release.yml

name: Release artifacts

on:
  push:
    branches: [main]
    paths:
      - .github/workflows/release.yml
      - pyproject.toml
      - meson.build
      - meson.options
      - README.rst
      - LICENSE
      - COPYING
      - LICENSE-THIRD-PARTY
      - ci/**
      - pele/**
      - source/**
  pull_request:
    branches: [main]
    paths:
      - .github/workflows/release.yml
      - pyproject.toml
      - meson.build
      - meson.options
      - README.rst
      - LICENSE
      - COPYING
      - LICENSE-THIRD-PARTY
      - ci/**
      - pele/**
      - source/**
  workflow_dispatch:
    inputs:
      testpypi:
        description: Publish the validated source distribution and wheels to TestPyPI
        type: boolean
        default: false
  release:
    types: [published]

permissions:
  contents: read

jobs:
  build:
    name: Source distribution
    runs-on: ubuntu-24.04
    timeout-minutes: 20
    defaults:
      run:
        shell: bash -el {0}
    steps:
      - uses: actions/checkout@v6
        with:
          persist-credentials: false
      - uses: conda-incubator/setup-miniconda@v3
        with:
          miniforge-version: latest
          activate-environment: ""
      - name: Create native dependency environment
        run: |
          conda create -y -n pele-release --override-channels -c conda-forge \
            python=3.11 pip sundials eigen blas-devel pkg-config
      - name: Verify release tag matches package version
        if: github.event_name == 'release'
        env:
          RELEASE_TAG: ${{ github.event.release.tag_name }}
        run: |
          conda activate pele-release
          python - <<'PYTHON'
          import os
          import tomllib
          from pathlib import Path

          version = tomllib.loads(Path("pyproject.toml").read_text())["project"]["version"]
          tag = os.environ["RELEASE_TAG"]
          assert tag in (version, f"v{version}"), f"Release tag {tag!r} does not match {version!r}"
          PYTHON
      - name: Build and check source distribution
        run: |
          conda activate pele-release
          python -m pip install --upgrade pip build twine
          python -m build --sdist --outdir dist \
            -Csetup-args=-Dnative=false -Csetup-args=-Dlammps=disabled -Csetup-args=-Dgui=enabled
          python -m twine check --strict dist/*.tar.gz
      - uses: actions/upload-artifact@v5
        with:
          name: pele-sdist
          path: dist/*.tar.gz
          if-no-files-found: error

  wheels:
    name: Portable wheels (${{ matrix.platform.os }}, ${{ matrix.platform.arch }}, ${{ matrix.python }})
    needs: build
    runs-on: ${{ matrix.platform.os }}
    timeout-minutes: 120
    strategy:
      fail-fast: false
      matrix:
        python: [cp311, cp312, cp313, cp314]
        platform:
          - os: ubuntu-24.04
            arch: x86_64
          - os: macos-15-intel
            arch: x86_64
          - os: macos-15
            arch: arm64
    steps:
      - uses: actions/setup-python@v6
        with:
          python-version: "3.13"
      - uses: actions/download-artifact@v6
        with:
          name: pele-sdist
          path: dist
      - name: Extract validated source archive
        run: |
          mkdir "$RUNNER_TEMP/pele-source"
          tar -xzf dist/*.tar.gz -C "$RUNNER_TEMP/pele-source" --strip-components=1
          test ! -e "$RUNNER_TEMP/pele-source/.git"
      - name: Install macOS compilers
        if: runner.os == 'macOS'
        run: |
          # Sonoma runtimes retain the macOS 14 minimum on macOS 15 runners.
          case "$(uname -m)" in
            arm64) pele_gcc_bottle_tag=arm64_sonoma; pele_gcc_bottle_sha=0f461330c058f4e9dce23dfa3942d3a6e716ad0555abf70cfff6bee4a2621ca5 ;;
            x86_64) pele_gcc_bottle_tag=sonoma; pele_gcc_bottle_sha=c5d05388d0bbd34d30cdd81a70db9d81c680712f96d4fa9a00bd7f43fc188d00 ;;
            *) exit 1 ;;
          esac
          export HOMEBREW_NO_AUTO_UPDATE=1 HOMEBREW_NO_INSTALLED_DEPENDENTS_CHECK=1 HOMEBREW_NO_INSTALL_CLEANUP=1
          pele_gcc_bottle_path="$RUNNER_TEMP/gcc@15--15.3.0.${pele_gcc_bottle_tag}.bottle.1.tar.gz"
          pele_gcc_token=$(curl --fail --silent --show-error --location --retry 3 \
            'https://ghcr.io/token?service=ghcr.io&scope=repository:homebrew/core/gcc/15:pull' \
            | python -c 'import json, sys; print(json.load(sys.stdin)["token"])')
          curl --fail --location --retry 3 --header "Authorization: Bearer $pele_gcc_token" \
            "https://ghcr.io/v2/homebrew/core/gcc/15/blobs/sha256:$pele_gcc_bottle_sha" \
            --output "$pele_gcc_bottle_path"
          unset pele_gcc_token
          test "$(shasum -a 256 "$pele_gcc_bottle_path" | awk '{print $1}')" = "$pele_gcc_bottle_sha"
          if brew list gcc@15 >/dev/null 2>&1; then brew uninstall --ignore-dependencies gcc@15; fi
          env -u HOMEBREW_FORBID_PACKAGES_FROM_PATHS HOMEBREW_DEVELOPER=1 \
            brew install --force-bottle "$pele_gcc_bottle_path"
          printf '%s\n' 'CC=clang' 'CXX=clang++' \
            "FC=$(brew --prefix gcc@15)/bin/gfortran-15" \
            "PELE_GCC_BOTTLE_SHA=$pele_gcc_bottle_sha" >> "$GITHUB_ENV"
      - name: Identify macOS native dependency build
        if: runner.os == 'macOS'
        id: native-key
        run: |
          set -euo pipefail
          {
            shasum -a 256 < "$RUNNER_TEMP/pele-source/ci/build-wheel-deps.sh"
            uname -m
            sw_vers -productVersion
            xcrun --show-sdk-path
            xcrun --show-sdk-version
            "$CC" --version
            "$CXX" --version
            "$FC" --version
            cmake --version
            printf '%s\n' '14.0' "$PELE_GCC_BOTTLE_SHA"
          } > "$RUNNER_TEMP/pele-native-build-inputs"
          pele_native_digest=$(shasum -a 256 "$RUNNER_TEMP/pele-native-build-inputs" | awk '{print $1}')
          echo "key=pele-macos-native-${{ matrix.platform.arch }}-$pele_native_digest" >> "$GITHUB_OUTPUT"
      - uses: actions/cache/restore@v5
        if: runner.os == 'macOS'
        id: native-cache
        with:
          path: /tmp/pele-wheel-deps
          key: ${{ steps.native-key.outputs.key }}
      - name: Build macOS native dependencies
        if: runner.os == 'macOS' && steps.native-cache.outputs.cache-hit != 'true'
        env:
          CONDA_PREFIX: /tmp/pele-wheel-deps
          PKG_CONFIG_PATH: /tmp/pele-wheel-deps/lib/pkgconfig
          MACOSX_DEPLOYMENT_TARGET: "14.0"
        run: |
          rm -rf /tmp/pele-wheel-deps
          bash "$RUNNER_TEMP/pele-source/ci/build-wheel-deps.sh"
      - uses: actions/cache/save@v5
        if: runner.os == 'macOS' && steps.native-cache.outputs.cache-hit != 'true'
        with:
          path: /tmp/pele-wheel-deps
          key: ${{ steps.native-key.outputs.key }}
      - name: Build, repair and test portable wheels
        env:
          CIBW_ARCHS: ${{ matrix.platform.arch }}
          CIBW_BUILD: ${{ matrix.python }}-manylinux_* ${{ matrix.python }}-macosx_*
          # Dependencies were built successfully or restored by their exact build key.
          CIBW_BEFORE_ALL_MACOS: >-
            for path in include/openblas/lapack.h include/eigen3/Eigen/Core
            lib/libopenblas.dylib lib/liblapack.dylib lib/libomp.dylib
            lib/libsundials_cvode.dylib lib/libsundials_core.dylib lib/libsundials_nvecserial.dylib;
            do test -r "/tmp/pele-wheel-deps/$path" || exit 1; done
        run: |
          python -m pip install cibuildwheel==4.3.0 twine
          cd "$RUNNER_TEMP/pele-source"
          python -m cibuildwheel . --output-dir "$GITHUB_WORKSPACE/wheelhouse"
          python -m twine check --strict "$GITHUB_WORKSPACE"/wheelhouse/*.whl
      - uses: actions/upload-artifact@v5
        with:
          name: pele-wheels-${{ matrix.platform.os }}-${{ matrix.platform.arch }}-${{ matrix.python }}
          path: wheelhouse/*.whl
          if-no-files-found: error

  publish-pypi:
    name: Publish distributions to PyPI
    if: github.event_name == 'release' && github.event.action == 'published'
    needs: [build, wheels]
    runs-on: ubuntu-24.04
    environment:
      name: pypi
      url: https://pypi.org/p/pele
    permissions:
      id-token: write
    steps:
      - uses: actions/download-artifact@v6
        with:
          pattern: pele-*
          merge-multiple: true
          path: dist
      - uses: pypa/gh-action-pypi-publish@release/v1

  publish-testpypi:
    name: Publish distributions to TestPyPI
    if: github.event_name == 'workflow_dispatch' && inputs.testpypi
    needs: [build, wheels]
    runs-on: ubuntu-24.04
    environment:
      name: testpypi
      url: https://test.pypi.org/p/pele
    permissions:
      id-token: write
    steps:
      - uses: actions/download-artifact@v6
        with:
          pattern: pele-*
          merge-multiple: true
          path: dist
      - uses: pypa/gh-action-pypi-publish@release/v1
        with:
          repository-url: https://test.pypi.org/legacy/