wheel-builder.yml

# This is based on pyca/cryptography but we use cibuildwheel
# https://github.com/pyca/cryptography/blob/50ae9623df9181e5d08bbca0791ae69af4d3d446/.github/workflows/wheel-builder.yml
name: Wheel Builder

permissions:
  contents: read
on:
  workflow_dispatch:
    inputs:
      version:
        description: The Git ref to build
  # Do not add any non-tag push events without updating pypi-publish.yml. If
  # you do, it'll upload wheels to PyPI.
  push:
    tags:
      - "*"
  pull_request:
    paths:
      - .github/workflows/wheel-builder.yml
      - setup.py
      - pyproject.toml

jobs:
  sdist:
    name: Build sdist
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
        with:
          # The tag to build or the tag received by the tag event
          ref: ${{ github.event.inputs.version || github.ref }}
          persist-credentials: false

      - run: python -m venv .venv
      - name: Install Python dependencies
        run: .venv/bin/pip install -U pip build
      - name: Make sdist
        run: .venv/bin/python -m build --sdist
      - name: Set SOURCE_DATE_EPOCH to last commit for reproducible build
        run: |
          echo "SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct)"
          echo "SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct)" >> $GITHUB_ENV
      - name: Repackage using SOURCE_DATE_EPOCH
        run: |
          set -xe

          cd dist
          targzname=$(find . -type f -name '*.tar.gz' -print0 | xargs -0 realpath)
          tarname="${targzname%.gz}"
          mkdir scratch
          tar xf "$targzname" -C scratch
          # cd into scratch so we can glob all files with `*`. Other approaches
          # like `-C scratch .` adds a leading `./` to the archive names.
          pushd scratch
          tar --sort=name --mtime="@$SOURCE_DATE_EPOCH" \
            --owner=0 --group=0 --numeric-owner \
            -cf "$tarname" -- *
          popd
          gzip --no-name "$tarname"
          rm -rf scratch
      - uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
        with:
          name: sdist
          path: dist/*.tar.gz

  build_wheels:
    name: Build wheels on ${{ matrix.os }}
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-20.04, windows-2019, macos-11]

    steps:
      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
        with:
          # The tag to build or the tag received by the tag event
          ref: ${{ github.event.inputs.version || github.ref }}
          persist-credentials: false

      - name: Set SOURCE_DATE_EPOCH to last commit for reproducible build
        run: |
          echo "SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct)"
          echo "SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct)" >> $GITHUB_ENV

      - name: Build wheels
        uses: pypa/cibuildwheel@39a63b5912f086dd459cf6fcb13dcdd3fe3bc24d # v2.15.0
        env:
          CIBW_BUILD: cp311-macosx_arm64 cp311-win_amd64 cp311-manylinux_x86_64

      - uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
        with:
          name: wheels
          path: ./wheelhouse/*.whl