python-wheels.yml

# SPDX-License-Identifier: BSD-3-Clause
# Copyright (c) Contributors to the OpenEXR Project.

name: Python Wheels

on:

  # Run on all changes (PR and push) to the python binding
  # source/configuration files. Note that changes to the core library
  # will *not* trigger building the wheels. However, the main ci
  # workflow does build and test the bindings (for a single python
  # version on a single arch).
  #
  # The wheels build Boost.Python from source, pinned by
  # IMATH_BOOST_URL / IMATH_BOOST_URL_HASH in src/python/CMakeLists.txt.
  # That is the place to bump the Boost version before a release.

  push:
    paths:
      - 'cmake/**'
      - 'src/python/**'
      - 'pyproject.toml'
      - '!share/ci/**'
      - '!.github/workflows/**'
      - '.github/workflows/python-wheels.yml'
  pull_request:
    paths:
      - 'cmake/**'
      - 'src/python/**'
      - 'pyproject.toml'
      - '!share/ci/**'
      - '!.github/workflows/**'
      - '.github/workflows/python-wheels.yml'

permissions:
  contents: read

jobs:
  build_wheels:
    name: Python Wheels - ${{ matrix.target }}-${{ matrix.python }}
    runs-on: ${{ matrix.os }}
    strategy:
      # One job per (platform, Python version): 30 jobs that run in
      # parallel, so the whole run takes about as long as a single wheel
      # (~15 min) instead of five sequential builds per platform (~65 min).
      fail-fast: false
      matrix:
        python: [cp39, cp310, cp311, cp312, cp313]
        target: [linux-x64, linux-arm64, macos-x64, macos-arm64, windows-x64, windows-arm64]
        include:
          - target: linux-x64
            os: ubuntu-latest
          - target: linux-arm64
            os: ubuntu-24.04-arm
          - target: macos-x64
            os: macos-15-intel
            cibw_archs_macos: x86_64 universal2
          - target: macos-arm64
            os: macos-latest
            cibw_archs_macos: arm64
          - target: windows-x64
            os: windows-latest
            cibw_archs_windows: AMD64
          - target: windows-arm64
            os: windows-11-arm
            cibw_archs_windows: ARM64

    permissions:
      contents: read
      actions: write

    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Install Python
        if: ${{ matrix.target == 'linux-x64' && matrix.python == 'cp312' }}
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: '3.x'

      - name: Create sdist
        # Only create it once.
        if: ${{ matrix.target == 'linux-x64' && matrix.python == 'cp312' }}
        run: pipx run build==1.2.2.post1 --sdist . --outdir wheelhouse

      - name: Build wheel
        uses: pypa/cibuildwheel@e090b81e30c4d855ea63bf4b6e59204c09a101ae  # v4.2.1
        with:
          output-dir: wheelhouse
        env:
          # Split macOS arches across runners so artifact merge does not collide on filenames.
          CIBW_ARCHS_MACOS: ${{ matrix.cibw_archs_macos }}
          CIBW_ARCHS_WINDOWS: ${{ matrix.cibw_archs_windows }}
          # Build the one Python version of this matrix job (3.9 through 3.13)
          CIBW_BUILD: "${{ matrix.python }}-*"
          # Skip 32-bit wheels builds on Windows
          CIBW_SKIP: "*-win32 *_i686"

      - name: Upload artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: wheels-${{ matrix.target }}-${{ matrix.python }}
          path: |
            ./wheelhouse/*.whl
            ./wheelhouse/*.tar.gz

  verify_publish_artifacts:
    name: Verify merged wheel artifacts
    needs: build_wheels
    runs-on: ubuntu-latest

    permissions:
      contents: read
      actions: read

    steps:
      - name: Download wheel artifacts separately
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          pattern: wheels-*
          path: artifacts

      - name: Detect duplicate distribution filenames
        run: |
          set -euo pipefail

          mapfile -t dupes < <(
            find artifacts -type f \( -name '*.whl' -o -name '*.tar.gz' \) -exec basename {} \; \
              | sort \
              | uniq -d
          )

          if ((${#dupes[@]} > 0)); then
            echo "::error::Duplicate distribution filenames across build artifacts:"
            printf '  %s\n' "${dupes[@]}"
            exit 1
          fi

      - name: Download wheel artifacts (as publish does)
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          pattern: wheels-*
          merge-multiple: true
          path: dist

      - name: Verify wheel ZIP integrity
        run: |
          set -euo pipefail
          shopt -s nullglob

          wheels=(dist/*.whl)
          if ((${#wheels[@]} == 0)); then
            echo "::error::No wheels found in dist/"
            exit 1
          fi

          for wheel in "${wheels[@]}"; do
            echo "Checking $wheel"
            python3 -m zipfile -t "$wheel"
          done

      - name: Validate distribution metadata
        run: pipx run twine==6.1.0 check dist/*