name: Tests and build wheels

on: [push, pull_request]
permissions: read-all

jobs:
  black:
    name: Black Code Formatter
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - run: pip install black
      - run: >
          black
          .
          --check
          --diff

  ci:
    name: Tests ${{ matrix.os }} - Python ${{ matrix.python-version }}
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ ubuntu-latest, windows-latest, macos-latest ]
        python-version: [ '3.10', '3.11', '3.12', '3.13', '3.14', '3.15-dev' ]

    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-python@v6
        name: Install Python
        with:
          python-version: ${{ matrix.python-version }}
      - name: Build module and run pytest
        run: |
          python -m pip install --upgrade pip
          pip install --group test
          pip install . -v
          python -c "import sabctools; print('Version:', sabctools.__version__);"
          python -c "import sabctools; print('SIMD:', sabctools.simd);"
          python -c "import sabctools; print('OpenSSL linked:', sabctools.openssl_linked);"
          pytest

  build_wheels:
    name: Build wheels on ${{ matrix.os }} ${{ matrix.linux_arch }}
    needs: ci
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: windows-latest
          - os: windows-11-arm
          - os: macos-latest
          - os: ubuntu-latest
            linux_arch: x86_64
          - os: ubuntu-24.04-arm
            linux_arch: aarch64

    steps:
      - uses: actions/checkout@v7
      - name: Build wheels
        uses: pypa/cibuildwheel@v4.1.0
      - name: Upload wheel artifacts
        uses: actions/upload-artifact@v7.0.1
        with:
          path: ./wheelhouse/*.whl
          name: Wheels ${{ matrix.os }} ${{ matrix.linux_arch }}
      - name: Install Python
        uses: actions/setup-python@v6
        if: runner.os == 'macOS'
        with:
          python-version: "3.13"
      - name: Build source distribution
        if: runner.os == 'macOS'
        run: |
          pip install build
          python -m build --sdist
      - name: Upload source distribution artifact
        uses: actions/upload-artifact@v7.0.1
        if: runner.os == 'macOS'
        with:
          path: ./dist/*.tar.gz
          name: Source distribution

  publish:
    name: Publish release to PyPI
    needs: build_wheels
    runs-on: ubuntu-latest
    if: startsWith(github.ref, 'refs/tags/')
    environment: pypi
    permissions:
      id-token: write
    steps:
      - name: Download all artifacts
        uses: actions/download-artifact@v8.0.1
        with:
          path: dist/
          merge-multiple: true
      - name: Publish to PyPI
        uses: pypa/gh-action-pypi-publish@v1.14.0
        with:
          skip-existing: true

  github_release:
    name: Publish release to GitHub
    needs: build_wheels
    runs-on: ubuntu-latest
    if: startsWith(github.ref, 'refs/tags/')
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v7
      - name: Download source distribution artifact
        uses: actions/download-artifact@v8.0.1
        with:
          name: Source distribution
          path: dist/
      - name: Publish release to GitHub (gh)
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          gh release create "${{ github.ref_name }}" ./dist/*.tar.gz \
            --title "${{ github.ref_name }}" \
            --notes "Release ${{ github.ref_name }}"
