CI.yml

name: CI

on:
  push:
    branches:
      - main
    tags:
      - '*'
  workflow_dispatch:
  pull_request:

permissions:
  contents: read

concurrency:
  group: ci-${{ github.ref_name }}
  cancel-in-progress: true

jobs:

  lint:
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac
      - uses: actions/setup-python@v5
        with:
          python-version: '3.10'
      - run: pip install pre-commit
        name: Install pre-commit
      - run: pre-commit run --all
        name: Run pre-commit checks

  test:
    timeout-minutes: 20
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-22.04, macos-13, windows-latest]
        python_version: ['3.7', '3.8', '3.9', '3.10', '3.11', '3.12', '3.13', 'pypy-3.9', 'pypy-3.10']
        exclude:
          # circumvent wierd issue with qh3.asyncio+windows+proactor loop...
          - python_version: pypy-3.9
            os: windows-latest
          - python_version: pypy-3.10
            os: windows-latest
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac
      - uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python_version }}
          allow-prereleases: true
      - name: Setup nox
        run: pip install nox
      - name: Set up Clang (Linux)
        if: matrix.os == 'ubuntu-22.04'
        run: sudo apt-get install clang
      - name: Set up Clang (Cygwin)
        if: matrix.os == 'windows-latest'
        run: choco install llvm -y
      - uses: ilammy/setup-nasm@v1
        if: matrix.os == 'windows-latest'
      - name: Run test CPython
        if: startsWith(matrix.python_version, 'pypy') == false
        run: nox -s test-${{ matrix.python_version }}
      - name: Run test PyPy
        if: startsWith(matrix.python_version, 'pypy')
        run: nox -s test-pypy
      - name: "Upload artifact"
        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808
        with:
          name: coverage-data-${{ matrix.os }}-${{ matrix.python_version }}
          path: ".coverage.*"
          if-no-files-found: error

  coverage:
    if: always()
    runs-on: "ubuntu-latest"
    needs: test
    steps:
      - name: "Checkout repository"
        uses: "actions/checkout@d632683dd7b4114ad314bca15554477dd762a938"

      - name: "Setup Python"
        uses: "actions/setup-python@3fddbee7870211eda9047db10474808be43c71ec"
        with:
          python-version: "3.x"

      - name: "Install coverage"
        run: "python -m pip install --upgrade coverage"

      - name: "Download artifact"
        uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e # v4.1.7
        with:
          pattern: coverage-data-*
          merge-multiple: true

      - name: "Combine & check coverage"
        run: |
          python -m coverage combine
          python -m coverage html --skip-covered --skip-empty
          python -m coverage report --ignore-errors --show-missing --fail-under=98

      - name: "Upload report"
        uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce
        with:
          name: coverage-report
          path: htmlcov

  integration:
    timeout-minutes: 20
    strategy:
      fail-fast: false
      matrix:
        os: [ ubuntu-22.04, macos-13, windows-latest ]
        python_version: [ '3.13', 'pypy-3.10' ]
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac
      - uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python_version }}
          allow-prereleases: true
      - name: Setup nox
        run: pip install nox
      - name: Set up Clang (Linux)
        if: matrix.os == 'ubuntu-22.04'
        run: sudo apt-get install clang
      - name: Set up Clang (Cygwin)
        if: matrix.os == 'windows-latest'
        run: choco install llvm -y
      - uses: ilammy/setup-nasm@v1
        if: matrix.os == 'windows-latest'
      - name: Run test
        run: nox -s downstream_niquests

  linux:
    runs-on: ubuntu-22.04
    needs:
      - test
      - lint
      - integration
    strategy:
      fail-fast: false
      matrix:
        target: [ x86_64, s390x, aarch64, armv7l, ppc64le, ppc64, i686 ]
        python_version: [ '3.10', 'pypy-3.7', 'pypy-3.8', 'pypy-3.9', 'pypy-3.10', '3.13t' ]
        manylinux: [ 'manylinux2014', 'musllinux_1_1' ]
        exclude:
          - manylinux: musllinux_1_1
            target: s390x
          - manylinux: musllinux_1_1
            target: ppc64
          - manylinux: musllinux_1_1
            target: ppc64le

    steps:
      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac
      - uses: actions/setup-python@v5
        if: matrix.python_version != '3.13t'
        with:
          python-version: ${{ matrix.python_version }}
      - uses: Quansight-Labs/setup-python@v5
        if: matrix.python_version == '3.13t'
        with:
          python-version: 3.13t
      - name: Build wheels (no workarounds)
        if: matrix.target == 'x86_64'
        uses: PyO3/maturin-action@v1
        env:
          UNSAFE_PYO3_SKIP_VERSION_CHECK: 1
        with:
          target: ${{ matrix.target }}
          args: --release --out dist --interpreter ${{ matrix.python_version }}
          sccache: 'true'
          manylinux: ${{ matrix.manylinux }}
          docker-options: -e UNSAFE_PYO3_SKIP_VERSION_CHECK=1
          before-script-linux: |
            sudo apt-get update || echo "no apt support"
            sudo apt-get install -y libclang || echo "no apt support"
            sudo apt-get install -y libc6 || echo "no apt support"
            sudo apt-get install -y libc6-dev || echo "no apt support"
            sudo apt-get install -y libclang-dev || echo "no apt support"
            sudo apt-get install -y clang || echo "no apt support"
            sudo apt-get install -y linux-headers-generic || echo "no apt support"
            sudo apt-get install -y gcc-multilib wget || echo "no apt support"
            sudo wget https://git.alpinelinux.org/aports/plain/main/bsd-compat-headers/queue.h -O /usr/local/musl/bin/../x86_64-unknown-linux-musl/include/sys/queue.h || echo "compat x64 fail"
            yum install -y llvm-toolset-7-clang || echo "not yum based"
            source /opt/rh/llvm-toolset-7/enable || echo "not yum based"

      - name: Build wheels (aarch64+musl workaround)
        if: matrix.target == 'aarch64' && matrix.manylinux == 'musllinux_1_1'
        uses: PyO3/maturin-action@v1
        env:
          CFLAGS_aarch64_unknown_linux_gnu: "-D__ARM_ARCH=8"
          UNSAFE_PYO3_SKIP_VERSION_CHECK: 1
        with:
          target: ${{ matrix.target }}
          args: --release --out dist --interpreter ${{ matrix.python_version }}
          sccache: 'true'
          manylinux: ${{ matrix.manylinux }}
          docker-options: -e UNSAFE_PYO3_SKIP_VERSION_CHECK=1
          before-script-linux: |
            sudo apt-get update || echo "no apt support"
            sudo apt-get install -y libclang || echo "no apt support"
            sudo apt-get install -y libc6 || echo "no apt support"
            sudo apt-get install -y libc6-dev || echo "no apt support"
            sudo apt-get install -y libclang-dev || echo "no apt support"
            sudo apt-get install -y clang || echo "no apt support"
            sudo apt-get install -y linux-headers-generic || echo "no apt support"
            sudo apt-get install -y gcc-multilib wget || echo "no apt support"
            sudo wget https://git.alpinelinux.org/aports/plain/main/bsd-compat-headers/queue.h -O /usr/local/musl/bin/../aarch64-unknown-linux-musl/include/sys/queue.h || echo "compat fail"
            export BINDGEN_EXTRA_CLANG_ARGS="--sysroot=/usr/local/musl/bin/../aarch64-unknown-linux-musl/"

      - name: Build wheels (aarch64+manylinux2014 workaround)
        if: matrix.target == 'aarch64' && matrix.manylinux == 'manylinux2014'
        uses: PyO3/maturin-action@v1
        env:
          CFLAGS_aarch64_unknown_linux_gnu: "-D__ARM_ARCH=8"
          UNSAFE_PYO3_SKIP_VERSION_CHECK: 1
        with:
          target: ${{ matrix.target }}
          args: --release --out dist --interpreter ${{ matrix.python_version }}
          sccache: 'true'
          manylinux: ${{ matrix.manylinux }}
          docker-options: -e UNSAFE_PYO3_SKIP_VERSION_CHECK=1
          before-script-linux: |
            sudo apt-get update || echo "no apt support"
            sudo apt-get install -y libclang || echo "no apt support"
            sudo apt-get install -y libc6 || echo "no apt support"
            sudo apt-get install -y libc6-dev || echo "no apt support"
            sudo apt-get install -y libclang-dev || echo "no apt support"
            sudo apt-get install -y clang || echo "no apt support"
            sudo apt-get install -y linux-headers-generic || echo "no apt support"
            sudo apt-get install -y gcc-multilib || echo "no apt support"
            export BINDGEN_EXTRA_CLANG_ARGS="--sysroot=/usr/aarch64-unknown-linux-gnu/aarch64-unknown-linux-gnu/sysroot"

      - name: Build wheels (s390x+manylinux2014 workaround)
        if: matrix.target == 's390x' && matrix.manylinux == 'manylinux2014'
        uses: PyO3/maturin-action@v1
        env:
          UNSAFE_PYO3_SKIP_VERSION_CHECK: 1
        with:
          target: ${{ matrix.target }}
          args: --release --out dist --interpreter ${{ matrix.python_version }}
          sccache: 'true'
          manylinux: ${{ matrix.manylinux }}
          docker-options: -e UNSAFE_PYO3_SKIP_VERSION_CHECK=1
          before-script-linux: |
            sudo apt-get update || echo "no apt support"
            sudo apt-get install -y libclang || echo "no apt support"
            sudo apt-get install -y libc6 || echo "no apt support"
            sudo apt-get install -y libc6-dev || echo "no apt support"
            sudo apt-get install -y libclang-dev || echo "no apt support"
            sudo apt-get install -y clang || echo "no apt support"
            sudo apt-get install -y linux-headers-generic || echo "no apt support"
            sudo apt-get install -y gcc-multilib || echo "no apt support"
            export BINDGEN_EXTRA_CLANG_ARGS="--sysroot=/usr/s390x-ibm-linux-gnu/s390x-ibm-linux-gnu/sysroot"

      - name: Build wheels (i686+manylinux2014 workaround)
        if: matrix.target == 'i686' && matrix.manylinux == 'manylinux2014'
        uses: PyO3/maturin-action@v1
        env:
          UNSAFE_PYO3_SKIP_VERSION_CHECK: 1
        with:
          target: ${{ matrix.target }}
          args: --release --out dist --interpreter ${{ matrix.python_version }}
          sccache: 'true'
          manylinux: ${{ matrix.manylinux }}
          docker-options: -e UNSAFE_PYO3_SKIP_VERSION_CHECK=1
          container: messense/manylinux2014-cross:i686
          before-script-linux: |
            sudo apt-get update || echo "no apt support"
            sudo apt-get install -y libclang || echo "no apt support"
            sudo apt-get install -y libc6 || echo "no apt support"
            sudo apt-get install -y libc6-dev || echo "no apt support"
            sudo apt-get install -y libclang-dev || echo "no apt support"
            sudo apt-get install -y clang || echo "no apt support"
            sudo apt-get install -y linux-headers-generic || echo "no apt support"
            sudo apt-get install -y gcc-multilib || echo "no apt support"
            export BINDGEN_EXTRA_CLANG_ARGS="--sysroot=/usr/i686-unknown-linux-gnu/i686-unknown-linux-gnu/sysroot"

      - name: Build wheels (ppc64le+manylinux2014 workaround)
        if: matrix.target == 'ppc64le' && matrix.manylinux == 'manylinux2014'
        uses: PyO3/maturin-action@v1
        env:
          UNSAFE_PYO3_SKIP_VERSION_CHECK: 1
        with:
          target: ${{ matrix.target }}
          args: --release --out dist --interpreter ${{ matrix.python_version }}
          sccache: 'true'
          manylinux: ${{ matrix.manylinux }}
          docker-options: -e UNSAFE_PYO3_SKIP_VERSION_CHECK=1
          before-script-linux: |
            sudo apt-get update || echo "no apt support"
            sudo apt-get install -y libclang || echo "no apt support"
            sudo apt-get install -y libc6 || echo "no apt support"
            sudo apt-get install -y libc6-dev || echo "no apt support"
            sudo apt-get install -y libclang-dev || echo "no apt support"
            sudo apt-get install -y clang || echo "no apt support"
            sudo apt-get install -y linux-headers-generic || echo "no apt support"
            sudo apt-get install -y gcc-multilib || echo "no apt support"
            export BINDGEN_EXTRA_CLANG_ARGS="--sysroot=/usr/powerpc64le-unknown-linux-gnu/powerpc64le-unknown-linux-gnu/sysroot"
            wget https://gist.githubusercontent.com/Ousret/2e7a58fc2baf773f6e38e78963e8985f/raw/05a99d92817473ae5cf8360b8df3f85f47d0a12a/elf.h -O /usr/powerpc64le-unknown-linux-gnu/powerpc64le-unknown-linux-gnu/sysroot/usr/include/elf.h

      - name: Build wheels (ppc64+manylinux2014 workaround)
        if: matrix.target == 'ppc64' && matrix.manylinux == 'manylinux2014'
        uses: PyO3/maturin-action@v1
        env:
          UNSAFE_PYO3_SKIP_VERSION_CHECK: 1
        with:
          target: ${{ matrix.target }}
          args: --release --out dist --interpreter ${{ matrix.python_version }}
          sccache: 'true'
          manylinux: ${{ matrix.manylinux }}
          docker-options: -e UNSAFE_PYO3_SKIP_VERSION_CHECK=1
          before-script-linux: |
            sudo apt-get update || echo "no apt support"
            sudo apt-get install -y libclang || echo "no apt support"
            sudo apt-get install -y libc6 || echo "no apt support"
            sudo apt-get install -y libc6-dev || echo "no apt support"
            sudo apt-get install -y libclang-dev || echo "no apt support"
            sudo apt-get install -y clang || echo "no apt support"
            sudo apt-get install -y linux-headers-generic || echo "no apt support"
            sudo apt-get install -y gcc-multilib || echo "no apt support"
            export BINDGEN_EXTRA_CLANG_ARGS="--sysroot=/usr/powerpc64-unknown-linux-gnu/powerpc64-unknown-linux-gnu/sysroot"

      - name: Build wheels (armv7l+manylinux workaround)
        if: matrix.target == 'armv7l' && matrix.manylinux == 'manylinux2014'
        uses: PyO3/maturin-action@v1
        env:
          UNSAFE_PYO3_SKIP_VERSION_CHECK: 1
        with:
          target: ${{ matrix.target }}
          args: --release --out dist --interpreter ${{ matrix.python_version }}
          sccache: 'true'
          manylinux: ${{ matrix.manylinux }}
          docker-options: -e UNSAFE_PYO3_SKIP_VERSION_CHECK=1
          before-script-linux: |
            sudo apt-get update || echo "no apt support"
            sudo apt-get install -y libclang || echo "no apt support"
            sudo apt-get install -y libc6 || echo "no apt support"
            sudo apt-get install -y libc6-dev || echo "no apt support"
            sudo apt-get install -y libclang-dev || echo "no apt support"
            sudo apt-get install -y clang || echo "no apt support"
            sudo apt-get install -y linux-headers-generic || echo "no apt support"
            sudo apt-get install -y gcc-multilib wget || echo "no apt support"
            wget https://gist.githubusercontent.com/Ousret/2e7a58fc2baf773f6e38e78963e8985f/raw/05a99d92817473ae5cf8360b8df3f85f47d0a12a/elf.h -O /usr/armv7-unknown-linux-gnueabihf/armv7-unknown-linux-gnueabihf/sysroot/usr/include/elf.h

      - name: Build wheels (armv7l+musl workaround)
        if: matrix.target == 'armv7l' && matrix.manylinux == 'musllinux_1_1'
        uses: PyO3/maturin-action@v1
        env:
          UNSAFE_PYO3_SKIP_VERSION_CHECK: 1
        with:
          target: ${{ matrix.target }}
          args: --release --out dist --interpreter ${{ matrix.python_version }}
          sccache: 'true'
          manylinux: ${{ matrix.manylinux }}
          docker-options: -e UNSAFE_PYO3_SKIP_VERSION_CHECK=1
          before-script-linux: |
            sudo apt-get update || echo "no apt support"
            sudo apt-get install -y libclang || echo "no apt support"
            sudo apt-get install -y libc6 || echo "no apt support"
            sudo apt-get install -y libc6-dev || echo "no apt support"
            sudo apt-get install -y libclang-dev || echo "no apt support"
            sudo apt-get install -y clang || echo "no apt support"
            sudo apt-get install -y linux-headers-generic || echo "no apt support"
            sudo apt-get install -y gcc-multilib wget || echo "no apt support"
            sudo wget https://git.alpinelinux.org/aports/plain/main/bsd-compat-headers/queue.h -O /usr/local/musl/armv7-unknown-linux-musleabihf/include/sys/queue.h || echo "compat fail"
            export BINDGEN_EXTRA_CLANG_ARGS="--sysroot=/usr/local/musl/armv7-unknown-linux-musleabihf"

      - name: Build wheels (i686+musl workaround)
        if: matrix.target == 'i686' && matrix.manylinux == 'musllinux_1_1'
        uses: PyO3/maturin-action@v1
        env:
          UNSAFE_PYO3_SKIP_VERSION_CHECK: 1
        with:
          target: ${{ matrix.target }}
          args: --release --out dist --interpreter ${{ matrix.python_version }}
          sccache: 'true'
          manylinux: ${{ matrix.manylinux }}
          docker-options: -e UNSAFE_PYO3_SKIP_VERSION_CHECK=1
          before-script-linux: |
            sudo apt-get update || echo "no apt support"
            sudo apt-get install -y libclang || echo "no apt support"
            sudo apt-get install -y libc6 || echo "no apt support"
            sudo apt-get install -y libc6-dev || echo "no apt support"
            sudo apt-get install -y libclang-dev || echo "no apt support"
            sudo apt-get install -y clang || echo "no apt support"
            sudo apt-get install -y linux-headers-generic || echo "no apt support"
            sudo apt-get install -y gcc-multilib wget || echo "no apt support"
            sudo wget https://git.alpinelinux.org/aports/plain/main/bsd-compat-headers/queue.h -O /usr/local/musl/i686-unknown-linux-musl/include/sys/queue.h || echo "compat fail"
            export BINDGEN_EXTRA_CLANG_ARGS="--sysroot=/usr/local/musl/i686-unknown-linux-musl"

      - name: Upload wheels
        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808
        with:
          name: wheels-linux-${{ matrix.target }}-${{ matrix.manylinux }}-${{ matrix.python_version }}
          path: dist/*.whl

  windows:
    needs:
      - test
      - lint
      - integration
    runs-on: windows-latest
    strategy:
      fail-fast: false
      matrix:
        target: [ x64, aarch64, x86 ]
        python_version: [ '3.10', 'pypy-3.7', 'pypy-3.8', 'pypy-3.9', 'pypy-3.10', '3.13t' ]
        exclude:
          - target: aarch64
            python_version: pypy-3.7
          - target: aarch64
            python_version: pypy-3.8
          - target: aarch64
            python_version: pypy-3.9
          - target: aarch64
            python_version: pypy-3.10
          - target: x86
            python_version: pypy-3.7
          - target: x86
            python_version: pypy-3.8
          - target: x86
            python_version: pypy-3.9
          - target: x86
            python_version: pypy-3.10
          - target: x86
            python_version: 3.13t
    steps:
      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac
      - uses: actions/setup-python@v5
        if: matrix.python_version != '3.13t'
        with:
          python-version: ${{ matrix.python_version }}
          architecture: ${{ matrix.target == 'x86' && 'x86' || 'x64' }}
      - uses: Quansight-Labs/setup-python@v5
        if: matrix.python_version == '3.13t' && matrix.target == 'x64'
        with:
          python-version: '3.13t'
          architecture: x64
      - uses: ilammy/setup-nasm@v1
      - name: Set up Clang (Cygwin)
        run: choco install llvm -y
      - name: Add Ninja (aarch64 build requirement)
        if: matrix.target == 'aarch64'
        run: choco install ninja -y
      - name: Build wheels (workaround 3.13t arm64)
        if: matrix.python_version == '3.13t' && matrix.target == 'aarch64'
        uses: PyO3/maturin-action@v1
        env:
          XWIN_VERSION: 16  # fix for "no cab file specified by MSI" ...?
          UNSAFE_PYO3_SKIP_VERSION_CHECK: 1
          PYO3_CROSS: 1
        with:
          target: ${{ matrix.target }}
          args: --release --out dist -i 3.13t
          sccache: 'true'
      - name: Build wheels (normal)
        if: matrix.python_version != '3.13t' || matrix.target == 'x64'
        uses: PyO3/maturin-action@v1
        env:
          XWIN_VERSION: 16  # fix for "no cab file specified by MSI" ...?
          UNSAFE_PYO3_SKIP_VERSION_CHECK: 1
        with:
          target: ${{ matrix.target }}
          args: --release --out dist
          sccache: 'true'
      - name: Upload wheels
        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808
        with:
          name: wheels-windows-${{ matrix.target }}-${{ matrix.python_version }}
          path: dist/*.whl

  macos:
    needs:
      - test
      - lint
      - integration
    runs-on: macos-13
    strategy:
      fail-fast: false
      matrix:
        target: [ universal2 ]
        python_version: [ '3.10', 'pypy-3.7', 'pypy-3.8', 'pypy-3.9', 'pypy-3.10', '3.13t' ]
    steps:
      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac
      - uses: actions/setup-python@v5
        if: matrix.python_version != '3.13t'
        with:
          python-version: ${{ matrix.python_version }}
      - uses: Quansight-Labs/setup-python@v5
        if: matrix.python_version == '3.13t'
        with:
          python-version: 3.13t
      - name: Build wheels
        uses: PyO3/maturin-action@v1
        env:
          UNSAFE_PYO3_SKIP_VERSION_CHECK: 1
        with:
          target: ${{ matrix.target }}
          args: --release --out dist --interpreter ${{ matrix.python_version }}
          sccache: 'true'
      - name: Upload wheels
        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808
        with:
          name: wheels-macos-${{ matrix.target }}-${{ matrix.python_version }}
          path: dist/*.whl

  sdist:
    needs:
      - test
      - lint
      - integration
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac
      - name: Build sdist
        uses: PyO3/maturin-action@v1
        with:
          command: sdist
          args: --out dist
      - name: Upload sdist
        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808
        with:
          name: wheels-sdist
          path: dist/*.tar.gz

  checksum:
    name: compute hashes
    runs-on: ubuntu-22.04
    needs: [windows, macos, linux, sdist]
    outputs:
      hashes: ${{ steps.compute.outputs.hashes }}
    steps:
      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
      - name: Download distributions
        uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e # v4.1.7
        with:
          pattern: wheels-*
          path: dist
          merge-multiple: true
      - name: Collected dists
        run: |
          tree dist
      - name: Generate hashes
        id: compute  #  needs.checksum.outputs.hashes
        working-directory: ./dist
        run: echo "hashes=$(sha256sum * | base64 -w0)" >> $GITHUB_OUTPUT

  provenance:
    needs: checksum
    if: "startsWith(github.ref, 'refs/tags/')"
    uses: "slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.0.0"
    permissions:
      actions: read
      id-token: write
      contents: write
    with:
      base64-subjects: ${{ needs.checksum.outputs.hashes }}
      upload-assets: true
      compile-generator: true

  release:
    name: release
    runs-on: ubuntu-22.04
    if: "startsWith(github.ref, 'refs/tags/')"
    needs: provenance
    environment: pypi
    permissions:
      id-token: write
      contents: write
    steps:
      - name: Download distributions
        uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e # v4.1.7
        with:
          pattern: wheels-*
          path: dist
          merge-multiple: true
      - name: "Upload dists to GitHub Release"
        env:
          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
        run: |
          gh release upload ${{ github.ref_name }} dist/* --repo ${{ github.repository }}
      - name: Publish to PyPI
        uses: "pypa/gh-action-pypi-publish@67339c736fd9354cd4f8cb0b744f2b82a74b5c70" # v1.12.3
        with:
          attestations: true