release.yml

name: Release
on:
  push:
    tags:
      - v*
  workflow_dispatch:
    inputs: {}
env:
  CIBW_BUILD: "cp310-* cp311-* cp312-*"
jobs:

  Build-Linux:
    strategy:
      matrix:
        include:
          - runner: ubuntu-latest
            cibw_arch: aarch64
          - runner: ubuntu-latest
            cibw_arch: x86_64
    runs-on: ${{ matrix.runner }}
    steps:
      - name: Checkout
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
      - name: Set up QEMU
        uses: docker/setup-qemu-action@68827325e0b33c7199eb31dd4e31fbe9023e06e3
        with:
          platforms: arm64
      - name: Build wheels
        uses: pypa/cibuildwheel@ce3fb7832089eb3e723a0a99cab7f3eaccf074fd
        env:
          CIBW_ENVIRONMENT: PATH=$(pwd)/go/bin:$PATH
          CIBW_BEFORE_ALL: sh ci-setup-golang.sh
          CIBW_SKIP: "*musllinux*"
          CIBW_ARCHS: ${{ matrix.cibw_arch }}
      - name: Upload Artifacts
        uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3
        with:
          name: wheels-linux-${{ matrix.cibw_arch }}
          path: ./wheelhouse/*.whl

  Build-Windows:
    runs-on: windows-latest
    steps:
      - name: Checkout
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
      - name: Set up Go
        uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491
        with:
          go-version: "1.21.5"
          cache: true
          cache-dependency-path: "gotfparse/go.sum"
      - name: Build wheels
        uses: pypa/cibuildwheel@ce3fb7832089eb3e723a0a99cab7f3eaccf074fd
        env:
          CGO_ENABLED: 1
          CIBW_ARCHS: AMD64
      - name: Upload Artifacts
        uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3
        with:
          name: wheels-windows
          path: ./wheelhouse/*.whl

  Build-MacOS:
    strategy:
      matrix:
        include:
          - cibw_arch: "x86_64"
            go_arch: "amd64"
          - cibw_arch: "arm64"
            go_arch: "arm64"
    runs-on: macos-latest
    steps:
      - name: Checkout
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
      - name: Set up Go
        uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491
        with:
          go-version: "1.21.5"
          cache: true
          cache-dependency-path: "gotfparse/go.sum"
      - name: Build wheels
        uses: pypa/cibuildwheel@ce3fb7832089eb3e723a0a99cab7f3eaccf074fd
        env:
          CGO_ENABLED: 1
          CIBW_ARCHS: ${{ matrix.cibw_arch }}
          GOARCH: ${{ matrix.go_arch }}
      - name: Upload Artifacts
        uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3
        with:
          name: wheels-macos-${{ matrix.cibw_arch }}
          path: ./wheelhouse/*.whl

  Gather:
    needs: [Build-Linux, Build-MacOS, Build-Windows]
    runs-on: ubuntu-latest
    outputs:
      hash: ${{ steps.hash.outputs.hash }}
    steps:
      - name: Fetch Wheels
        uses: actions/download-artifact@87c55149d96e628cc2ef7e6fc2aab372015aec85
        with:
          pattern: "wheels-*"
          path: dist
          merge-multiple: true
      - name: Display downloaded artifacts
        run: ls -lh dist
      - name: Generate Hashes
        id: hash
        run: cd dist && echo "hash=$(sha256sum * | base64 -w0)" >> $GITHUB_OUTPUT

  Provenance:
    needs: [Gather]
    permissions:
      actions: read
      id-token: write
      contents: write
    # Can't pin with hash due to how this workflow works.
    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.10.0
    with:
      base64-subjects: ${{ needs.Gather.outputs.hash }}

  Release:
    runs-on: ubuntu-latest
    needs: [Provenance]
    permissions:
      contents: write
    if: startsWith(github.ref, 'refs/tags/')
    steps:
      - name: Checkout
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11      
      - name: Fetch Wheels
        uses: actions/download-artifact@87c55149d96e628cc2ef7e6fc2aab372015aec85
        with:
          pattern: "*"
          path: dist
          merge-multiple: true
      - name: Upload Release Assets
        run: |
          gh release upload ${{ github.ref_name }} dist/*
        env:
          GH_TOKEN: ${{ github.token }}

  Upload:
    needs: [Release]
    runs-on: ubuntu-latest
    if: startsWith(github.ref, 'refs/tags/')
    permissions:
      id-token: write
    steps:
      - name: Fetch Wheels
        uses: actions/download-artifact@87c55149d96e628cc2ef7e6fc2aab372015aec85
        with:
          pattern: "wheels-*"
          path: dist
          merge-multiple: true
      - name: Upload to PYPI
        uses: pypa/gh-action-pypi-publish@e53eb8b103ffcb59469888563dc324e3c8ba6f06