python-wheels/.github/workflows/build-pycryptodome.yml at main · riseproject-dev/python-wheels · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
# SPDX-FileCopyrightText: 2026 The RISE Project
# SPDX-License-Identifier: MIT
---
# Based on upstream's wheel builder:
#   https://github.com/Legrandin/pycryptodome/blob/v3.23.0/.github/workflows/wheels.yml
name: Build pycryptodome wheels (riscv64)

on:
  workflow_dispatch:
    inputs:
      version:
        description: 'Version glob to (re)build; empty builds every version of docs/packages/pycryptodome.yaml not released yet'
        required: false
        default: ''
  pull_request:
    branches: [main]
    paths:
      - '.github/workflows/build-pycryptodome.yml'
      - 'docs/packages/pycryptodome.yaml'
  push:
    branches: [main]
    paths:
      - '.github/workflows/build-pycryptodome.yml'
      - 'docs/packages/pycryptodome.yaml'

concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

permissions:
  contents: read  # to fetch code (actions/checkout)

env:
  MANYLINUX_RISCV64_IMAGE: quay.io/pypa/manylinux_2_39_riscv64
  # Upstream's requirements-test.txt; without it SelfTest skips its Wycheproof vectors.
  TEST_REQUIRES: pycryptodome-test-vectors==1.0.22
  TEST_COMMAND: python -m Crypto.SelfTest --skip-slow-tests

jobs:
  setup:
    uses: $/.github/workflows/_setup.yml
    with:
      package: pycryptodome
      version: ${{ inputs.version }}

  build_abi3:
    needs: [setup]
    if: needs.setup.outputs.versions != '[]'
    strategy:
      fail-fast: false
      matrix:
        version: ${{ fromJSON(needs.setup.outputs.versions) }}
    name: Build pycryptodome ${{ matrix.version }} cp37-abi3-manylinux_riscv64
    runs-on: ubuntu-24.04-riscv
    timeout-minutes: 180

    env:
      PYCRYPTODOME_VERSION: ${{ matrix.version }}

    steps:
      - name: Checkout pycryptodome v${{ env.PYCRYPTODOME_VERSION }}
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          repository: Legrandin/pycryptodome
          ref: v${{ env.PYCRYPTODOME_VERSION }}
          persist-credentials: false

      - uses: pypa/cibuildwheel@1828c10ab37f080699c7b81cea34097c684a7074  # v4.2.0
        env:
          CIBW_ARCHS: riscv64
          CIBW_BUILD: cp312-manylinux_riscv64 cp313-manylinux_riscv64 cp314-manylinux_riscv64
          CIBW_MANYLINUX_RISCV64_IMAGE: ${{ env.MANYLINUX_RISCV64_IMAGE }}
          CIBW_TEST_REQUIRES: ${{ env.TEST_REQUIRES }}
          CIBW_TEST_COMMAND: ${{ env.TEST_COMMAND }}

      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
        with:
          name: pycryptodome-${{ env.PYCRYPTODOME_VERSION }}-cp37-abi3-manylinux_riscv64
          path: ./wheelhouse/*.whl
          if-no-files-found: error

  # Free-threaded builds get no abi3 wheel (setup.py skips py_limited_api under
  # Py_GIL_DISABLED); cp314t is the only free-threaded interpreter in the image.
  build_freethreaded:
    needs: [setup]
    if: needs.setup.outputs.versions != '[]'
    strategy:
      fail-fast: false
      matrix:
        version: ${{ fromJSON(needs.setup.outputs.versions) }}
    name: Build pycryptodome ${{ matrix.version }} cp314t-manylinux_riscv64
    runs-on: ubuntu-24.04-riscv
    timeout-minutes: 180

    env:
      PYCRYPTODOME_VERSION: ${{ matrix.version }}

    steps:
      - name: Checkout pycryptodome v${{ env.PYCRYPTODOME_VERSION }}
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          repository: Legrandin/pycryptodome
          ref: v${{ env.PYCRYPTODOME_VERSION }}
          persist-credentials: false

      - uses: pypa/cibuildwheel@1828c10ab37f080699c7b81cea34097c684a7074  # v4.2.0
        env:
          CIBW_ARCHS: riscv64
          CIBW_BUILD: cp314t-manylinux_riscv64
          CIBW_MANYLINUX_RISCV64_IMAGE: ${{ env.MANYLINUX_RISCV64_IMAGE }}
          CIBW_TEST_REQUIRES: ${{ env.TEST_REQUIRES }}
          CIBW_TEST_COMMAND: ${{ env.TEST_COMMAND }}

      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
        with:
          name: pycryptodome-${{ env.PYCRYPTODOME_VERSION }}-cp314t-manylinux_riscv64
          path: ./wheelhouse/*.whl
          if-no-files-found: error

  publish:
    name: Publish pycryptodome ${{ matrix.version }}
    needs: [setup, build_abi3, build_freethreaded]
    if: needs.setup.outputs.versions != '[]'
    strategy:
      fail-fast: false
      matrix:
        version: ${{ fromJSON(needs.setup.outputs.versions) }}
    permissions:
      contents: write
      pull-requests: write
    uses: $/.github/workflows/_publish-wheel.yml
    secrets:
      app-private-key: ${{ secrets.RISEPROJECT_APP_PRIVATE_KEY }}
    with:
      artifact-pattern: pycryptodome-${{ matrix.version }}-*-manylinux_riscv64