - name: "Upload wheels"
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: wheels-${{ matrix.platform.target }}
          path: dist