build-zensical.yml

# SPDX-FileCopyrightText: 2026 The RISE Project
# SPDX-License-Identifier: MIT
---
# This workflow is based on: https://github.com/zensical/zensical/blob/master/.github/workflows/build.yml
name: Build zensical wheels (riscv64)

on:
  workflow_dispatch:
    inputs:
      version:
        description: 'Version glob to (re)build; empty builds every version of docs/packages/zensical.yaml not released yet'
        required: false
        default: ''
  pull_request:
    branches: [main]
    paths:
      - '.github/workflows/build-zensical.yml'
      - 'docs/packages/zensical.yaml'
  push:
    branches: [main]
    paths:
      - '.github/workflows/build-zensical.yml'
      - 'docs/packages/zensical.yaml'

concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

permissions:
  contents: read  # to fetch code (actions/checkout)

env:
  MANYLINUX_RISCV64_IMAGE: quay.io/pypa/manylinux_2_39_riscv64

jobs:
  setup:
    uses: $/.github/workflows/_setup.yml
    with:
      package: zensical
      version: ${{ inputs.version }}

  # abi3-py310, so cp310 is the only identifier that actually compiles (gotcha
  # 96: upstream itself pins --interpreter python3.10 for this reason, see
  # build.yml's "Temporary fix for .../issues/425"); cibuildwheel builds once
  # there and reuses+retests that wheel on cp312/cp313/cp314
  # (find_compatible_wheel).
  build_wheels:
    needs: [setup]
    if: needs.setup.outputs.versions != '[]'
    strategy:
      fail-fast: false
      matrix:
        version: ${{ fromJSON(needs.setup.outputs.versions) }}
    name: Build zensical ${{ matrix.version }} cp310-abi3-manylinux_riscv64
    runs-on: ubuntu-24.04-riscv
    timeout-minutes: 120
    env:
      ZENSICAL_VERSION: ${{ matrix.version }}

    steps:
      - name: Checkout zensical ${{ env.ZENSICAL_VERSION }}
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          repository: zensical/zensical
          ref: v${{ env.ZENSICAL_VERSION }}
          persist-credentials: false

      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d  # v10.0.1
        with:
          python-version: '3.12'
          activate-environment: true
          enable-cache: false

      - name: Prepare build
        run: python scripts/prepare.py

      - name: Build wheels
        uses: pypa/cibuildwheel@1828c10ab37f080699c7b81cea34097c684a7074  # v4.2.0
        env:
          CIBW_ARCHS: riscv64
          CIBW_BUILD: 'cp310-* cp312-* cp313-* cp314-*'
          CIBW_SKIP: '*-musllinux_*'  # rustup.rs has no riscv64 musl toolchain
          CIBW_MANYLINUX_RISCV64_IMAGE: ${{ env.MANYLINUX_RISCV64_IMAGE }}
          CIBW_BEFORE_ALL_LINUX: >-
            curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
          CIBW_ENVIRONMENT: >-
            PATH="$PATH:$HOME/.cargo/bin"
            PIP_EXTRA_INDEX_URL=https://pypi.riseproject.dev/simple/
          # tomli>=2.4.0 has no cp310 riscv64 wheel on the registry (only
          # cp312+), so cp310 can build but not install-and-test (gotcha 216).
          CIBW_TEST_SKIP: cp310-*
          # pandas' own numpy>=1.26.0 requirement is unpinned: a newer PyPI
          # release of either with no riscv64 wheel yet otherwise wins version
          # resolution and falls back to a from-source build (gotcha 12).
          CIBW_TEST_ENVIRONMENT: PIP_ONLY_BINARY=pandas,numpy
          CIBW_TEST_REQUIRES: pytest beautifulsoup4 lxml mkdocstrings[python] pandas tabulate
          CIBW_TEST_SOURCES: python/tests
          # Relative to test_cwd (gotcha 25), not {project}: python/zensical
          # isn't staged there, so import zensical can't resolve to the
          # uncompiled checkout and only finds the installed wheel.
          # test_serve_refreshes_autorefs_before_validation races a live
          # `zensical serve` subprocess's file-watcher against a hardcoded
          # 10s wall-clock timeout; under contended CI it can observe a
          # second rebuild that read stale content. The same cache-
          # invalidation path is covered without a subprocess or timeout by
          # test_validation_refreshes_cached_autoref_resolutions, which passes.
          # test_disabled_minify_reconciles_asset_handoffs_and_removals races
          # the same `zensical serve` file-watcher against a hardcoded 10s
          # wait_for() timeout (gotcha 38: a slow/contended runner turns a
          # latent upstream test race into a hard failure).
          # test_serve_retracts_superseded_cache_safe_assets: same
          # `zensical serve` file-watcher race, different assertion - the
          # spawned dev-server subprocess dies with SIGABRT (status -6) under
          # this runner's timing instead of serving the expected response.
          CIBW_TEST_COMMAND: >-
            python -m pytest python/tests
            --deselect python/tests/integration/test_validation.py::test_serve_refreshes_autorefs_before_validation
            --deselect python/tests/integration/test_minify.py::test_disabled_minify_reconciles_asset_handoffs_and_removals
            --deselect python/tests/integration/test_minify.py::test_serve_retracts_superseded_cache_safe_assets

      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
        with:
          name: zensical-${{ env.ZENSICAL_VERSION }}-cp310-abi3-manylinux_riscv64
          path: wheelhouse/*.whl
          if-no-files-found: error

  publish:
    name: Publish zensical ${{ matrix.version }}
    needs: [setup, build_wheels]
    if: needs.setup.outputs.versions != '[]'
    strategy:
      fail-fast: false
      matrix:
        version: ${{ fromJSON(needs.setup.outputs.versions) }}
    permissions:
      contents: write
      pull-requests: write
    uses: $/.github/workflows/_publish-wheel.yml
    secrets:
      app-private-key: ${{ secrets.RISEPROJECT_APP_PRIVATE_KEY }}
    with:
      artifact-pattern: zensical-${{ matrix.version }}-*-manylinux_riscv64