murk-cli 0.10.1

Encrypted secrets manager for developers — one file, age encryption, git-friendly
Documentation
name: Python

on:
  push:
    tags: ["v*"]
  pull_request:
    paths:
      - "src/python.rs"
      - "python/**"
      - "pyproject.toml"
      - "murk.pyi"
      - "Cargo.toml"
      - ".github/workflows/python.yaml"

permissions:
  contents: read

env:
  PYO3_USE_ABI3_FORWARD_COMPATIBILITY: "1"

jobs:
  lint:
    name: Lint
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: astral-sh/ruff-action@278981a28ce3188b1e39527901f38254bf3aac89 # v4.1.0
        with:
          src: python/

  test:
    name: Test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: dtolnay/rust-toolchain@631a55b12751854ce901bb631d5902ceb48146f7 # stable
      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2

      - name: Build release binary (for test fixture)
        run: cargo build --release

      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0

      - name: Install and test
        run: |
          uv venv
          source .venv/bin/activate
          uv pip install maturin pytest
          maturin develop --features python
          pytest python/tests -v

  wheels:
    name: Build wheels (${{ matrix.os }}, ${{ matrix.target }})
    needs: [lint, test]
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            target: x86_64
          - os: ubuntu-latest
            target: aarch64
            manylinux: manylinux_2_28
          - os: macos-14
            target: x86_64
          - os: macos-latest
            target: aarch64
          - os: windows-latest
            target: x64
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.12"

      - name: Set up QEMU
        if: runner.os == 'Linux' && matrix.target == 'aarch64'
        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v3
        with:
          platforms: arm64

      - name: Build wheels
        uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1
        env:
          PYO3_USE_ABI3_FORWARD_COMPATIBILITY: "1"
        with:
          target: ${{ matrix.target }}
          args: --release --out dist --features python -i python3.12
          manylinux: ${{ matrix.manylinux || 'auto' }}
          docker-options: -e PYO3_USE_ABI3_FORWARD_COMPATIBILITY=1

      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: wheels-${{ matrix.os }}-${{ matrix.target }}
          path: dist/

  sdist:
    name: Build sdist
    needs: [lint, test]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Build sdist
        uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1
        with:
          command: sdist
          args: --out dist

      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: wheels-sdist
          path: dist/

  verify-wheel:
    name: Verify abi3 wheel imports on 3.13
    needs: wheels
    runs-on: ubuntu-latest
    steps:
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: wheels-ubuntu-latest-x86_64
          path: dist/
      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.13"
      - name: Install wheel and import
        run: |
          python -m pip install dist/*.whl
          python -c "import murk; print('abi3 wheel imports on', __import__('sys').version.split()[0]); assert isinstance(murk.has_identity(), bool)"

  publish:
    name: Publish to PyPI
    if: startsWith(github.ref, 'refs/tags/v')
    needs: [wheels, sdist, verify-wheel]
    runs-on: ubuntu-latest
    permissions:
      id-token: write
    steps:
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          pattern: wheels-*
          merge-multiple: true
          path: dist/

      - name: Publish to PyPI
        uses: pypa/gh-action-pypi-publish@ba38be9e461d3875417946c167d0b5f3d385a247 # release/v1
        with:
          attestations: true
          skip-existing: true