fastmm-engine 0.2.0__tar.gz

fastmm_engine-0.2.0/.clang-format

@@ -0,0 +1,24 @@
+BasedOnStyle: Google
+ColumnLimit: 100
+IndentWidth: 2
+PointerAlignment: Left
+DerivePointerAlignment: false
+QualifierAlignment: Left
+AllowShortFunctionsOnASingleLine: Inline
+AllowShortIfStatementsOnASingleLine: WithoutElse
+AllowShortLoopsOnASingleLine: true
+AlignConsecutiveAssignments: false
+BinPackArguments: false
+BinPackParameters: false
+IncludeBlocks: Regroup
+IncludeCategories:
+  - Regex: '^"fastmm/'
+    Priority: 2
+  - Regex: '^<(doctest|benchmark|fmt|simdjson|toml\+\+|pybind11|openssl)/'
+    Priority: 3
+  - Regex: '^<.*\.h>'
+    Priority: 4
+  - Regex: '^<'
+    Priority: 5
+  - Regex: '.*'
+    Priority: 1

fastmm_engine-0.2.0/.clang-tidy

@@ -0,0 +1,59 @@
+# Style checks that contradict .clang-format (braces on one-line ifs) or the hot-path design
+# (deliberately uninitialised buffers, FASTMM_ macros, explicit enum widths) are disabled.
+# bugprone-* and performance-* stay errors; everything else is advisory.
+Checks: >
+  bugprone-*,
+  performance-*,
+  modernize-*,
+  readability-*,
+  cppcoreguidelines-*,
+  clang-analyzer-*,
+  misc-*,
+  concurrency-*,
+  -modernize-use-trailing-return-type,
+  -readability-magic-numbers,
+  -cppcoreguidelines-avoid-magic-numbers,
+  -cppcoreguidelines-pro-bounds-pointer-arithmetic,
+  -cppcoreguidelines-pro-bounds-constant-array-index,
+  -cppcoreguidelines-pro-type-reinterpret-cast,
+  -cppcoreguidelines-pro-type-union-access,
+  -cppcoreguidelines-avoid-c-arrays,
+  -modernize-avoid-c-arrays,
+  -readability-identifier-length,
+  -readability-function-cognitive-complexity,
+  -misc-non-private-member-variables-in-classes,
+  -cppcoreguidelines-non-private-member-variables-in-classes,
+  -bugprone-easily-swappable-parameters,
+  -cppcoreguidelines-avoid-do-while,
+  -misc-include-cleaner,
+  -readability-convert-member-functions-to-static,
+  -readability-braces-around-statements,
+  -readability-redundant-member-init,
+  -readability-uppercase-literal-suffix,
+  -readability-named-parameter,
+  -modernize-use-nodiscard,
+  -misc-const-correctness,
+  -cppcoreguidelines-pro-bounds-array-to-pointer-decay,
+  -cppcoreguidelines-pro-type-member-init,
+  -cppcoreguidelines-macro-usage,
+  -cppcoreguidelines-special-member-functions,
+  -cppcoreguidelines-pro-type-vararg,
+  -cppcoreguidelines-owning-memory,
+  -cppcoreguidelines-avoid-non-const-global-variables,
+  -performance-enum-size
+WarningsAsErrors: 'bugprone-*,performance-*'
+HeaderFilterRegex: '^.*/(include|src|apps)/.*'
+CheckOptions:
+  readability-identifier-naming.ClassCase: CamelCase
+  readability-identifier-naming.StructCase: CamelCase
+  readability-identifier-naming.EnumCase: CamelCase
+  readability-identifier-naming.FunctionCase: lower_case
+  readability-identifier-naming.VariableCase: lower_case
+  readability-identifier-naming.PrivateMemberSuffix: _
+  readability-identifier-naming.ConstexprVariablePrefix: k
+  readability-identifier-naming.ConstexprVariableCase: CamelCase
+  readability-identifier-naming.EnumConstantPrefix: ''
+  readability-identifier-naming.EnumConstantCase: CamelCase
+  readability-identifier-naming.MacroDefinitionCase: UPPER_CASE
+  readability-identifier-naming.MacroDefinitionPrefix: FASTMM_
+  readability-identifier-naming.TemplateParameterCase: CamelCase

fastmm_engine-0.2.0/.dockerignore

@@ -0,0 +1,16 @@
+# Keep the Docker build context small and reproducible: only sources go in.
+build/
+.cpm-cache/
+.venv/
+runs/
+dist/
+**/__pycache__/
+*.egg-info/
+python/fastmm/_core*.so
+bench/results/
+.git/
+.cache/
+.idea/
+.vscode/
+.env
+.claude/

fastmm_engine-0.2.0/.editorconfig

@@ -0,0 +1,13 @@
+root = true
+[*]
+charset = utf-8
+end_of_line = lf
+insert_final_newline = true
+trim_trailing_whitespace = true
+indent_style = space
+indent_size = 2
+max_line_length = 100
+[*.py]
+indent_size = 4
+[Makefile]
+indent_style = tab

fastmm_engine-0.2.0/.env.example

@@ -0,0 +1,12 @@
+# Copy to .env and `source` it, or export in your shell. Never commit real keys.
+FASTMM_BINANCE_API_KEY=
+FASTMM_BINANCE_API_SECRET=
+FASTMM_BYBIT_API_KEY=
+FASTMM_BYBIT_API_SECRET=
+# Deribit testnet API key: client id and client secret.
+FASTMM_DERIBIT_CLIENT_ID=
+FASTMM_DERIBIT_CLIENT_SECRET=
+# Opt-in Binance live test environment: testnet (default) or demo.
+FASTMM_BINANCE_ENV=testnet
+# Set to 1 to enable opt-in tests that talk to exchange testnets.
+FASTMM_LIVE_TESTS=0

fastmm_engine-0.2.0/.github/workflows/bench-nightly.yml

@@ -0,0 +1,24 @@
+name: bench-nightly
+# Manual only: hosted-runner numbers are advisory, and a daily 40-minute run would spend most of a
+# private repository's Actions minutes. Add a schedule back (e.g. weekly) if the repository is public.
+on:
+  workflow_dispatch:
+jobs:
+  bench:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 40
+    steps:
+      - uses: actions/checkout@v4
+      - run: sudo apt-get update && sudo apt-get install -y g++-13 ninja-build libssl-dev zlib1g-dev && cmake --version
+      - uses: actions/cache@v4
+        with:
+          path: ~/.cache/CPM
+          key: cpm-${{ hashFiles('cmake/Dependencies.cmake', 'cmake/CPM.cmake') }}
+      - name: bench (release, portable flags; hosted runners are noisy)
+        run: CPM_SOURCE_CACHE=~/.cache/CPM ./scripts/bench.sh --preset release --cpu 1 --min-time 0.2s
+      - name: compare to baseline (advisory)
+        run: python3 tools/bench_compare.py bench/results/baseline-ci bench/results/latest || true
+      - name: budgets (same three-times-the-budget gate as the CI subset)
+        run: python3 tools/check_budgets.py bench/results/latest --slack 2
+      - uses: actions/upload-artifact@v4
+        with: { name: bench-results, path: bench/results/latest }

fastmm_engine-0.2.0/.github/workflows/ci.yml

@@ -0,0 +1,224 @@
+name: CI
+# Pushes and pull requests run lint, the gcc release build with tests, and the Python wheel; a push
+# that only changes documentation runs lint alone. clang-tidy, the sanitizer builds, the clang build
+# and the Docker smoke test run weekly and on manual dispatch ("Run workflow").
+on:
+  push:
+    branches: [main]
+  pull_request:
+  schedule:
+    - cron: "0 3 * * 0"
+  workflow_dispatch:
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.ref }}
+  cancel-in-progress: true
+env:
+  CPM_SOURCE_CACHE: ~/.cache/CPM
+jobs:
+  plan:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    outputs:
+      full: ${{ steps.plan.outputs.full }}
+      code: ${{ steps.plan.outputs.code }}
+      matrix: ${{ steps.plan.outputs.matrix }}
+    steps:
+      - id: plan
+        env:
+          GH_TOKEN: ${{ github.token }}
+          EVENT: ${{ github.event_name }}
+          BEFORE: ${{ github.event.before }}
+        run: |
+          gcc_release='{"name":"gcc-release","preset":"release","cxx":"g++-13","pkgs":"g++-13"}'
+          others='{"name":"gcc-asan","preset":"asan","cxx":"g++-13","pkgs":"g++-13"},{"name":"clang-release","preset":"clang-release","cxx":"clang++-18","pkgs":"clang-18 lld-18"},{"name":"clang-tsan","preset":"clang-tsan","cxx":"clang++-18","pkgs":"clang-18 lld-18"}'
+          full=false; code=true; matrix="[$gcc_release]"
+          if [ "$EVENT" = schedule ] || [ "$EVENT" = workflow_dispatch ]; then
+            full=true; matrix="[$gcc_release,$others]"
+          elif [ "$EVENT" = push ]; then
+            # Unknown ranges (first push, force push) count as code changes.
+            if files=$(gh api "repos/$GITHUB_REPOSITORY/compare/$BEFORE...$GITHUB_SHA" --jq '.files[].filename') && [ -n "$files" ]; then
+              echo "$files" | grep -qvE '^(docs/.*|.*\.md|LICENSE)$' || code=false
+            fi
+          fi
+          { echo "full=$full"; echo "code=$code"; echo "matrix=$matrix"; } >> "$GITHUB_OUTPUT"
+          echo "full=$full code=$code"
+
+  lint:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v4
+      - name: install tools
+        run: sudo apt-get update && sudo apt-get install -y clang-format-18
+      - name: clang-format
+        run: CLANG_FORMAT=clang-format-18 ./scripts/format.sh --check
+      - name: generated SBE flyweights are up to date
+        run: >-
+          python3 tools/sbe_gen.py generate --schema tools/sbe/mdp3_templates_subset.xml
+          --schema-label tools/sbe/mdp3_templates_subset.xml
+          --out include/fastmm/codecs/mdp3/generated/mdp3_schema.hpp
+          --namespace fastmm::codecs::mdp3::schema --check &&
+          python3 tools/sbe_gen.py generate --schema tools/sbe/binance_spot_stream_1_0.xml
+          --schema-label tools/sbe/binance_spot_stream_1_0.xml
+          --out include/fastmm/venues/binance/generated/binance_stream_sbe.hpp
+          --namespace fastmm::venues::binance::sbe_stream --check
+      - name: forbidden patterns
+        run: |
+          ! grep -rnE 'dynamic_cast|std::cout' include src || (echo "forbidden pattern in hot-path code" && exit 1)
+          ! grep -rnE 'TEST_CASE\("[^"]*;' tests || (echo "';' in a TEST_CASE name breaks doctest_discover_tests filters" && exit 1)
+      - name: docs (snippets, links and anchors, configuration reference)
+        # docs/contributing/writing-docs.md; the command-line reference needs a build (gcc-release).
+        run: |
+          python3 tools/doc_snippets.py --check
+          python3 tools/docs_links.py --check
+          python3 tools/docs_config_ref.py --check
+
+  clang-tidy:
+    needs: plan
+    if: needs.plan.outputs.full == 'true'
+    runs-on: ubuntu-24.04
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@v4
+      - name: install tools
+        run: sudo apt-get update && sudo apt-get install -y clang-tidy-18 ninja-build libssl-dev zlib1g-dev && cmake --version
+      - uses: actions/cache@v4
+        with:
+          path: ~/.cache/CPM
+          key: cpm-${{ hashFiles('cmake/Dependencies.cmake', 'cmake/CPM.cmake') }}
+      - name: configure (compile_commands.json)
+        run: cmake --preset debug -DFASTMM_BUILD_BENCH=OFF
+      - name: clang-tidy (bugprone-* and performance-* fail the job)
+        run: RUN_CLANG_TIDY=run-clang-tidy-18 ./scripts/tidy.sh build/debug
+
+  build-test:
+    needs: plan
+    if: needs.plan.outputs.code == 'true'
+    runs-on: ubuntu-24.04
+    # Private-repository runners have 2 vCPUs and 7 GB: a cold sanitizer build takes well over 20 min.
+    timeout-minutes: 60
+    strategy:
+      fail-fast: false
+      matrix:
+        include: ${{ fromJSON(needs.plan.outputs.matrix) }}
+    name: ${{ matrix.name }}
+    steps:
+      - uses: actions/checkout@v4
+      - name: install
+        run: sudo apt-get update && sudo apt-get install -y ${{ matrix.pkgs }} ninja-build libssl-dev zlib1g-dev ccache && cmake --version
+      - uses: hendrikmuhs/ccache-action@v1.2
+        with:
+          key: ${{ matrix.name }}
+      - uses: actions/cache@v4
+        with:
+          path: ~/.cache/CPM
+          key: cpm-${{ hashFiles('cmake/Dependencies.cmake', 'cmake/CPM.cmake') }}
+      - name: allow TSan on high-entropy ASLR kernels
+        if: contains(matrix.preset, 'tsan')
+        run: sudo sysctl -w vm.mmap_rnd_bits=28
+      - name: configure
+        run: cmake --preset ${{ matrix.preset }} -DCMAKE_CXX_COMPILER=${{ matrix.cxx }} -DFASTMM_WERROR=ON
+      - name: build
+        # -k 0: report every compile error in one run instead of stopping at the first one
+        run: cmake --build --preset ${{ matrix.preset }} -j$(nproc) -- -k 0
+      - name: docs (command-line reference is up to date)
+        if: matrix.name == 'gcc-release'
+        run: python3 tools/docs_cli_help.py --check --bin build/release/bin
+      - name: test
+        env: { ASAN_OPTIONS: "detect_leaks=1:strict_string_checks=1", UBSAN_OPTIONS: "print_stacktrace=1:halt_on_error=1", TSAN_OPTIONS: "halt_on_error=1" }
+        # The test presets set no job count; run as many tests at once as the runner has cores.
+        # Includes the labels examples (quick start, C++ examples), tutorial (its unit test, C++
+        # backtest and, outside sanitizers, scripts/docs/tutorial.sh up to the simulated exchange on
+        # a free port) and docs (strategy API doc test, public headers compile alone).
+        run: ctest --preset ${{ matrix.preset }} -j$(nproc)
+      - name: benchmark budgets (subset)
+        if: matrix.name == 'gcc-release'
+        # bench/ci_budget.toml holds absolute times measured on the reference machine. A hosted
+        # runner is roughly twice as slow and its load is not ours to control, so this gate is set
+        # at three times the budget: it catches a benchmark that errored, that stopped doing the
+        # work it is named for (the [min_counters] floors), or that collapsed by an order of
+        # magnitude -- the class of harness bug that once published an 8 ms reactor round trip. The
+        # tight gate is the local one (default --slack 0.10, scripts/bench.sh + check_budgets.py).
+        run: |
+          mkdir -p bench/results/ci
+          for b in bench_book bench_risk bench_oms bench_quote_manager bench_logger bench_journal \
+                   bench_codecs_fix bench_codecs_mdp3; do
+            ./build/release/bin/bench/$b --benchmark_min_time=0.1s --benchmark_repetitions=3 \
+              --benchmark_out_format=json --benchmark_out="bench/results/ci/$b.json"
+          done
+          # Each tick-to-order iteration runs an untimed settle loop that costs far more than the
+          # timed part, so this one gets a short min_time.
+          ./build/release/bin/bench/bench_tick_to_order --benchmark_min_time=0.02s \
+            --benchmark_repetitions=3 --benchmark_out_format=json \
+            --benchmark_out=bench/results/ci/bench_tick_to_order.json
+          python3 tools/check_budgets.py bench/results/ci --slack 2
+
+      - name: install + external project
+        if: matrix.name == 'gcc-release'
+        # examples/external-project against the install prefix: strategy lists, a synthetic backtest,
+        # 15 s of live trading against fastmm-sim-exchange, a verified replay of that journal.
+        run: |
+          cmake --install build/release --prefix build/install
+          CXX=${{ matrix.cxx }} JOBS=$(nproc) ./scripts/ci-external-project.sh build/release build/install build/external-project
+
+  docker:
+    needs: plan
+    if: needs.plan.outputs.full == 'true'
+    runs-on: ubuntu-24.04
+    timeout-minutes: 60
+    steps:
+      - uses: actions/checkout@v4
+      - name: build the image
+        run: docker compose build
+      - name: smoke test (simulated exchange + engine, 20 s)
+        run: |
+          docker compose up -d sim-exchange
+          docker compose run --rm engine --config /fastmm/configs/sim-docker.toml --duration 20s
+      - name: the production image builds and runs as uid 10001
+        run: |
+          docker build -f docker/Dockerfile.production -t fastmm-production:ci .
+          test "$(docker run --rm --entrypoint id fastmm-production:ci -u)" = 10001
+          docker run --rm fastmm-production:ci fastmm-live --version
+      - name: simulator log
+        if: always()
+        run: docker compose logs sim-exchange | tail -40
+      - name: stop
+        if: always()
+        run: docker compose down
+
+  python:
+    needs: plan
+    if: needs.plan.outputs.code == 'true'
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with: { python-version: "3.12" }
+      - name: install
+        run: sudo apt-get update && sudo apt-get install -y g++-13 ninja-build ccache && python -m pip install --upgrade pip
+      - uses: hendrikmuhs/ccache-action@v1.2
+        with:
+          key: python-wheel
+      - uses: actions/cache@v4
+        with:
+          path: ~/.cache/CPM
+          key: cpm-${{ hashFiles('cmake/Dependencies.cmake', 'cmake/CPM.cmake') }}
+      - name: wheel (scikit-build-core, FASTMM_BUILD_NET=OFF)
+        run: CXX=g++-13 pip wheel . -w dist --no-deps -v
+      - name: install wheel + test deps
+        # numba: python/tests/test_hot.py and the hot example (the fastmm-engine[hot] extra)
+        run: pip install "$(ls dist/fastmm_engine-*.whl)[hot]" pytest pandas
+      - name: wheel holds only the package
+        run: python -m zipfile -l dist/fastmm_engine-*.whl | awk 'NR>1 {print $1}' | grep -vE '^fastmm(/|_engine-[0-9.]+\.dist-info/)' && exit 1 || true
+      - name: pytest (against the installed wheel)
+        run: |
+          python -c "import fastmm; print(fastmm.__version__, fastmm.build_info())"
+          python -m pytest python/tests -q
+      - name: examples
+        run: |
+          python examples/python/backtest_quickstart.py
+          python examples/python/sweep_spread.py
+          python examples/python/strategies/basic_mm_exact.py
+          python examples/python/strategies/basic_mm_hot.py
+          python examples/python/strategies/skew_mm.py

fastmm_engine-0.2.0/.github/workflows/docs.yml

@@ -0,0 +1,98 @@
+name: docs
+
+# Builds the documentation site (mkdocs.yml) and publishes it to GitHub Pages.
+# A pull request builds it strictly without deploying, so a broken page or link fails before merge.
+
+# GitHub Actions does not expand YAML anchors, so the two path lists are kept identical by hand.
+on:
+  push:
+    branches: [main]
+    paths:
+      - docs/**
+      - include/**
+      - python/**
+      - doxygen/**
+      - mkdocs.yml
+      - tools/mkdocs_hooks.py
+      - tools/doxygen_filter.py
+      - tools/griffe_fastmm.py
+      - scripts/docs-serve.sh
+      - CMakeLists.txt
+      - .github/workflows/docs.yml
+  pull_request:
+    paths:
+      - docs/**
+      - include/**
+      - python/**
+      - doxygen/**
+      - mkdocs.yml
+      - tools/mkdocs_hooks.py
+      - tools/doxygen_filter.py
+      - tools/griffe_fastmm.py
+      - scripts/docs-serve.sh
+      - CMakeLists.txt
+      - .github/workflows/docs.yml
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: docs-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  build:
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+          cache: pip
+          cache-dependency-path: docs/requirements.txt
+
+      - name: doxygen (the C++ reference)
+        run: |
+          sudo apt-get update
+          sudo apt-get install --yes --no-install-recommends doxygen
+          doxygen --version
+
+      - run: pip install --requirement docs/requirements.txt
+
+      # --strict fails on a broken link, a missing anchor, a page that is not in the nav and a
+      # docstring that mkdocstrings cannot resolve; tools/mkdocs_hooks.py adds the C++ reference.
+      - name: mkdocs build --strict
+        run: mkdocs build --strict
+
+      - name: the generated reference is not empty
+        run: |
+          test -s site/api/cpp/index.html
+          test -s site/api/python/index.html
+          test -s site/api/cpp/classfastmm_1_1QuoteManager.html
+          test -s site/search/search_index.json
+
+      - uses: actions/upload-pages-artifact@v3
+        if: github.event_name != 'pull_request'
+        with:
+          path: site
+
+  deploy:
+    if: github.event_name != 'pull_request'
+    needs: build
+    runs-on: ubuntu-24.04
+    permissions:
+      pages: write
+      id-token: write
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    # One deployment at a time, and never cancel one halfway.
+    concurrency:
+      group: github-pages
+      cancel-in-progress: false
+    steps:
+      - uses: actions/configure-pages@v5
+      - id: deployment
+        uses: actions/deploy-pages@v4

fastmm_engine-0.2.0/.github/workflows/release.yml

@@ -0,0 +1,81 @@
+name: release
+# On a `v*` tag: builds the portable tarball (scripts/package-release.sh), attaches it and its
+# SHA-256 to a GitHub Release with the CHANGELOG section as the notes, and pushes the production
+# image to GHCR. The PyPI distributions are built and published by wheels.yml on the same tag.
+# A manual run takes an existing tag and repeats both.
+on:
+  push:
+    tags: ["v*"]
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Existing tag to release, e.g. v0.2.0"
+        required: true
+permissions:
+  contents: read
+env:
+  TAG: ${{ inputs.tag || github.ref_name }}
+
+jobs:
+  tarball:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 90
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v4
+        with: { ref: "${{ inputs.tag || github.ref }}" }
+      - name: install
+        run: sudo apt-get update && sudo apt-get install -y g++-13 ninja-build libssl-dev zlib1g-dev
+      - uses: actions/cache@v4
+        with:
+          path: ~/.cache/CPM
+          key: cpm-${{ hashFiles('cmake/Dependencies.cmake', 'cmake/CPM.cmake') }}
+      # The `release` preset, not `release-dpdk`: a hosted runner has no NIC to bind and building
+      # DPDK here would triple the job. A DPDK tarball is a local `scripts/package-release.sh` run.
+      - name: build the tarball
+        run: ./scripts/package-release.sh --preset release --out dist
+      - name: the checksum matches and the binaries run
+        run: |
+          (cd dist && sha256sum -c ./*.sha256)   # the file names one bare tarball, in dist/
+          tar xzf dist/*.tar.gz -C dist
+          dist/fastmm-*/bin/fastmm-live --version
+          dist/fastmm-*/bin/fastmm-top --help > /dev/null
+      - name: release notes from the CHANGELOG
+        run: |
+          awk -v v="${TAG#v}" '
+            $0 ~ "^## \\[" v "\\]" { on = 1; next }
+            on && /^## \[/ { exit }
+            on { print }' CHANGELOG.md > notes.md
+          printf '\n[Install](https://ziy.bio/FastMM/getting-started/install/) - [Deploy](https://ziy.bio/FastMM/how-to/operations/deploy/)\n' >> notes.md
+          test -s notes.md
+      - name: publish the release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh release create "$TAG" --title "FastMM ${TAG#v}" --notes-file notes.md --verify-tag \
+            dist/*.tar.gz dist/*.tar.gz.sha256
+
+  image:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 90
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - uses: actions/checkout@v4
+        with: { ref: "${{ inputs.tag || github.ref }}" }
+      # GHCR repository names are lower case; ${{ github.repository }} is not.
+      - name: build the production image
+        run: |
+          docker build -f docker/Dockerfile.production --build-arg "VERSION=${TAG#v}" \
+            -t "ghcr.io/ziyangliu-666/fastmm:${TAG#v}" -t ghcr.io/ziyangliu-666/fastmm:latest .
+      - name: the image runs as uid 10001 and starts
+        run: |
+          test "$(docker run --rm --entrypoint id "ghcr.io/ziyangliu-666/fastmm:${TAG#v}" -u)" = 10001
+          docker run --rm "ghcr.io/ziyangliu-666/fastmm:${TAG#v}" fastmm-live --version
+      - name: push to GHCR
+        run: |
+          echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u "${{ github.actor }}" --password-stdin
+          docker push "ghcr.io/ziyangliu-666/fastmm:${TAG#v}"
+          docker push ghcr.io/ziyangliu-666/fastmm:latest

fastmm_engine-0.2.0/.github/workflows/wheels.yml

@@ -0,0 +1,84 @@
+name: wheels
+# Builds the wheels (manylinux_2_28 x86_64): fastmm-engine for CPython 3.9-3.14 and fastmm-engine-live for
+# CPython 3.10-3.14, plus the fastmm-engine sdist, and uploads them as artifacts. Each build job runs
+# the test suite of the wheel it built; publishing needs all three jobs green.
+#
+# Publishing to PyPI uses the repository secret PYPI_API_TOKEN (a project-scoped API token) in the
+# environment "pypi", and happens on a `v*` tag push, or from a manual run with "publish" checked.
+# The environment's deployment rules have to admit the tag ref, or the tag run stops before uploading.
+on:
+  workflow_dispatch:
+    inputs:
+      publish:
+        description: "Publish the built distributions to PyPI"
+        type: boolean
+        default: false
+  push:
+    tags: ["v*"]
+
+jobs:
+  sdist:
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with: { python-version: "3.12" }
+      - name: build sdist
+        run: python -m pip install build twine && python -m build --sdist && python -m twine check dist/*
+      - uses: actions/upload-artifact@v4
+        with: { name: sdist, path: dist/*.tar.gz }
+
+  wheels:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 120
+    steps:
+      - uses: actions/checkout@v4
+      - uses: pypa/cibuildwheel@v4.2.1
+        env:
+          CIBW_BUILD: "cp39-manylinux_x86_64 cp310-manylinux_x86_64 cp311-manylinux_x86_64 cp312-manylinux_x86_64 cp313-manylinux_x86_64 cp314-manylinux_x86_64"
+          CIBW_MANYLINUX_X86_64_IMAGE: manylinux_2_28
+          CIBW_ENVIRONMENT: "CPM_SOURCE_CACHE=/tmp/cpm"
+          CIBW_TEST_REQUIRES: "pytest pandas"
+          CIBW_TEST_COMMAND: "python -m pytest {project}/python/tests -q"
+      - uses: actions/upload-artifact@v4
+        with: { name: wheels, path: wheelhouse/*.whl }
+
+  live-wheels:
+    needs: wheels
+    runs-on: ubuntu-24.04
+    timeout-minutes: 150
+    steps:
+      - uses: actions/checkout@v4
+      # cibuildwheel copies the checkout, wheelhouse/ included, into the container: before the tests,
+      # fastmm-engine is installed from /project/wheelhouse only.
+      - uses: actions/download-artifact@v4
+        with: { name: wheels, path: wheelhouse }
+      - uses: pypa/cibuildwheel@v4.2.1
+        with:
+          package-dir: python/live
+        env:
+          CIBW_BUILD: "cp310-manylinux_x86_64 cp311-manylinux_x86_64 cp312-manylinux_x86_64 cp313-manylinux_x86_64 cp314-manylinux_x86_64"
+          CIBW_MANYLINUX_X86_64_IMAGE: manylinux_2_28
+          # OpenSSL 3, pinned and checksum-verified, static and position-independent.
+          CIBW_BEFORE_ALL: "bash {project}/scripts/wheels/build-openssl.sh /opt/fastmm-openssl"
+          CIBW_ENVIRONMENT: "CPM_SOURCE_CACHE=/tmp/cpm OPENSSL_ROOT_DIR=/opt/fastmm-openssl FASTMM_OPENSSL_STATIC=ON"
+          # auditwheel repair, then: no libssl or libcrypto needed or bundled, only PyInit__live exported.
+          CIBW_REPAIR_WHEEL_COMMAND: "auditwheel repair -w {dest_dir} {wheel} && bash {project}/scripts/wheels/check-live-wheel.sh {dest_dir}/fastmm_engine_live-*.whl"
+          CIBW_BEFORE_TEST: "pip install numpy && pip install --no-index --find-links {project}/wheelhouse fastmm-engine"
+          CIBW_TEST_REQUIRES: "pytest"
+          CIBW_TEST_COMMAND: "python -m pytest {project}/python/live/tests -q"
+      - uses: actions/upload-artifact@v4
+        with: { name: live-wheels, path: wheelhouse/fastmm_engine_live-*.whl }
+
+  publish:
+    if: startsWith(github.ref, 'refs/tags/v') || inputs.publish
+    needs: [sdist, wheels, live-wheels]
+    runs-on: ubuntu-24.04
+    environment: pypi
+    steps:
+      - uses: actions/download-artifact@v4
+        with: { path: dist, merge-multiple: true }
+      - uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          password: ${{ secrets.PYPI_API_TOKEN }}
+          print-hash: true