sismatic 0.1.2__tar.gz

sismatic-0.1.2/.cargo/config.toml

@@ -0,0 +1,9 @@
+# Building the pyo3 `extension-module` cdylib resolves CPython symbols at load
+# time, so the linker must be told to leave them undefined. maturin sets this
+# automatically; this config lets a plain `cargo build --features python` link
+# too. It is harmless for the default (no-python) builds and the test binaries.
+[target.aarch64-apple-darwin]
+rustflags = ["-C", "link-arg=-undefined", "-C", "link-arg=dynamic_lookup"]
+
+[target.x86_64-apple-darwin]
+rustflags = ["-C", "link-arg=-undefined", "-C", "link-arg=dynamic_lookup"]

sismatic-0.1.2/.envrc

@@ -0,0 +1,24 @@
+#------------------------------------------------------------------------------#
+#                             Flake Prerequisites                              #
+#                                 (idempotent)                                 #
+#------------------------------------------------------------------------------#
+# Day-0 Steps (Ensure the following)
+[ -f Cargo.toml ] || cargo init .; git ls-files --error-unmatch Cargo.toml >/dev/null 2>&1 || git add Cargo.toml
+[ -f Cargo.lock ] || cargo generate-lockfile; git ls-files --error-unmatch Cargo.lock </dev/null 2>&1 || git add Cargo.lock
+
+git ls-files --error-unmatch .envrc || git add .envrc
+git ls-files --error-unmatch flake.nix || git add flake.nix
+git ls-files --error-unmatch rust-toolchain.toml || git add rust-toolchain.toml
+
+
+# .gitignore contains result and result-* as Nix will output build artifacts there.
+
+# (optional) for direnv flake activation (does not create subprocess) devShell
+use flake
+
+#------------------------------------------------------------------------------#
+#                         Post-flake activation setup                          #
+#------------------------------------------------------------------------------#
+
+git ls-files --error-unmatch flake.lock || git add flake.lock
+git ls-files --error-unmatch deny.toml || {cargo deny init && git add deny.toml}

sismatic-0.1.2/.github/actions/nix/action.yml

@@ -0,0 +1,23 @@
+name: Nix setup
+description: >
+  Install Nix with flakes enabled and restore the shared Nix store cache.
+  The cache key is scoped by OS *and* arch so the two macOS runners
+  (Intel macos-13 / Apple-silicon macos-14) don't clobber each other.
+
+runs:
+  using: composite
+  steps:
+    - uses: cachix/install-nix-action@v31
+      with:
+        extra_nix_config: |
+          experimental-features = nix-command flakes
+
+    - uses: nix-community/cache-nix-action@v6
+      with:
+        primary-key: nix-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('**/*.nix', '**/flake.lock', '**/Cargo.lock') }}
+        restore-prefixes-first-match: nix-${{ runner.os }}-${{ runner.arch }}-
+        gc-max-store-size-linux: 1G
+        purge: true
+        purge-prefixes: nix-${{ runner.os }}-${{ runner.arch }}-
+        purge-created: 0
+        purge-primary-key: never

sismatic-0.1.2/.github/workflows/pipeline.yml

@@ -0,0 +1,186 @@
+name: Build & Release
+
+# Every step below is defined in flake.nix and runs identically on a laptop:
+#   nix flake check          # fmt, clippy, tests, audit, deny, coverage
+#   nix build .#             # the crate
+#   nix build .#wheel        # hermetic (nixpkgs-linked) wheel
+#   nix run .#build-wheel    # portable wheel (manylinux_2_28 via zig on Linux)
+#   nix run .#build-sdist    # source distribution
+# This workflow is only a dispatcher: it installs Nix (./.github/actions/nix)
+# and invokes those outputs. No build logic lives here.
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+    tags: ["v*"]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+# Supersede in-flight PR runs on a new push; never cancel main/tag builds
+# (those may be producing a release).
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  # nix flake check + the crate build — the whole validation suite, all from
+  # the flake. Uses default features, so aws-lc-sys is not compiled here.
+  checks:
+    name: Checks + crate
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ./.github/actions/nix
+
+      - name: nix flake check
+        run: nix flake check --print-build-logs
+
+      - name: Build crate
+        run: nix build .# --out-link result-crate --print-build-logs
+
+      - name: Stage crate
+        run: |
+          mkdir -p out/crate
+          cp -Lr result-crate/. out/crate/
+      - uses: actions/upload-artifact@v4
+        with:
+          name: crate
+          path: out/crate/**
+          if-no-files-found: error
+
+  # Portable wheels: one native runner per platform, each running the same
+  # `nix run .#build-wheel`. The cargo cache below keeps repeat runs from
+  # recompiling aws-lc-sys (pulled in by russh) from scratch.
+  wheels:
+    name: Wheel ${{ matrix.runner }}
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        # ubuntu = x86_64 linux, macos-15-intel = x86_64 macOS,
+        # macos-14 = aarch64 macOS.
+        runner: [ubuntu-latest, macos-15-intel, macos-14]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ./.github/actions/nix
+
+      # Nix caches the toolchain/maturin/zig/cmake; this caches the *cargo*
+      # build (crates + target/), so aws-lc-sys is only compiled once per
+      # platform+lockfile. Keyed by runner (not runner.os) to keep the two
+      # macOS archs separate.
+      - name: Cache cargo build
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/registry/index
+            ~/.cargo/registry/cache
+            ~/.cargo/git/db
+            target
+          key: wheel-cargo-${{ matrix.runner }}-${{ hashFiles('Cargo.lock', 'rust-toolchain.toml') }}
+          restore-keys: |
+            wheel-cargo-${{ matrix.runner }}-
+
+      - name: Build portable wheel
+        run: nix run .#build-wheel
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: wheel-${{ matrix.runner }}
+          path: dist/*.whl
+          if-no-files-found: error
+
+  sdist:
+    name: Source distribution
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ./.github/actions/nix
+
+      - name: Build sdist
+        run: nix run .#build-sdist
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: sdist
+          path: dist/*.tar.gz
+          if-no-files-found: error
+
+  # On a v* tag, gather every artifact and attach it to a GitHub Release.
+  release:
+    name: GitHub Release
+    if: startsWith(github.ref, 'refs/tags/')
+    needs: [checks, wheels, sdist]
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          path: artifacts
+
+      - name: Collect release files
+        run: |
+          mkdir -p release
+          find artifacts -type f \( -name '*.whl' -o -name '*.tar.gz' \) \
+            -exec cp -n {} release/ \;
+          if [ -d artifacts/crate ]; then
+            tar -czf "release/sismatic-crate-${GITHUB_REF_NAME}.tar.gz" \
+              -C artifacts/crate .
+          fi
+          ls -l release
+
+      - uses: softprops/action-gh-release@v2
+        with:
+          files: release/*
+          generate_release_notes: true
+
+  # On a v* tag, ship the built wheels + sdist to PyPI. Inlined here rather than
+  # split into a reusable workflow: PyPI's PEP 740 attestation records this file
+  # (the top-level workflow_ref) as its Build Config URI, so publishing from a
+  # reusable workflow makes that identity disagree with the OIDC
+  # job_workflow_ref and PyPI rejects the upload. Keeping it inline means both
+  # the OIDC auth and the attestation resolve to pipeline.yml — configure
+  # sismatic's PyPI Trusted Publisher to this file (pipeline.yml) and the `pypi`
+  # environment below.
+  publish-pypi:
+    name: Publish to PyPI
+    if: startsWith(github.ref, 'refs/tags/')
+    needs: [checks, wheels, sdist]
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    environment:
+      name: pypi
+      url: https://pypi.org/project/sismatic/
+    permissions:
+      # Required for Trusted Publishing (OIDC) and PEP 740 attestations.
+      id-token: write
+    steps:
+      # Wheels + sdist were uploaded earlier in this same run, so no run-id is
+      # needed — download-artifact pulls them straight from the current run.
+      - name: Download pipeline artifacts
+        uses: actions/download-artifact@v4
+        with:
+          path: artifacts
+
+      # Gather only the Python distributions. The pipeline also uploads a crate
+      # tarball (sismatic-crate-*.tar.gz), which is not a PyPI artifact.
+      - name: Collect wheels + sdist
+        run: |
+          mkdir -p dist
+          find artifacts \( -name '*.whl' -o -name '*.tar.gz' \) \
+            -not -name '*crate*' -exec cp -n {} dist/ \;
+          echo "Files to publish:"
+          ls -l dist
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          packages-dir: dist
+          print-hash: true

sismatic-0.1.2/.gitignore

@@ -0,0 +1,5 @@
+/target
+.direnv
+result
+result-*
+dist