ci.yml

name: Continous integration

on:
  pull_request:
  push:
    branches:
      - develop
      - main
    tags:
      - "*"

jobs:
  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: recursive
      - name: Set up Python 3.11
        uses: actions/setup-python@v7
        with:
          python-version: "3.11"
      - name: Install tox
        run: pip install tox
      - name: Lint
        run: tox -e lint

  package-checks:
    strategy:
      matrix:
        tox_env:
          - docs
          - twine_check
    # Use the same Ubuntu release as build.os in .readthedocs.yml, so the
    # documentation is checked against the libisal that Read the Docs uses.
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: recursive
      - name: Set up Python 3.10
        uses: actions/setup-python@v7
        with:
          python-version: "3.11"
      - name: Install isal
        run: sudo apt-get install libisal-dev
      - name: Install tox and upgrade setuptools and pip
        run: pip install --upgrade tox setuptools pip
      - name: Run tox -e ${{ matrix.tox_env }}
        run: tox -e ${{ matrix.tox_env }}
        env:
          PYTHON_ISAL_LINK_DYNAMIC: True

  test-static:
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        python-version:
          - "3.11"
          - "3.12"
          - "3.13"
          - "3.14"
          - "3.14t"
          - "3.15"
          - "3.15t"
          - "pypy-3.11"
          - "pypy-3.12"
        os: ["ubuntu-latest"]
        include:
          - os: "macos-15-intel"
            python-version: "3.11"
          - os: "macos-latest"
            python-version: "3.11"
          - os: "windows-latest"
            python-version: "3.11"
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: recursive
      - name: Set up Python ${{ matrix.python-version }}
        uses: actions/setup-python@v7
        with:
          python-version: ${{ matrix.python-version }}
          allow-prereleases: true
      - name: Install tox and upgrade setuptools
        run: pip install --upgrade tox setuptools
      - name: Install build dependencies (Linux)  # Yasm in pypa/manylinux images.
        run: sudo apt install nasm
        if: runner.os == 'Linux'
      - name: Install build dependencies (Macos)
        # Install yasm because nasm does not work when building wheels.
        # Probably because of nasm-filter.sh not filtering all flags that can not be used.
        run: brew install nasm
        if: runner.os == 'macOS'
      - name: Set MSVC developer prompt
        uses: ilammy/msvc-dev-cmd@v1
        if: runner.os == 'Windows'
      - name: Install nasm (Windows)
        uses: ilammy/setup-nasm@v1
        if: runner.os == 'Windows'
      - name: Run tests
        run: tox
      - name: Upload coverage report
        uses: codecov/codecov-action@v1

  test-arch:
    if: startsWith(github.ref, 'refs/tags') || github.ref == 'refs/heads/develop' || github.ref == 'refs/heads/main'
    runs-on: "ubuntu-latest"
    strategy:
      matrix:
        python_version:
          - "3.11"
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: recursive
      - uses: uraimo/run-on-arch-action@v3
        name: Build & run test
        with:
          arch: none
          distro: none
          base_image: "--platform=linux/arm64 quay.io/pypa/manylinux2014_aarch64"
          # versioningit needs an accessible git repository but the container
          # is run as root, which is different from the repository user.
          # use git config to override this.
          run: |-
            git config --global --add safe.directory $PWD
            CFLAGS="-DNDEBUG -g0" python${{matrix.python_version}} -m pip install . pytest
            python${{matrix.python_version}} -m pytest tests

  # Test if the python-isal conda package can be build. Which is linked
  # dynamically to the conda isa-l package.
  test-dynamic:
    runs-on: ${{ matrix.os }}
    defaults:
      run:
        # This is needed for miniconda, see:
        # https://github.com/marketplace/actions/setup-miniconda#important.
        shell: bash -l {0}
    strategy:
      matrix:
        os: ["ubuntu-latest", "macos-15-intel", "windows-latest"]
        python_version: [ "python==3.11" ]
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: recursive
      - name: Install miniconda.
        uses: conda-incubator/setup-miniconda@v4 # https://github.com/conda-incubator/setup-miniconda.
        with:
          channels: conda-forge,defaults
      - name: Install requirements (universal)
        run: conda install isa-l ${{ matrix.python_version}} tox
      - name: Set MSVC developer prompt
        uses: ilammy/msvc-dev-cmd@v1
        if: runner.os == 'Windows'
      - name: Run tests (dynamic link)
        run: tox
        env:
          PYTHON_ISAL_LINK_DYNAMIC: True

  # Run the tests on CPython builds with AddressSanitizer and ThreadSanitizer
  # from https://github.com/nascheme/cpython_sanity.
  test-sanitizers:
    runs-on: ubuntu-latest
    # A crash under ThreadSanitizer can hang instead of exiting.
    timeout-minutes: 30
    strategy:
      fail-fast: false
      matrix:
        include:
          - sanitizer: address
            image: ghcr.io/nascheme/cpython-asan:3.14
          # The free-threaded build runs Python threads in parallel.
          - sanitizer: thread
            image: ghcr.io/nascheme/cpython-tsan:3.14t
    container:
      image: ${{ matrix.image }}
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: recursive
      - name: Install build dependencies
        run: apt-get update && apt-get install -y nasm
      - name: Install python-isal with ${{ matrix.sanitizer }} sanitizer
        # setuptools-scm needs git, and the container user does not own the
        # repository.
        run: |
          git config --global --add safe.directory "$GITHUB_WORKSPACE"
          python -m pip install . pytest pytest-timeout
        env:
          # The extension modules get -fsanitize from CPython. CFLAGS adds it
          # to the C code of ISA-L.
          CFLAGS: -fsanitize=${{ matrix.sanitizer }} -fno-omit-frame-pointer -g
      - name: Run tests
        # Do not set PYTHONDEVMODE. Its debug allocator pads each allocation,
        # so AddressSanitizer misses small overflows. --capture=sys prints
        # sanitizer reports from C code even when they end the process, and
        # -v prints the name of the test before its report.
        run: python -m pytest -v tests --capture=sys
        env:
          # Exit at the first data race. A crash after a race can hang.
          TSAN_OPTIONS: halt_on_error=1

  deploy:
    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags')
    runs-on: ${{ matrix.os }}
    needs:
      - lint
      - package-checks
      - test-static
      - test-dynamic
      - test-arch
      - test-sanitizers
    strategy:
      matrix:
        os:
          - ubuntu-latest
          - macos-15-intel
          - macos-latest
          - windows-latest
        cibw_archs_linux: ["x86_64"]
        cibw_before_all_linux:
          - >-
            curl -o nasm-2.15.05.tar.gz https://www.nasm.us/pub/nasm/releasebuilds/2.15.05/nasm-2.15.05.tar.gz &&
            tar -xzvf nasm-2.15.05.tar.gz &&
            cd nasm-2.15.05/ &&
            ./autogen.sh &&
            ./configure &&
            make nasm &&
            install -c nasm /usr/bin/nasm
        build_sdist: [true]
        include:
          - os: "ubuntu-latest"
            cibw_archs_linux: "aarch64"
            cibw_before_all_linux: "true"  # The true command exits with 0
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: recursive
          fetch-depth: 0  # Fetch everything to get accurately versioned tag.
      - uses: actions/setup-python@v7
        name: Install Python
      - name: Install cibuildwheel twine wheel
        run: python -m pip install cibuildwheel twine wheel
      - name: Install build dependencies (Macos)
        run: brew install nasm
        if: runner.os == 'macOS'
      - name: Set MSVC developer prompt
        uses: ilammy/msvc-dev-cmd@v1
        if: runner.os == 'Windows'
      - name: Install nasm (Windows)
        uses: ilammy/setup-nasm@v1
        if: runner.os == 'Windows'
      - name: Set up QEMU
        if: ${{runner.os == 'Linux' && matrix.cibw_archs_linux == 'aarch64'}}
        uses: docker/setup-qemu-action@v3
        with:
          platforms: arm64
      - name: Build wheels
        run: cibuildwheel --output-dir dist
        env:
          CIBW_ENABLE: "pypy"
          CIBW_SKIP: "*-win32 *-manylinux_i686 cp38-macosx_*arm64 cp39-macosx_*arm64"  # Skip 32 bit and problematic mac builds.
          CIBW_ARCHS_LINUX: ${{ matrix.cibw_archs_linux }}
          CIBW_BEFORE_ALL_LINUX: ${{ matrix.cibw_before_all_linux }}
          # Fully test the build wheels again.
          CIBW_TEST_REQUIRES: "pytest"
          # Simple tests that requires the project to be build correctly
          # Skip extensive compatibility testing which is slow.
          CIBW_TEST_COMMAND_LINUX: >-
            pytest -v {project}/tests/test_igzip.py
            {project}/tests/test_gzip_compliance.py
            {project}/tests/test_zlib_compliance.py
            {project}/tests/test_igzip_lib.py
            -k 'not test_compress_decompress'
          CIBW_TEST_COMMAND_MACOS: >-
            pytest -v {project}/tests/test_igzip.py
            {project}/tests/test_gzip_compliance.py
            {project}/tests/test_zlib_compliance.py
            {project}/tests/test_igzip_lib.py
            -k 'not test_compress_decompress'
          # Windows does not have the test module apparently. Do more expensive
          # tests to verify build.
          CIBW_TEST_COMMAND_WINDOWS: >-
            pytest {project}/tests/test_igzip.py
            {project}/tests/test_igzip_lib.py
            {project}/tests/test_compat.py
          CIBW_ENVIRONMENT_LINUX: >-
            PYTHON_ISAL_BUILD_CACHE=True
            PYTHON_ISAL_BUILD_CACHE_FILE=/tmp/build_cache
            CFLAGS="-O3 -DNDEBUG"
          CIBW_ENVIRONMENT_WINDOWS: >-
            PYTHON_ISAL_BUILD_CACHE=True
            PYTHON_ISAL_BUILD_CACHE_FILE=${{ runner.temp }}\build_cache
          CIBW_ENVIRONMENT_MACOS: >-
            PYTHON_ISAL_BUILD_CACHE=True
            PYTHON_ISAL_BUILD_CACHE_FILE=${{ runner.temp }}/build_cache
            CFLAGS="-O3 -DNDEBUG"
      - name: Build sdist
        if: ${{runner.os == 'Linux' && matrix.cibw_archs_linux == 'x86_64'}}
        run: |
            pip install build
            python -m build --sdist
      - uses: actions/upload-artifact@v4
        with:
          name: "dist-${{ runner.os }}-${{ runner.arch }}-${{ matrix.cibw_archs_linux }}"
          path: "dist/"
      - name: Publish package to TestPyPI
        # pypa/gh-action-pypi-publish@master does not work on OSX
        # Alpha, Beta and dev releases contain a - in the tag.
        if: contains(github.ref, '-') && startsWith(github.ref, 'refs/tags')
        run: twine upload --skip-existing --repository-url https://test.pypi.org/legacy/ dist/*
        env:
          TWINE_USERNAME: __token__
          TWINE_PASSWORD: ${{ secrets.TEST_PYPI_API_TOKEN }}
      - name: Publish package to PyPI
        if: "!contains(github.ref, '-') && startsWith(github.ref, 'refs/tags')"
        run: twine upload --skip-existing dist/*
        env:
          TWINE_USERNAME: __token__
          TWINE_PASSWORD: ${{ secrets.PYPI_API_TOKEN }}