build-cel-expr-python.yml

# SPDX-FileCopyrightText: 2026 The RISE Project
# SPDX-License-Identifier: MIT
#
# This workflow is based on: https://github.com/cel-expr/cel-python/blob/v0.1.3/release/kokoro/release_linux.sh
---
name: Build cel-expr-python wheels (riscv64)

on:
  workflow_dispatch:
    inputs:
      version:
        description: 'Version glob to (re)build; empty builds every version of docs/packages/cel-expr-python.yaml not released yet'
        required: false
        default: ''
  pull_request:
    branches: [main]
    paths:
      - '.github/workflows/build-cel-expr-python.yml'
      - 'docs/packages/cel-expr-python.yaml'
  push:
    branches: [main]
    paths:
      - '.github/workflows/build-cel-expr-python.yml'
      - 'docs/packages/cel-expr-python.yaml'

run-name: build-cel-expr-python ${{ inputs.version && format('- {0}', inputs.version) || '' }}

concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

permissions:
  contents: read

env:
  MANYLINUX_RISCV64_IMAGE: quay.io/pypa/manylinux_2_39_riscv64
  # Upstream's .bazelversion. Bazel publishes no riscv64 binary, so bootstrap one from
  # the dist archive; 8.2.0+ bootstraps on riscv64 unpatched (gotcha 47).
  BAZEL_VERSION: '8.5.1'

jobs:
  setup:
    uses: $/.github/workflows/_setup.yml
    with:
      package: cel-expr-python
      version: ${{ inputs.version }}

  bazel:
    needs: [setup]
    if: needs.setup.outputs.versions != '[]'
    name: Bootstrap bazel (riscv64)
    runs-on: ubuntu-24.04-riscv
    timeout-minutes: 720

    steps:
      - name: Restore bazel binary
        id: cache
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v6.1.0
        with:
          path: bazel-bin
          key: bazel-${{ env.BAZEL_VERSION }}-manylinux_riscv64

      - name: Bootstrap bazel ${{ env.BAZEL_VERSION }}
        if: steps.cache.outputs.cache-hit != 'true'
        run: |
          mkdir -p bazel-bin
          docker run --rm -i --network=host \
            -v "${GITHUB_WORKSPACE}:/work" \
            -w /work \
            -e BAZEL_VERSION="${BAZEL_VERSION}" \
            "${MANYLINUX_RISCV64_IMAGE}" \
            bash <<'SCRIPT'
          set -eux

          dnf install -y --setopt=install_weak_deps=False java-21-openjdk-devel zip unzip
          JAVA_HOME="$(dirname "$(dirname "$(readlink -f "$(command -v javac)")")")"
          export JAVA_HOME

          mkdir -p /tmp/bazel-src
          cd /tmp/bazel-src
          curl -fsSLo dist.zip "https://github.com/bazelbuild/bazel/releases/download/${BAZEL_VERSION}/bazel-${BAZEL_VERSION}-dist.zip"
          unzip -q dist.zip

          EXTRA_BAZEL_ARGS="--tool_java_runtime_version=local_jdk" bash ./compile.sh
          install -m 0755 output/bazel /work/bazel-bin/bazel
          SCRIPT

      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
        with:
          name: bazel-${{ env.BAZEL_VERSION }}-riscv64
          path: bazel-bin/bazel
          if-no-files-found: error

  build_wheels:
    name: Build cel-expr-python ${{ matrix.version }} ${{ matrix.python }}-manylinux_riscv64
    runs-on: ubuntu-24.04-riscv
    timeout-minutes: 720
    needs: [setup, bazel]
    if: needs.setup.outputs.versions != '[]'

    strategy:
      fail-fast: false
      matrix:
        version: ${{ fromJSON(needs.setup.outputs.versions) }}
        # Upstream publishes cp311-cp314 and no free-threaded wheel. setup.py points
        # rules_python's hermetic toolchain at the building interpreter, so each one is
        # a full bazel build (gotcha 456).
        python: ["cp312", "cp313", "cp314"]

    env:
      CEL_EXPR_PYTHON_VERSION: ${{ matrix.version }}

    steps:
      - name: Checkout cel-python v${{ matrix.version }}
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          repository: cel-expr/cel-python
          ref: v${{ env.CEL_EXPR_PYTHON_VERSION }}
          path: cel-python
          fetch-depth: 1
          persist-credentials: false

      - name: Download bazel
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
        with:
          name: bazel-${{ env.BAZEL_VERSION }}-riscv64
          path: bazel-bin

      - name: Build wheel
        env:
          PYTHON_TAG: ${{ matrix.python }}
        run: |
          mkdir -p wheelhouse
          set -o pipefail
          docker run --rm -i --network=host \
            -v "${GITHUB_WORKSPACE}:/work" \
            -w /work/cel-python \
            -e PYTHON_TAG \
            -e CEL_EXPR_PYTHON_VERSION \
            "${MANYLINUX_RISCV64_IMAGE}" \
            bash <<'SCRIPT' 2>&1 | tee build.log
          set -euxo pipefail

          dnf install -y --setopt=install_weak_deps=False java-21-openjdk-devel
          JAVA_HOME="$(dirname "$(dirname "$(readlink -f "$(command -v javac)")")")"
          export JAVA_HOME
          install -m 0755 /work/bazel-bin/bazel /usr/local/bin/bazel

          python_dir="/opt/python/${PYTHON_TAG}-${PYTHON_TAG}/bin"
          export PATH="${python_dir}:${PATH}"
          python_exe="${python_dir}/python"
          "${python_exe}" -m pip install -q -U setuptools wheel auditwheel

          cp release/pyproject.toml release/setup.py release/cel_basic_test.py .
          rm -f cel_expr_python/*_test.py
          sed -i "s/\$VERSION/${CEL_EXPR_PYTHON_VERSION}/g" pyproject.toml

          # CEL_BAZEL_FLAGS is setup.py's own hook (upstream passes its remote cache
          # through it). No remote JDK is published for riscv64, and cel-cpp runs the
          # ANTLR tool as a java_binary. A long build's default curses progress output is
          # large enough that GitHub drops the job log, taking the failure with it.
          export CEL_BAZEL_FLAGS="--java_runtime_version=local_jdk --tool_java_runtime_version=local_jdk --curses=no --show_progress_rate_limit=60 --local_ram_resources=HOST_RAM*.5"

          # First pass populates bazel's external repositories so their licences can be
          # collected; the second pass is served from bazel's cache.
          "${python_exe}" -m pip wheel . --no-deps --no-build-isolation -w /tmp/wheelbuild

          # The extensions statically link every C++ dependency; upstream ships none of
          # their licences, so collect them from the repositories bazel linked.
          OUTPUT_BASE="$(bazel info output_base)"
          targets="//cel_expr_python:cel"
          for ext in bindings encoders math optional proto strings; do
            targets="${targets} + //cel_expr_python/ext:ext_${ext}"
          done
          # shellcheck disable=SC2086
          bazel cquery --compilation_mode=opt ${CEL_BAZEL_FLAGS} --output=label --consistent_labels \
            "kind('cc_library|proto_library', deps(${targets}))" > /tmp/deps.txt
          # --consistent_labels prints external repos as @@<canonical>// and the main repo
          # as @@//, which the non-empty capture leaves out.
          sed -nE 's|^@@([^@/]+)//.*|\1|p' /tmp/deps.txt | sort -u \
            | grep -vE '^(rules_|bazel_tools|platforms|local_config_)' > /tmp/repos.txt
          cat /tmp/repos.txt
          while read -r repo; do
            name="${repo%+}"
            name="${name##*+}"
            dir="${OUTPUT_BASE}/external/${repo}"
            file=""
            if [ -d "${dir}" ]; then
              file="$(find "${dir}" -maxdepth 1 -type f \( -iname 'LICENSE*' -o -iname 'COPYING*' \) | sort | head -1)"
            fi
            if [ -n "${file}" ]; then
              cp "${file}" "LICENSE.${name}"
            else
              echo "::warning::no licence file at the root of ${repo}"
            fi
          done < /tmp/repos.txt
          ls LICENSE*
          for name in abseil-cpp cel-cpp cel-spec protobuf pybind11 re2; do
            test -f "LICENSE.${name}"
          done

          # setuptools' namespace package discovery follows bazel's convenience symlinks
          # into the execroot, which is how upstream's wheels come to carry a bazel-project/
          # tree; clear them so the second pass packages only cel_expr_python.
          find . -maxdepth 1 -name 'bazel-*' -type l -delete
          rm -rf build ./*.egg-info

          "${python_exe}" -m pip wheel . --no-deps --no-build-isolation -w /tmp/wheelhouse
          auditwheel repair --plat manylinux_2_39_riscv64 -w /work/wheelhouse /tmp/wheelhouse/*.whl
          SCRIPT

      - name: Upload build log
        if: failure()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
        with:
          name: cel-expr-python-${{ env.CEL_EXPR_PYTHON_VERSION }}-${{ matrix.python }}-build-log
          path: build.log

      - name: Check the wheel contents
        run: |
          python3 - wheelhouse/*.whl <<'EOF'
          import sys, zipfile
          for whl in sys.argv[1:]:
              names = zipfile.ZipFile(whl).namelist()
              tops = {n.split("/", 1)[0] for n in names}
              assert all(t == "cel_expr_python" or t.endswith(".dist-info") for t in tops), tops
              assert not any(".libs/" in n for n in names), whl
              sos = sorted(n for n in names if n.endswith(".so"))
              assert len(sos) == 7, sos
              print(whl, "ok", *sos, sep="\n  ")
          EOF

      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
        with:
          name: cel-expr-python-${{ env.CEL_EXPR_PYTHON_VERSION }}-${{ matrix.python }}-manylinux_riscv64
          path: wheelhouse/*.whl
          if-no-files-found: error

      - name: Test wheel
        env:
          PYTHON_TAG: ${{ matrix.python }}
        run: |
          docker run --rm -i --network=host \
            -v "${GITHUB_WORKSPACE}:/work" \
            -e PYTHON_TAG \
            "${MANYLINUX_RISCV64_IMAGE}" \
            bash <<'SCRIPT'
          set -eux

          python_exe="/opt/python/${PYTHON_TAG}-${PYTHON_TAG}/bin/python"
          "${python_exe}" -m pip install /work/wheelhouse/*.whl

          # /work/cel-python holds the checkout, whose cel_expr_python/ would join the
          # installed namespace package if the tests ran from there.
          cd /tmp
          "${python_exe}" /work/cel-python/release/cel_basic_test.py

          "${python_exe}" - <<'PY'
          import importlib
          import importlib.metadata

          for name in ["cel_expr_python.cel"] + [
              "cel_expr_python.ext.ext_" + ext
              for ext in ("bindings", "encoders", "math", "optional", "proto", "strings")
          ]:
              module = importlib.import_module(name)
              assert module.__file__.endswith(".so"), module.__file__

          licenses = {
              str(f).rsplit("/", 1)[1]
              for f in importlib.metadata.files("cel-expr-python")
              if ".dist-info/licenses/" in str(f)
          }
          print(sorted(licenses))
          expected = {"LICENSE"} | {
              "LICENSE." + name
              for name in ["abseil-cpp", "cel-cpp", "cel-spec", "protobuf", "pybind11", "re2"]
          }
          assert expected <= licenses, expected - licenses
          PY
          SCRIPT

  publish:
    name: Publish cel-expr-python ${{ matrix.version }}
    needs: [setup, build_wheels]
    if: needs.setup.outputs.versions != '[]'
    strategy:
      fail-fast: false
      matrix:
        version: ${{ fromJSON(needs.setup.outputs.versions) }}
    permissions:
      contents: write
      pull-requests: write
    uses: $/.github/workflows/_publish-wheel.yml
    secrets:
      app-private-key: ${{ secrets.RISEPROJECT_APP_PRIVATE_KEY }}
    with:
      artifact-pattern: cel-expr-python-${{ matrix.version }}-*-manylinux_riscv64