v0.3.70 release

.github/workflows/build-binaries.yml

@@ -42,7 +42,12 @@ jobs:
       - uses: actions/checkout@v6
         with:
           submodules: recursive
+          persist-credentials: false
       - uses: actions-rust-lang/setup-rust-toolchain@v1.11.0
+      - name: Cache rust
+        uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32  # v2
+        with:
+          shared-key: sdist
       - uses: actions/setup-python@v6
         with:
           python-version: ${{ env.PYTHON_VERSION }}
@@ -72,6 +77,7 @@ jobs:
       - uses: actions/checkout@v6
         with:
           submodules: recursive
+          persist-credentials: false
       - name: "Install fresh upstream rustup"
         # The macos-15-arm64 runner image (20260511.0048+) ships a broken
         # Homebrew rustup whose bundled rustup-init rejects standard argv
@@ -92,6 +98,10 @@ jobs:
           # freshly-installed upstream rustup with a stale (and possibly
           # Homebrew-linked) binary from a previous run.
           cache-bin: false
+      - name: Cache rust
+        uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32  # v2
+        with:
+          shared-key: py${{ matrix.python-version }}-macos-x86_64
       - uses: actions/setup-python@v6
         with:
           python-version: ${{ matrix.python-version }}
@@ -117,6 +127,7 @@ jobs:
       - uses: actions/checkout@v6
         with:
           submodules: recursive
+          persist-credentials: false
       - name: "Install fresh upstream rustup"
         # The macos-15-arm64 runner image (20260511.0048+) ships a broken
         # Homebrew rustup whose bundled rustup-init rejects standard argv
@@ -137,6 +148,10 @@ jobs:
           # freshly-installed upstream rustup with a stale (and possibly
           # Homebrew-linked) binary from a previous run.
           cache-bin: false
+      - name: Cache rust
+        uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32  # v2
+        with:
+          shared-key: py${{ matrix.python-version }}-macos-aarch64
       - uses: actions/setup-python@v6
         with:
           python-version: ${{ matrix.python-version }}
@@ -170,7 +185,12 @@ jobs:
       - uses: actions/checkout@v6
         with:
           submodules: recursive
+          persist-credentials: false
       - uses: actions-rust-lang/setup-rust-toolchain@v1.11.0
+      - name: Cache rust
+        uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32  # v2
+        with:
+          shared-key: py${{ matrix.python-version }}-${{ matrix.platform.target }}
       - uses: actions/setup-python@v6
         with:
           python-version: ${{ matrix.python-version }}
@@ -204,16 +224,20 @@ jobs:
       - uses: actions/checkout@v6
         with:
           submodules: recursive
+          persist-credentials: false
       - uses: actions-rust-lang/setup-rust-toolchain@v1.11.0
+      - name: Cache rust
+        uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32  # v2
+        with:
+          shared-key: py${{ matrix.python-version }}-${{ matrix.platform.target }}
       - uses: actions/setup-python@v6
         with:
           python-version: ${{ matrix.python-version }}
-          architecture: x64
       - name: Build wheel
         uses: PyO3/maturin-action@v1.50.1
         with:
           target: ${{ matrix.platform.target }}
-          manylinux: auto
+          manylinux: 2_28
           args: --release --locked --out dist -i python${{ matrix.python-version }}
           before-script-linux: |
             # If we're running on rhel centos, install needed packages.
@@ -237,23 +261,24 @@ jobs:
           name: wheels-${{ matrix.platform.target }}-py${{ matrix.python-version }}
           path: dist
 
-  linux-cross:
+  linux-arm:
     if: ${{ !contains(github.event.pull_request.labels.*.name, 'no-build') }}
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04-arm
     strategy:
       matrix:
         platform:
           - target: aarch64-unknown-linux-gnu
-            arch: aarch64
-            # see https://github.com/astral-sh/ruff/issues/3791
-            # and https://github.com/gnzlbg/jemallocator/issues/170#issuecomment-1503228963
-            maturin_docker_options: -e JEMALLOC_SYS_WITH_LG_PAGE=16 -e PYO3_USE_ABI3_FORWARD_COMPATIBILITY=1
         python-version: ["3.12", "3.13", "3.14"]
     steps:
       - uses: actions/checkout@v6
         with:
           submodules: recursive
           persist-credentials: false
+      - uses: actions-rust-lang/setup-rust-toolchain@v1.11.0
+      - name: Cache rust
+        uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32  # v2
+        with:
+          shared-key: py${{ matrix.python-version }}-${{ matrix.platform.target }}
       - uses: actions/setup-python@v6
         with:
           python-version: ${{ matrix.python-version }}
@@ -262,35 +287,14 @@ jobs:
         with:
           target: ${{ matrix.platform.target }}
           manylinux: 2_28
-          docker-options: ${{ matrix.platform.maturin_docker_options }}
-          args: --release --locked --out dist -i ${{ format('python{0}', matrix.python-version) }}
-        env:
-          CARGO_REGISTRIES_CRATES_IO_PROTOCOL: sparse
-      - uses: uraimo/run-on-arch-action@v3
-        if: ${{ matrix.platform.arch != 'ppc64' && matrix.platform.arch != 'ppc64le'}}
-        name: Test wheel
-        with:
-          arch: ${{ matrix.platform.arch }}
-          distro: ubuntu24.04
-          githubToken: ${{ github.token }}
-          install: |
-            apt-get update
-            apt-get install -y software-properties-common
-            add-apt-repository ppa:deadsnakes/ppa
-            apt-get update
-            apt-get install -y --no-install-recommends ${{ format('python{0}-full', matrix.python-version) }} ${{ format('python{0}-venv', matrix.python-version) }} cargo libffi-dev
-          # Create and use a virtual environment to avoid the externally-managed-environment error
-          run: |
-            ln -s -f /usr/bin/${{ format('python{0}', matrix.python-version) }} /usr/bin/python3
-            ln -s -f /usr/bin/${{ format('pip{0}', matrix.python-version) }} /usr/bin/pip3
-            # Workaround for QEMU bug when emulating 32-bit on 64-bit hosts
-            # See: https://github.com/docker/buildx/issues/395
-            # Use /tmp for CARGO_HOME (often tmpfs, which avoids the QEMU filesystem bug)
-            export CARGO_HOME=/tmp/cargo-home
-            python3 -m venv /tmp/venv
-            . /tmp/venv/bin/activate
-            pip3 install dist/*.whl --force-reinstall
-            ${{ env.EXECUTABLE_NAME }} --help
+          args: --release --locked --out dist -i python${{ matrix.python-version }}
+      - name: Test wheel
+        if: ${{ startsWith(matrix.platform.target, 'aarch64') }}
+        run: |
+          PYTAG="cp$(python -c "import sys; print(f'{sys.version_info.major}{sys.version_info.minor}')")"
+          pip install dist/*-${PYTAG}-*.whl --force-reinstall
+          ${{ env.EXECUTABLE_NAME }} --help
+          python -m ${{ env.MODULE_NAME }} --help
       - name: Upload wheel
         uses: actions/upload-artifact@v6
         with:
@@ -309,11 +313,14 @@ jobs:
       - uses: actions/checkout@v6
         with:
           submodules: recursive
+          persist-credentials: false
       - uses: actions/setup-python@v6
         with:
           python-version: ${{ matrix.python-version }}
-      - name: Install OpenSSL
-        run: sudo apt-get update && sudo apt-get install libssl-dev openssl
+      - name: Cache rust
+        uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32  # v2
+        with:
+          shared-key: py${{ matrix.python-version }}-${{ matrix.platform.target }}
       - name: Build wheel
         uses: PyO3/maturin-action@v1.50.1
         with:
@@ -337,40 +344,41 @@ jobs:
           name: wheels-${{ matrix.platform.target }}-py${{ matrix.python-version }}
           path: dist
 
-  musllinux-cross:
+  musllinux-arm:
     if: ${{ !contains(github.event.pull_request.labels.*.name, 'no-build') }}
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04-arm
     strategy:
       matrix:
         platform:
           - target: aarch64-unknown-linux-musl
-            arch: aarch64
         python-version: ["3.12", "3.13", "3.14"]
     steps:
       - uses: actions/checkout@v6
         with:
           submodules: recursive
+          persist-credentials: false
       - uses: actions/setup-python@v6
         with:
           python-version: ${{ matrix.python-version }}
+      - name: Cache rust
+        uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32  # v2
+        with:
+          shared-key: py${{ matrix.python-version }}-${{ matrix.platform.target }}
       - name: Build wheel
         uses: PyO3/maturin-action@v1.50.1
         with:
           target: ${{ matrix.platform.target }}
           manylinux: musllinux_1_2
           args: --release --locked --out dist -i python${{ matrix.python-version }}
-      - uses: uraimo/run-on-arch-action@v2
-        name: Test wheel
-        with:
-          arch: ${{ matrix.platform.arch }}
-          distro: alpine_latest
-          githubToken: ${{ github.token }}
-          install: |
-            apk add uv rust
+      - name: Test wheel
+        if: matrix.platform.target == 'aarch64-unknown-linux-musl'
+        uses: addnab/docker-run-action@v3
+        with:
+          image: python:${{ matrix.python-version}}-alpine
+          options: -v ${{ github.workspace }}:/io -w /io
           run: |
-            uv python install ${{ matrix.python-version }} --default
-            export PATH="/root/.local/bin:$PATH"
-            python3 -m venv .venv
+            apk add rust
+            python -m venv .venv
             .venv/bin/pip3 install dist/*.whl --force-reinstall
             .venv/bin/${{ env.EXECUTABLE_NAME }} --help
       - name: Upload wheel

.github/workflows/publish-npm.yml

@@ -35,4 +35,12 @@ jobs:
         run: npm install -g npm@latest
       - name: Publish to npm
         working-directory: pkg
-        run: npm publish --access public --provenance
+        # npm refuses to publish a prerelease version without an explicit
+        # dist-tag; publish those under `next` so they never become `latest`.
+        run: |
+          VERSION="$(node -p "require('./package.json').version")"
+          if [[ "$VERSION" == *-* ]]; then
+            npm publish --access public --provenance --tag next
+          else
+            npm publish --access public --provenance
+          fi