openodd-py 0.2.1__tar.gz

openodd_py-0.2.1/.github/workflows/ci.yml

@@ -0,0 +1,35 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  rust:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: clippy, rustfmt
+      - uses: Swatinem/rust-cache@v2
+      - run: cargo fmt --check
+      - run: cargo clippy --all-features --all-targets -- -D warnings
+      - run: cargo test
+
+  python:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python: ["3.10", "3.12", "3.13"]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@v2
+      - uses: astral-sh/setup-uv@v6
+        with:
+          python-version: ${{ matrix.python }}
+      - run: uv venv && uv pip install maturin pytest hypothesis pyyaml
+      - run: uv run --no-project maturin develop
+      - run: uv run --no-project pytest -q

openodd_py-0.2.1/.github/workflows/release-label.yml

@@ -0,0 +1,72 @@
+name: Release label
+
+# The release workflow reads `release:major|minor|patch` off a PR once it is merged
+# into main. This checks the same thing while the PR is still open, so a mistake shows
+# up as a red check rather than as a failed (or missing) release after the merge:
+#
+#   - the three labels exist in the repository, and are created if they do not;
+#   - the PR carries at most one of them (the release job refuses more than one);
+#   - the job summary says which bump the merge will cut, or that it cuts none.
+#
+# Its own workflow rather than a job in ci.yml, so that adding or removing a label
+# re-runs this check and not the whole build.
+
+on:
+  pull_request:
+    types: [opened, reopened, synchronize, labeled, unlabeled]
+
+permissions:
+  contents: read
+  issues: write         # create a missing release label
+  pull-requests: read
+
+jobs:
+  release-label:
+    name: release label
+    runs-on: ubuntu-latest
+    steps:
+      - name: the release labels exist in the repository
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          REPO: ${{ github.repository }}
+        run: |
+          set -euo pipefail
+          existing=$(gh api "repos/$REPO/labels" --paginate --jq '.[].name')
+          for spec in "major:d73a4a:Merging this PR cuts a major release" \
+                      "minor:fbca04:Merging this PR cuts a minor release" \
+                      "patch:0e8a16:Merging this PR cuts a patch release"; do
+            IFS=: read -r lvl color desc <<< "$spec"
+            name="release:$lvl"
+            if grep -qxF "$name" <<< "$existing"; then
+              echo "$name exists"
+              continue
+            fi
+            # A PR from a fork gets a read-only token, so creating can fail; say what
+            # is missing instead of an opaque API error.
+            if gh api "repos/$REPO/labels" -f name="$name" -f color="$color" \
+                 -f description="$desc" > /dev/null; then
+              echo "created $name"
+            else
+              echo "::error::label $name does not exist and could not be created"
+              exit 1
+            fi
+          done
+
+      - name: at most one release label on this PR
+        env:
+          LABELS: ${{ toJSON(github.event.pull_request.labels.*.name) }}
+        run: |
+          set -euo pipefail
+          found=$(jq -r '.[] | select(test("^release:(major|minor|patch)$"))' <<< "$LABELS")
+          count=$(grep -c . <<< "$found" || true)
+          if [ "$count" -gt 1 ]; then
+            echo "::error::More than one release label on the PR ($(paste -sd, <<< "$found")) -- pick exactly one"
+            exit 1
+          fi
+          if [ "$count" -eq 1 ]; then
+            msg="Merging this PR cuts a **${found#release:}** release."
+          else
+            msg="No release label: merging this PR cuts no release."
+          fi
+          echo "$msg"
+          echo "$msg" >> "$GITHUB_STEP_SUMMARY"

openodd_py-0.2.1/.github/workflows/release.yml

@@ -0,0 +1,322 @@
+# Cuts releases and publishes them to the GitHub release and PyPI. The mechanism is simple_lanelet2's.
+#
+# There are three ways in, and the first is the everyday one:
+#
+#   push to main   when a merged PR carries exactly one `release:major|minor|patch`
+#                  label, the `release` job bumps the version, tags it `vX.Y.Z`, and the
+#                  tag is built and published -- all in this one run.
+#   push a v* tag  a hand-cut tag (a hotfix, say) is built and published directly; the
+#                  `release` job is skipped.
+#   workflow_dispatch   builds the wheels and sdist without tagging or publishing, to
+#                  eyeball a release before committing to it.
+#
+# The publish happens as a follow-up job here rather than in a separate `on: push:
+# tags` workflow on purpose: the auto-release tag is pushed with GITHUB_TOKEN, and a
+# token-pushed tag does not start new workflow runs.
+#
+# Every release's wheels and sdist are attached to its GitHub release, whose assets
+# page is a find-links index (`uv`/`pip --find-links
+# https://github.com/hakuturu583/openodd_py/releases/expanded_assets/<tag>`).
+#
+# Every release is also published to PyPI with Trusted Publishing, so no token is
+# stored here. Configure it once on PyPI: project openodd-py, owner hakuturu583,
+# repository openodd_py, workflow release.yml, environment pypi. Until that exists the
+# publish job fails, while the GitHub release still carries the files.
+#
+# A version can never be replaced on PyPI, so the tests run again here rather than
+# trusting that CI was green on the same commit.
+
+name: Release
+
+on:
+  push:
+    branches: [main]
+    tags: ["v*"]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  # Read the release label off the merged PR and, if there is one, bump the version
+  # and push the tag. Runs only on a push to main; a tag push or a manual dispatch
+  # skips it and falls straight through to the build.
+  release:
+    name: cut the release tag
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: read   # the commit -> PR lookup below
+    # Two release merges close together would both bump the same main and race on the
+    # push. Queue them instead: the second checks out main only once the first has
+    # pushed its bump, so it bumps from there.
+    concurrency:
+      group: release-bump
+      cancel-in-progress: false
+    outputs:
+      bump: ${{ steps.pr.outputs.bump }}
+      tag: ${{ steps.bump.outputs.tag }}
+    steps:
+      - name: read the release label off the merged PR
+        id: pr
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          # A failed lookup fails the job: swallowing it would read as "no PR" and
+          # drop a labelled merge's release without a trace.
+          pr_json=$(gh api repos/${{ github.repository }}/commits/${{ github.sha }}/pulls \
+            --jq '.[0] // empty')
+          if [ -z "$pr_json" ]; then
+            echo "No PR associated with this push -- nothing to release"
+            echo "bump=none" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          labels=$(echo "$pr_json" | jq -r '[.labels[].name] | join(",")')
+          bump=none
+          count=0
+          for lvl in major minor patch; do
+            if echo ",$labels," | grep -q ",release:${lvl},"; then
+              bump=$lvl
+              count=$((count + 1))
+            fi
+          done
+          if [ "$count" -gt 1 ]; then
+            echo "::error::More than one release label on the PR -- pick exactly one"
+            exit 1
+          fi
+          echo "bump=${bump}" >> "$GITHUB_OUTPUT"
+          echo "Resolved bump level: ${bump}"
+
+      - uses: actions/checkout@v4
+        if: steps.pr.outputs.bump != 'none'
+        with:
+          ref: main
+          fetch-depth: 0
+
+      - name: bump Cargo.toml and Cargo.lock together
+        if: steps.pr.outputs.bump != 'none'
+        id: bump
+        run: |
+          set -euo pipefail
+          next=$(python3 tools/bump_version.py "${{ steps.pr.outputs.bump }}")
+          echo "next=${next}" >> "$GITHUB_OUTPUT"
+          echo "tag=v${next}" >> "$GITHUB_OUTPUT"
+          echo "Bumped to ${next} (${{ steps.pr.outputs.bump }})"
+
+      - name: fail if the tag already exists
+        if: steps.pr.outputs.bump != 'none'
+        run: |
+          if git rev-parse "refs/tags/${{ steps.bump.outputs.tag }}" >/dev/null 2>&1; then
+            echo "Tag ${{ steps.bump.outputs.tag }} already exists" >&2
+            exit 1
+          fi
+
+      - name: commit, tag and push
+        if: steps.pr.outputs.bump != 'none'
+        run: |
+          set -euo pipefail
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git add Cargo.toml Cargo.lock
+          git commit -m "chore(release): ${{ steps.bump.outputs.tag }}"
+          git tag -a "${{ steps.bump.outputs.tag }}" -m "Release ${{ steps.bump.outputs.tag }}"
+          git push origin "HEAD:main"
+          git push origin "${{ steps.bump.outputs.tag }}"
+
+  # One place to work out, for all three entry points, which commit to build and whether
+  # it may be published. Runs even when `release` is skipped (tag push, dispatch).
+  resolve:
+    name: resolve what to build
+    needs: [release]
+    if: always()
+    runs-on: ubuntu-latest
+    outputs:
+      proceed: ${{ steps.r.outputs.proceed }}
+      ref: ${{ steps.r.outputs.ref }}
+      publish: ${{ steps.r.outputs.publish }}
+      version: ${{ steps.r.outputs.version }}
+    steps:
+      - id: r
+        env:
+          EVENT: ${{ github.event_name }}
+          REF: ${{ github.ref }}
+          REF_NAME: ${{ github.ref_name }}
+          BUMP: ${{ needs.release.outputs.bump }}
+          TAG: ${{ needs.release.outputs.tag }}
+        run: |
+          set -euo pipefail
+          proceed=false; publish=false; ref="$REF_NAME"
+          if [ "$EVENT" = "push" ] && [[ "$REF" == refs/tags/v* ]]; then
+            # A hand-cut tag: build and publish it.
+            proceed=true; publish=true; ref="$REF_NAME"
+          elif [ "$EVENT" = "push" ] && [ "$REF" = "refs/heads/main" ]; then
+            # The auto-release path: build and publish only if a tag was cut.
+            if [ "$BUMP" != "none" ] && [ -n "$TAG" ]; then
+              proceed=true; publish=true; ref="$TAG"
+            fi
+          elif [ "$EVENT" = "workflow_dispatch" ]; then
+            # A dry run: build the artifacts, publish nothing.
+            proceed=true; publish=false; ref="$REF_NAME"
+          fi
+          version=""
+          if [ "$publish" = true ]; then version="${ref#v}"; fi
+          echo "proceed=$proceed" >> "$GITHUB_OUTPUT"
+          echo "publish=$publish" >> "$GITHUB_OUTPUT"
+          echo "ref=$ref" >> "$GITHUB_OUTPUT"
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+          echo "event=$EVENT ref=$ref proceed=$proceed publish=$publish version=$version"
+
+  verify:
+    name: test the tagged commit
+    needs: [resolve]
+    # `release` is skipped on a tag push or a dispatch, and a skipped ancestor skips
+    # every job downstream unless its condition says otherwise -- hence `!cancelled()`.
+    if: ${{ !cancelled() && needs.resolve.result == 'success' && needs.resolve.outputs.proceed == 'true' }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ needs.resolve.outputs.ref }}
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: astral-sh/setup-uv@v6
+        with:
+          python-version: "3.12"
+
+      # pyproject.toml declares the version dynamic, so Cargo.toml is the one source;
+      # the lock file must agree with it or `cargo --locked` fails downstream.
+      - name: the version in the tag must be the version in the package
+        if: needs.resolve.outputs.publish == 'true'
+        env:
+          TAG: ${{ needs.resolve.outputs.version }}
+        run: |
+          CRATE=$(python3 tools/bump_version.py --current)
+          echo "tag=$TAG cargo=$CRATE"
+          test "$TAG" = "$CRATE"
+          cargo metadata --locked --format-version 1 --no-deps > /dev/null
+
+      - run: cargo test --locked
+      - run: uv venv && uv pip install maturin pytest hypothesis pyyaml
+      - run: uv run --no-project maturin develop
+      - run: uv run --no-project pytest -q
+
+  wheels:
+    name: wheel (${{ matrix.os }} ${{ matrix.target }})
+    needs: [resolve, verify]
+    if: ${{ !cancelled() && needs.verify.result == 'success' }}
+    runs-on: ${{ matrix.runner }}
+    strategy:
+      matrix:
+        # Every target on a runner of its own architecture, so the wheel that is
+        # uploaded is also the wheel that is tested below.
+        include:
+          - { os: linux, runner: ubuntu-latest, target: x86_64 }
+          - { os: linux, runner: ubuntu-24.04-arm, target: aarch64 }
+          - { os: macos, runner: macos-latest, target: universal2-apple-darwin }
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ needs.resolve.outputs.ref }}
+      # abi3-py310, so one wheel per platform serves every Python 3.10+.
+      # `manylinux` is ignored on macOS.
+      - uses: PyO3/maturin-action@v1
+        with:
+          target: ${{ matrix.target }}
+          args: --release --out dist
+          manylinux: auto
+      # The artifact itself, installed clean and run against the tests -- not a
+      # rebuild of the same sources.
+      - uses: astral-sh/setup-uv@v6
+      - name: test the wheel that is about to be published
+        run: |
+          uv venv --python 3.12 "$RUNNER_TEMP/fresh"
+          uv pip install --python "$RUNNER_TEMP/fresh" dist/*.whl pytest hypothesis pyyaml
+          # Run from a directory without python/openodd, so the installed wheel is
+          # what gets imported.
+          cp -r tests "$RUNNER_TEMP/tests"
+          cd "$RUNNER_TEMP" && "$RUNNER_TEMP/fresh/bin/python" -m pytest tests -q
+      - uses: actions/upload-artifact@v4
+        with:
+          name: wheel-${{ matrix.os }}-${{ matrix.target }}
+          path: dist
+
+  sdist:
+    name: sdist
+    needs: [resolve, verify]
+    if: ${{ !cancelled() && needs.verify.result == 'success' }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ needs.resolve.outputs.ref }}
+      - uses: PyO3/maturin-action@v1
+        with:
+          command: sdist
+          args: --out dist
+      - uses: actions/upload-artifact@v4
+        with:
+          name: sdist
+          path: dist
+
+  # The GitHub release, created for an auto-cut and a hand-cut tag alike, once the
+  # wheels have passed -- so a release page never exists without its files.
+  github-release:
+    name: GitHub release with the wheels attached
+    needs: [resolve, wheels, sdist]
+    if: ${{ !cancelled() && needs.wheels.result == 'success' && needs.sdist.result == 'success' && needs.resolve.outputs.publish == 'true' }}
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          pattern: wheel-*
+          path: dist
+          merge-multiple: true
+      - uses: actions/download-artifact@v4
+        with:
+          name: sdist
+          path: dist
+      - uses: softprops/action-gh-release@v2
+        with:
+          tag_name: ${{ needs.resolve.outputs.ref }}
+          files: dist/*
+          generate_release_notes: true
+
+  publish:
+    name: publish to PyPI
+    needs: [resolve, wheels, sdist]
+    if: ${{ !cancelled() && needs.wheels.result == 'success' && needs.sdist.result == 'success' && needs.resolve.outputs.publish == 'true' }}
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/p/openodd-py
+    permissions:
+      id-token: write   # Trusted Publishing; no token in secrets.
+    steps:
+      # Named explicitly rather than "everything in the run", so nothing else a later
+      # job uploads can end up in dist/.
+      - uses: actions/download-artifact@v4
+        with:
+          pattern: wheel-*
+          path: dist
+          merge-multiple: true
+      - uses: actions/download-artifact@v4
+        with:
+          name: sdist
+          path: dist
+      - run: ls -l dist
+
+      # PyPI rejects bad metadata only after the build and the OIDC exchange; failing
+      # here costs nothing.
+      - name: check the metadata before uploading
+        run: pipx run twine check --strict dist/*
+
+      # PyPI refuses to replace a file but accepts new ones for an existing release,
+      # so skipping what is already there lets a re-run add what an earlier attempt
+      # failed to upload.
+      - uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          skip-existing: true

openodd_py-0.2.1/.gitignore

@@ -0,0 +1,7 @@
+/target
+/.venv
+__pycache__/
+*.so
+*.pyd
+/dist
+.pytest_cache/