build-release.yml

on:
  push:
    paths-ignore: &paths-ignore
      - ".github/dependabot.yml"
      - ".github/workflows/lint.yml"
      - ".github/workflows/test.yml"
      - ".pre-commit-config.yaml"
      - ".ruff.toml"
      - "README.md"
      - "tests/**"
  pull_request:
    paths-ignore: *paths-ignore
  workflow_dispatch:
    inputs:
      git_remote:
        type: choice
        description: "Git remote to checkout"
        options:
          - python
          - savannahostrowski
          - hugovk
          - Yhg1s
          - pablogsal
          - ambv
      git_commit:
        type: string
        description: "Git commit to target for the release. Must use the full commit SHA, not the short ID"
      cpython_release:
        type: string
        description: "CPython release number (ie '3.11.5', note without the 'v' prefix)"

name: "Build release artifacts"

permissions: {}

env:
  FORCE_COLOR: 1
  # Set from inputs for workflow_dispatch, or set defaults to test push/PR events
  GIT_REMOTE: ${{ github.event.inputs.git_remote || 'python' }}
  GIT_COMMIT: ${{ github.event.inputs.git_commit || '8a8eb0b90d40f0e03f8252e9f73cad156e1caca8' }}
  CPYTHON_RELEASE: ${{ github.event.inputs.cpython_release || '3.15.0rc3' }}

jobs:
  verify-input:
    runs-on: ubuntu-24.04
    timeout-minutes: 5
    outputs:
      build-docs: ${{ steps.select-jobs.outputs.docs }}
      build-android: ${{ steps.select-jobs.outputs.android }}
      build-ios: ${{ steps.select-jobs.outputs.ios }}
    steps:
      - name: "Workflow run information"
        run: |
          echo "git_remote: $GIT_REMOTE"
          echo "git_commit: $GIT_COMMIT"
          echo "cpython_release: $CPYTHON_RELEASE"

          {
            echo "| Variable        | Value                |"
            echo "| --------------- | -------------------- |"
            echo "| git_remote      | \`$GIT_REMOTE\`      |"
            echo "| git_commit      | \`$GIT_COMMIT\`      |"
            echo "| cpython_release | \`$CPYTHON_RELEASE\` |"
          } >> "$GITHUB_STEP_SUMMARY"

      - name: "Checkout python/release-tools"
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: "Checkout ${{ env.GIT_REMOTE }}/cpython"
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          repository: "${{ env.GIT_REMOTE }}/cpython"
          ref: "v${{ env.CPYTHON_RELEASE }}"
          path: "cpython"

      - name: "Verify CPython commit matches tag"
        run: |
          tagged_commit="$(cd cpython && git rev-parse HEAD)"
          if [[ "$GIT_COMMIT" != "$tagged_commit" ]]; then
            echo "expected git commit ('$GIT_COMMIT') didn't match tagged commit ('$tagged_commit')"
            exit 1
          fi

      - name: "Setup Python"
        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
        with:
          python-version: 3.12

      - name: "Select jobs"
        id: select-jobs
        run: |
          test_flag=""
          if [[ "${{ github.event_name }}" != "workflow_dispatch" ]]; then
            test_flag="--test"
          fi
          output=$(./select_jobs.py $test_flag "$CPYTHON_RELEASE")
          echo "$output" | tee -a "$GITHUB_OUTPUT"

          {
            echo "| Job     | Enabled |"
            echo "| ------- | ------- |"
            echo "$output" | while IFS='=' read -r key value; do
              echo "| $key | $value |"
            done
          } >> "$GITHUB_STEP_SUMMARY"

  build-source:
    runs-on: ubuntu-24.04
    timeout-minutes: 15
    needs:
      - verify-input
    steps:
      - name: "Checkout python/release-tools"
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: "Checkout ${{ env.GIT_REMOTE }}/cpython"
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          repository: "${{ env.GIT_REMOTE }}/cpython"
          ref: "v${{ env.CPYTHON_RELEASE }}"
          path: "cpython"

      - name: "Setup Python"
        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
        with:
          python-version: 3.12

      - name: "Install source dependencies"
        run: |
          python -m pip install --no-deps \
            -r requirements.txt

      - name: "Build Python release artifacts"
        run: |
          cd cpython
          python ../release.py --export "$CPYTHON_RELEASE" --skip-docs

      - name: "Upload the source artifacts"
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: source
          path: |
            cpython/${{ env.CPYTHON_RELEASE }}/src

  build-docs:
    runs-on: ubuntu-24.04
    timeout-minutes: 45
    needs:
      - verify-input
    if: fromJSON(needs.verify-input.outputs.build-docs)
    steps:
      - name: "Checkout ${{ env.GIT_REMOTE }}/cpython"
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          repository: "${{ env.GIT_REMOTE }}/cpython"
          ref: "v${{ env.CPYTHON_RELEASE }}"

      - name: "Setup Python"
        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
        with:
          python-version: 3.12

      - name: "Install docs dependencies"
        run: |
          python -m pip install -r Doc/requirements.txt

      - name: "Build docs"
        env:
          SPHINXOPTS: "-j10"
        run: |
          cd Doc
          make dist-epub
          make dist-html
          make dist-texinfo
          make dist-text

      - name: "Upload the docs artifacts"
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: docs
          path: |
            Doc/dist/

  test-source:
    runs-on: ubuntu-24.04
    timeout-minutes: 60
    needs:
      - build-source
    steps:
      - name: "Download the source artifacts"
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: source

      - name: "Test Python source tarballs"
        run: |
          mkdir -p ./tmp/installation/
          cp "Python-$CPYTHON_RELEASE.tgz" ./tmp/
          cd tmp/
          tar xvf "Python-$CPYTHON_RELEASE.tgz"
          cd "Python-$CPYTHON_RELEASE"

          ./configure "--prefix=$(realpath '../installation/')"
          make -j
          make install -j

          cd ../installation
          ./bin/python3 -m test -uall -j4

  test-docs:
    runs-on: ubuntu-24.04
    timeout-minutes: 15
    needs:
      - build-docs
    steps:
      - name: "Download the docs artifacts"
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: docs

      - name: "Set up Python"
        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
        with:
          python-version: "3.x"

      - name: "Install epubcheck"
        run: python -m pip install epubcheck

      - name: "Run epubcheck"
        continue-on-error: true
        run: |
          ls -la
          epubcheck "python-$CPYTHON_RELEASE-docs.epub" &> epubcheck.txt

      - name: "Show epubcheck output"
        run: cat epubcheck.txt

      - name: "Check for fatal errors in EPUB"
        run: |
          if grep -q "^FATAL" epubcheck.txt; then
            echo "Fatal errors found in EPUB:"
            grep "^FATAL" epubcheck.txt
            exit 1
          fi
          echo "No fatal errors found in EPUB"

  build-android:
    name: build-android (${{ matrix.arch }})
    needs:
      - verify-input
    if: fromJSON(needs.verify-input.outputs.build-android)

    strategy:
      matrix:
        include:
          - arch: aarch64
            runs-on: macos-15
          - arch: x86_64
            runs-on: ubuntu-24.04

    runs-on: ${{ matrix.runs-on }}
    timeout-minutes: 60
    env:
      triplet: ${{ matrix.arch }}-linux-android
    steps:
      - name: "Checkout ${{ env.GIT_REMOTE }}/cpython"
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          repository: "${{ env.GIT_REMOTE }}/cpython"
          ref: "v${{ env.CPYTHON_RELEASE }}"

      # Python 3.15 moved the build tools to the Platforms directory. Add a
      # compatibility shim to simplify execution. Can be removed when 3.14
      # reaches EOL
      - name: Set up compatibility symlink
        run: |
          if [ ! -e Platforms/Android ]; then
            mkdir -p Platforms
            ln -s ../Android Platforms/Android
            ln -s ./android.py Android/__main__.py
          fi

      - name: Build and test
        run: python3 Platforms/Android ci --fast-ci "$triplet"

      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: ${{ env.triplet }}
          path: cross-build/${{ env.triplet }}/dist/*
          if-no-files-found: error

  build-ios:
    name: build-iOS
    needs:
      - verify-input
    if: fromJSON(needs.verify-input.outputs.build-ios)
    runs-on: macos-26
    timeout-minutes: 60
    steps:
      - name: "Checkout ${{ env.GIT_REMOTE }}/cpython"
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          repository: "${{ env.GIT_REMOTE }}/cpython"
          ref: "v${{ env.CPYTHON_RELEASE }}"

      - name: Build and test
        run: python3 Platforms/Apple ci iOS --slow-ci

      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: ios
          path: cross-build/dist/*
          if-no-files-found: error