build-release.yml

on:
  push:
    paths-ignore:
      - ".github/dependabot.yml"
      - ".github/workflows/lint.yml"
      - ".github/workflows/test.yml"
      - ".pre-commit-config.yaml"
      - ".ruff.toml"
      - "README.md"
      - "tests/**"
  pull_request:
    paths-ignore:
      - ".github/dependabot.yml"
      - ".github/workflows/lint.yml"
      - ".github/workflows/test.yml"
      - ".pre-commit-config.yaml"
      - ".ruff.toml"
      - "README.md"
      - "tests/**"
  workflow_dispatch:
    inputs:
      git_remote:
        type: choice
        description: "Git remote to checkout"
        options:
          - python
          - savannahostrowski
          - hugovk
          - Yhg1s
          - pablogsal
          - ambv
      git_commit:
        type: string
        description: "Git commit to target for the release. Must use the full commit SHA, not the short ID"
      cpython_release:
        type: string
        description: "CPython release number (ie '3.11.5', note without the 'v' prefix)"

name: "Build release artifacts"

permissions: {}

# Set from inputs for workflow_dispatch, or set defaults to test push/PR events
env:
  GIT_REMOTE: ${{ github.event.inputs.git_remote || 'python' }}
  GIT_COMMIT: ${{ github.event.inputs.git_commit || 'df793163d5821791d4e7caf88885a2c11a107986' }}
  CPYTHON_RELEASE: ${{ github.event.inputs.cpython_release || '3.14.2' }}

jobs:
  verify-input:
    runs-on: ubuntu-24.04
    timeout-minutes: 5
    outputs:
      build-docs: ${{ steps.select-jobs.outputs.docs }}
      build-android: ${{ steps.select-jobs.outputs.android }}
    steps:
      - name: "Workflow run information"
        run: |
          echo "git_remote: $GIT_REMOTE"
          echo "git_commit: $GIT_COMMIT"
          echo "cpython_release: $CPYTHON_RELEASE"

      - name: "Checkout python/release-tools"
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: "Checkout ${{ env.GIT_REMOTE }}/cpython"
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          repository: "${{ env.GIT_REMOTE }}/cpython"
          ref: "v${{ env.CPYTHON_RELEASE }}"
          path: "cpython"

      - name: "Verify CPython commit matches tag"
        run: |
          if [[ "$GIT_COMMIT" != "$(cd cpython && git rev-parse HEAD)" ]]; then
            echo "expected git commit ('$GIT_COMMIT') didn't match tagged commit ('$(git rev-parse HEAD)')"
            exit 1
          fi

      - name: "Setup Python"
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: 3.12

      - name: "Select jobs"
        id: select-jobs
        run: |
          ./select_jobs.py "$CPYTHON_RELEASE" | tee -a "$GITHUB_OUTPUT"

  build-source:
    runs-on: ubuntu-24.04
    timeout-minutes: 15
    needs:
      - verify-input
    steps:
      - name: "Checkout python/release-tools"
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: "Checkout ${{ env.GIT_REMOTE }}/cpython"
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          repository: "${{ env.GIT_REMOTE }}/cpython"
          ref: "v${{ env.CPYTHON_RELEASE }}"
          path: "cpython"

      - name: "Setup Python"
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: 3.12

      - name: "Install source dependencies"
        run: |
          python -m pip install --no-deps \
            -r requirements.txt

      - name: "Build Python release artifacts"
        run: |
          cd cpython
          python ../release.py --export "$CPYTHON_RELEASE" --skip-docs

      - name: "Upload the source artifacts"
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          name: source
          path: |
            cpython/${{ env.CPYTHON_RELEASE }}/src

  build-docs:
    runs-on: ubuntu-24.04
    timeout-minutes: 45
    needs:
      - verify-input
    if: fromJSON(needs.verify-input.outputs.build-docs)
    steps:
      - name: "Checkout ${{ env.GIT_REMOTE }}/cpython"
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          repository: "${{ env.GIT_REMOTE }}/cpython"
          ref: "v${{ env.CPYTHON_RELEASE }}"

      - name: "Setup Python"
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: 3.12

      - name: "Install docs dependencies"
        run: |
          python -m pip install -r Doc/requirements.txt

      - name: "Build docs"
        env:
          SPHINXOPTS: "-j10"
        run: |
          cd Doc
          make dist-epub
          make dist-html
          make dist-texinfo
          make dist-text

      - name: "Upload the docs artifacts"
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        with:
          name: docs
          path: |
            Doc/dist/

  test-source:
    runs-on: ubuntu-24.04
    timeout-minutes: 60
    needs:
      - build-source
    steps:
      - name: "Download the source artifacts"
        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
        with:
          name: source

      - name: "Test Python source tarballs"
        run: |
          mkdir -p ./tmp/installation/
          cp "Python-$CPYTHON_RELEASE.tgz" ./tmp/
          cd tmp/
          tar xvf "Python-$CPYTHON_RELEASE.tgz"
          cd "Python-$CPYTHON_RELEASE"

          ./configure "--prefix=$(realpath '../installation/')"
          make -j
          make install -j

          cd ../installation
          ./bin/python3 -m test -uall -j4

  test-docs:
    runs-on: ubuntu-24.04
    timeout-minutes: 15
    needs:
      - build-docs
    steps:
      - name: "Download the docs artifacts"
        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
        with:
          name: docs

      - name: "Set up Python"
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: "3.x"

      - name: "Install epubcheck"
        run: python -m pip install epubcheck

      - name: "Run epubcheck"
        continue-on-error: true
        run: |
          ls -la
          epubcheck "python-$CPYTHON_RELEASE-docs.epub" &> epubcheck.txt

      - name: "Show epubcheck output"
        run: cat epubcheck.txt

      - name: "Check for fatal errors in EPUB"
        run: |
          if grep -q "^FATAL" epubcheck.txt; then
            echo "Fatal errors found in EPUB:"
            grep "^FATAL" epubcheck.txt
            exit 1
          fi
          echo "No fatal errors found in EPUB"

  build-android:
    name: build-android (${{ matrix.arch }})
    needs:
      - verify-input
    if: fromJSON(needs.verify-input.outputs.build-android)

    strategy:
      matrix:
        include:
          - arch: aarch64
            runs-on: macos-15
          - arch: x86_64
            runs-on: ubuntu-24.04

    runs-on: ${{ matrix.runs-on }}
    timeout-minutes: 60
    env:
      triplet: ${{ matrix.arch }}-linux-android
    steps:
      - name: "Checkout ${{ env.GIT_REMOTE }}/cpython"
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          repository: "${{ env.GIT_REMOTE }}/cpython"
          ref: "v${{ env.CPYTHON_RELEASE }}"

      - name: Build and test
        run: ./Android/android.py ci --fast-ci "$triplet"

      - uses: actions/upload-artifact@v6
        with:
          name: ${{ env.triplet }}
          path: cross-build/${{ env.triplet }}/dist/*
          if-no-files-found: error