name: Publish_py

on: [ workflow_dispatch ]

permissions:
  contents: read

jobs:
  pypi_publish:
    name: Publish (pypi.org)
    runs-on: ubuntu-latest
    env:
      CARGO_HOME: ${{ github.workspace }}/.cargo
      RUSTUP_HOME: ${{ github.workspace }}/.rustup
      RUSTUP_TOOLCHAIN: stable
    steps:
      - uses: actions/checkout@v6
        with:
          submodules: true
      - uses: actions/setup-python@v5
        with:
          python-version: 3.x

      - name: Restore cache
        uses: actions/cache/restore@v4
        with:
          path: |
            ~/.cache/pip
            ~/.cache/pip-wheel
            ~/.cache/sccache
            ~/.cache/cargo-xwin
            ${{ env.CARGO_HOME }}
            ~/.osxcross
          key: cache-ubuntu-maturin-cross-compile

      - name: Install llvm, cmake and clang
        run: |
          if ! command -v llvm-dlltool >/dev/null 2>&1; then
            sudo apt update
            sudo apt install -y llvm cmake build-essential libclang-dev clang
          fi
          # the stock clang on noble is 18, but the 2025+ MSVC STL bundled with
          # cargo-xwin requires clang >= 19 (yvals_core.h "error STL1000: expected
          # Clang 19.0.0 or newer"). Install a newer toolchain from apt.llvm.org so
          # its clang-cl driver, lld-link and libclang (bindgen) are all new enough.
          if ! command -v clang-24 >/dev/null 2>&1; then
            echo "deb [trusted=yes] https://apt.llvm.org/noble/ llvm-toolchain-noble main" | sudo tee /etc/apt/sources.list.d/llvm-toolchain-noble.list
            sudo apt update
            # libeigen3-dev: Eigen 3.4.0 for libczirw (see the cmake-shim step below)
            sudo apt install -y clang-24 lld-24 libclang-24-dev libeigen3-dev
          fi
        shell: bash

      - name: Install Rust
        run: |
          export PATH="$CARGO_HOME/bin:$PATH"
          if ! command -v rustup >/dev/null 2>&1; then
            curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
          fi
          rustup toolchain install stable --profile minimal
          rustup default stable
          echo "$CARGO_HOME/bin" >> "$GITHUB_PATH"
          cargo --version
        shell: bash

      - name: Install sccache and maturin
        run: |
          python -m pip install --upgrade pip
          # ziglang >= 0.17 ships a bundled libc++ that requires -D_LIBCPP_* config
          # macros only cargo-zigbuild >= 0.24.0 passes to bindgen; otherwise
          # libczirw-sys fails with "hardening.h ... _LIBCPP_ASSERTION_SEMANTIC_DEFAULT
          # is not defined". Pin the combo that is known to work.
          python -m pip install --upgrade maturin "ziglang==0.17.0" "cargo-zigbuild==0.24.0"
          # in case an older copy was cargo-installed into the CARGO_HOME cache,
          # prevent it from shadowing the pip-installed one
          rm -f "${CARGO_HOME:?}/bin/cargo-zigbuild" || true
          if ! command -v sccache >/dev/null 2>&1; then
            cargo install sccache || pip install sccache
          fi
        shell: bash

      - name: Install xwin
        run: |
          if ! command -v cargo-xwin >/dev/null 2>&1; then
            cargo install cargo-xwin || pip install cargo-xwin
            cargo xwin cache xwin
          fi
        shell: bash

      - name: Install osxcross
        run: |
          export PATH="$HOME/.osxcross/bin:$PATH"
          if [ ! -d "$HOME/.osxcross/bin" ]; then
            wget ${{ secrets.OSXCROSS_LINK }} -O osxcross.tar.gz
            tar -xzf osxcross.tar.gz -C ~/
            mv ~/osxcross ~/.osxcross
          fi

      - name: Tune the libczirw-sys cmake build (system Eigen, dynamic CRT)
        run: |
          # libczirw-sys cmake build clones Eigen3 from gitlab.com (ExternalProject);
          # that clone is flaky on this runner (it is the only git-based network step
          # left in the build). noble libeigen3-dev is the same Eigen 3.4.0 that libczi
          # pins, and libczi has an upstream option to use it - flip that option for
          # the libCZI project via CMAKE_PROJECT_INCLUDE. cmake does not read that
          # variable from the environment, so a cmake shim injects it (-D); the shim is
          # scoped to invocations that look like the libczi configure (no-op for
          # --build / --version / other uses).
          # the override also aligns the msvc CRT: libCZI forces the static runtime
          # (/MT) while the rest of the build (Rust std, cc-compiled vendored libs,
          # /defaultlib:msvcrt) is dynamic (/MD), and lld-link rejects the mix with
          # /failifmismatch:RuntimeLibrary. no effect on the non-windows builds.
          mkdir -p /root/ci-shims
          cat > /root/cm-override-libczi.cmake <<'CMAKEEOF'
          if (CMAKE_PROJECT_NAME STREQUAL "libCZI")
            set(LIBCZI_BUILD_PREFER_EXTERNALPACKAGE_EIGEN3 ON CACHE BOOL "" FORCE)
            set(LIBCZI_DO_NOT_SET_MSVC_RUNTIME_LIBRARY ON CACHE BOOL "" FORCE)
            set(CMAKE_MSVC_RUNTIME_LIBRARY "MultiThreadedDLL$<$<CONFIG:Debug>:Debug>" CACHE STRING "" FORCE)
          endif()
          CMAKEEOF
          cat > /root/ci-shims/cmake <<'SHIMEOF'
          #!/usr/bin/env bash
          case "$*" in
            --build*)
              exec /usr/bin/cmake "$@" ;;
            *libczi*)
              exec /usr/bin/cmake -DCMAKE_PROJECT_INCLUDE=/root/cm-override-libczi.cmake "$@" ;;
            *)
              exec /usr/bin/cmake "$@" ;;
          esac
          SHIMEOF
          chmod +x /root/ci-shims/cmake
          echo "--- /root/cm-override-libczi.cmake ---"
          cat /root/cm-override-libczi.cmake
          echo "--- /root/ci-shims/cmake ---"
          cat /root/ci-shims/cmake
        shell: bash

      - name: Build wheels
        env:
          # ziglang >= 0.17's bundled libc++ needs these -D_LIBCPP_* macros when
          # parsed by bindgen/libclang; cargo-zigbuild >= 0.24.0 supplies them, but
          # the runner may still resolve an older 0.23.1 — pre-set them so any
          # cargo-zigbuild version works (it appends its own flags to these)
          BINDGEN_EXTRA_CLANG_ARGS_x86_64-apple-darwin: "-D_LIBCPP_ASSERTION_SEMANTIC_DEFAULT=_LIBCPP_ASSERTION_SEMANTIC_ENFORCE -D_LIBCPP_PSTL_BACKEND_SERIAL -D_LIBCPP_HAS_VENDOR_AVAILABILITY_ANNOTATIONS=0 -D_LIBCPP_HAS_TERMINAL -D_LIBCPP_HAS_RANDOM_DEVICE -D_LIBCPP_HAS_NO_STD_MODULES -D_LIBCPP_HAS_FILESYSTEM=1"
          BINDGEN_EXTRA_CLANG_ARGS_aarch64-apple-darwin: "-D_LIBCPP_ASSERTION_SEMANTIC_DEFAULT=_LIBCPP_ASSERTION_SEMANTIC_ENFORCE -D_LIBCPP_PSTL_BACKEND_SERIAL -D_LIBCPP_HAS_VENDOR_AVAILABILITY_ANNOTATIONS=0 -D_LIBCPP_HAS_TERMINAL -D_LIBCPP_HAS_RANDOM_DEVICE -D_LIBCPP_HAS_NO_STD_MODULES -D_LIBCPP_HAS_FILESYSTEM=1"
          BINDGEN_EXTRA_CLANG_ARGS_x86_64-unknown-linux-gnu: "-D_LIBCPP_ASSERTION_SEMANTIC_DEFAULT=_LIBCPP_ASSERTION_SEMANTIC_ENFORCE -D_LIBCPP_PSTL_BACKEND_SERIAL -D_LIBCPP_HAS_VENDOR_AVAILABILITY_ANNOTATIONS=0 -D_LIBCPP_HAS_TERMINAL -D_LIBCPP_HAS_RANDOM_DEVICE -D_LIBCPP_HAS_NO_STD_MODULES -D_LIBCPP_HAS_FILESYSTEM=1"
          BINDGEN_EXTRA_CLANG_ARGS_aarch64-unknown-linux-gnu: "-D_LIBCPP_ASSERTION_SEMANTIC_DEFAULT=_LIBCPP_ASSERTION_SEMANTIC_ENFORCE -D_LIBCPP_PSTL_BACKEND_SERIAL -D_LIBCPP_HAS_VENDOR_AVAILABILITY_ANNOTATIONS=0 -D_LIBCPP_HAS_TERMINAL -D_LIBCPP_HAS_RANDOM_DEVICE -D_LIBCPP_HAS_NO_STD_MODULES -D_LIBCPP_HAS_FILESYSTEM=1"
          BINDGEN_EXTRA_CLANG_ARGS_x86_64-unknown-linux-musl: "-D_LIBCPP_ASSERTION_SEMANTIC_DEFAULT=_LIBCPP_ASSERTION_SEMANTIC_ENFORCE -D_LIBCPP_PSTL_BACKEND_SERIAL -D_LIBCPP_HAS_VENDOR_AVAILABILITY_ANNOTATIONS=0 -D_LIBCPP_HAS_TERMINAL -D_LIBCPP_HAS_RANDOM_DEVICE -D_LIBCPP_HAS_NO_STD_MODULES -D_LIBCPP_HAS_FILESYSTEM=1"
          BINDGEN_EXTRA_CLANG_ARGS_aarch64-unknown-linux-musl: "-D_LIBCPP_ASSERTION_SEMANTIC_DEFAULT=_LIBCPP_ASSERTION_SEMANTIC_ENFORCE -D_LIBCPP_PSTL_BACKEND_SERIAL -D_LIBCPP_HAS_VENDOR_AVAILABILITY_ANNOTATIONS=0 -D_LIBCPP_HAS_TERMINAL -D_LIBCPP_HAS_RANDOM_DEVICE -D_LIBCPP_HAS_NO_STD_MODULES -D_LIBCPP_HAS_FILESYSTEM=1"
        shell: bash
        run: |
          export PATH="$HOME/.osxcross/bin:$PATH"
          # put the cmake shim (system-Eigen override for libczirw) in front
          export PATH="/root/ci-shims:$PATH"
          command -v cmake
          echo "HOME=$HOME CARGO_HOME=$CARGO_HOME RUSTUP_HOME=$RUSTUP_HOME"
          command -v cargo-zigbuild || echo "cargo-zigbuild: not on PATH"
          cargo-zigbuild --version 2>&1 || true
          command -v rustup
          command -v cargo
          rustup show
          cargo --version
          rm -rf dist
          maturin sdist --out dist -m ndbioimage/Cargo.toml
          
          rustup target add x86_64-apple-darwin
          maturin build --release --out dist --target x86_64-apple-darwin --zig --auditwheel repair -m ndbioimage/Cargo.toml
          rustup target add aarch64-apple-darwin
          maturin build --release --out dist --target aarch64-apple-darwin --zig --auditwheel repair -m ndbioimage/Cargo.toml
          
          rustup target add x86_64-unknown-linux-gnu
          # the x86_64-gnu build links the runner's host liblzma (lzma-sys), which needs
          # glibc symbols up to 2.34 - higher than the default manylinux_2_17 baseline
          maturin build --release --out dist --target x86_64-unknown-linux-gnu --zig --auditwheel repair --compatibility manylinux_2_34 -m ndbioimage/Cargo.toml
          rustup target add aarch64-unknown-linux-gnu
          maturin build --release --out dist --target aarch64-unknown-linux-gnu --zig --auditwheel repair --compatibility manylinux_2_34 -m ndbioimage/Cargo.toml
          rustup target add x86_64-unknown-linux-musl
          maturin build --release --out dist --target x86_64-unknown-linux-musl --zig --auditwheel repair -m ndbioimage/Cargo.toml
          rustup target add aarch64-unknown-linux-musl
          maturin build --release --out dist --target aarch64-unknown-linux-musl --zig --auditwheel repair -m ndbioimage/Cargo.toml
          
          # cargo-xwin resolves clang-cl / lld-link through PATH and bindgen finds
          # libclang via LIBCLANG_PATH, so prefer the >=19 toolchain over the stock
          # clang-18 (rejected by the 2025+ MSVC STL with STL1000) for the msvc builds
          export PATH="/usr/lib/llvm-24/bin:$PATH"
          export LIBCLANG_PATH="/usr/lib/llvm-24/lib"
          command -v clang-cl
          clang-cl --version
          command -v lld-link
          rustup target add x86_64-pc-windows-msvc
          maturin build --release --out dist --target x86_64-pc-windows-msvc --auditwheel repair -m ndbioimage/Cargo.toml
          rustup target add aarch64-pc-windows-msvc
          maturin build --release --out dist --target aarch64-pc-windows-msvc --auditwheel repair -m ndbioimage/Cargo.toml

      - name: Store cache
        uses: actions/cache/save@v4
        with:
          path: |
            ~/.cache/pip
            ~/.cache/pip-wheel
            ~/.cache/sccache
            ~/.cache/cargo-xwin
            ${{ env.CARGO_HOME }}
            ~/.osxcross
          key: cache-ubuntu-maturin-cross-compile

      - name: Publish to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          password: ${{ secrets.PYPI_API_TOKEN }}
        env:
          GITHUB_WORKFLOW_REF: 1.10.1