build-grpcio.yml

---
name: Build grpcio wheels (riscv64)

on:
  workflow_dispatch:
    inputs:
      version:
        description: 'Version glob to (re)build; empty builds every version of docs/packages/grpcio.yaml not released yet'
        required: false
        default: ''
  pull_request:
    branches: [main]
    paths:
      - '.github/workflows/build-grpcio.yml'
      - 'docs/packages/grpcio.yaml'
      - 'patches/grpcio/**'
  push:
    branches: [main]
    paths:
      - '.github/workflows/build-grpcio.yml'
      - 'docs/packages/grpcio.yaml'
      - 'patches/grpcio/**'

concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

permissions:
  contents: read

env:
  UV_EXTRA_INDEX_URL: https://pypi.riseproject.dev/simple/
  UV_INDEX_STRATEGY: unsafe-best-match
  UV_ONLY_BINARY: ':all:'
  MANYLINUX_RISCV64_IMAGE: quay.io/pypa/manylinux_2_39_riscv64

jobs:
  setup:
    uses: $/.github/workflows/_setup.yml
    with:
      package: grpcio
      version: ${{ inputs.version }}

  build_wheels:
    needs: [setup]
    if: needs.setup.outputs.versions != '[]'
    name: Build grpcio ${{ matrix.version }} ${{ matrix.python }}-manylinux_riscv64
    runs-on: ubuntu-24.04-riscv
    timeout-minutes: 480
    strategy:
      fail-fast: false
      matrix:
        version: ${{ fromJSON(needs.setup.outputs.versions) }}
        # grpcio doesn't advertise free-threaded support yet
        # (src/python/grpcio/python_version.py lists only 3.10-3.14), so
        # 3.14t is dropped from the usual default matrix.
        # See also: https://github.com/grpc/grpc/issues/38762
        python: ["cp312", "cp313", "cp314"]

    env:
      GRPCIO_VERSION: ${{ matrix.version }}
      CCACHE_DIR: ${{ github.workspace }}/.ccache
      CCACHE_BASEDIR: "/project"
      CCACHE_COMPILERCHECK: "content"

    steps:
      - name: Checkout grpc v${{ env.GRPCIO_VERSION }}
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          repository: grpc/grpc
          ref: v${{ env.GRPCIO_VERSION }}
          submodules: true
          fetch-depth: 1  # grpc's submodules (boringssl, abseil, re2, ...) are large; skip history
          persist-credentials: false

      - name: Checkout python-wheels
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          path: python-wheels
          fetch-depth: 1
          persist-credentials: false

      # install_all_python_modules.sh (run below via CIBW_TEST_COMMAND) would
      # otherwise reinstall grpcio from source before testing, rather than
      # testing the wheel this job just built.
      - name: Patch grpc source
        run: git apply python-wheels/patches/grpcio/${{ env.GRPCIO_VERSION }}/00*.patch

      # The C++ core is identical across cp312/cp313/cp314; share ccache across
      # builds assuming that the package version is the same.
      - name: Restore compilation cache
        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v6.1.0
        with:
          path: ${{ env.CCACHE_DIR }}
          key: ccache-wheels-grpcio-v${{ env.GRPCIO_VERSION }}-manylinux_riscv64-${{ matrix.python }}
          restore-keys: |
            ccache-wheels-grpcio-v${{ env.GRPCIO_VERSION }}-manylinux_riscv64-

      - name: Build wheels
        uses: pypa/cibuildwheel@1828c10ab37f080699c7b81cea34097c684a7074  # v4.2.0
        env:
          CIBW_BUILD: ${{ matrix.python }}-manylinux_riscv64
          CIBW_MANYLINUX_RISCV64_IMAGE: ${{ env.MANYLINUX_RISCV64_IMAGE }}
          CIBW_BEFORE_ALL: |
            set -eux
            CCACHE_VERSION=4.13.6
            curl -fsSL https://github.com/ccache/ccache/releases/download/v${CCACHE_VERSION}/ccache-${CCACHE_VERSION}-linux-$(uname -m)-musl-static.tar.gz | \
              tar -xvzf - --strip-components 1 -C /usr/local/bin ccache-${CCACHE_VERSION}-linux-$(uname -m)-musl-static/ccache
            ccache --version
            ccache --zero-stats
          CIBW_ENVIRONMENT: PIP_EXTRA_INDEX_URL=https://pypi.riseproject.dev/simple/
          # only-binary is test-scoped only: grpcio_tests pulls cryptography
          # transitively (via oauth2client/google-auth), and an unbounded
          # `pip install .` picks the newest PyPI version even when our
          # registry has an older riscv64 wheel, forcing a maturin/Rust
          # source build. Build phase still needs sdist compiles (cython
          # has no riscv64 wheel anywhere), so this can't go in CIBW_ENVIRONMENT.
          CIBW_TEST_ENVIRONMENT: "PIP_ONLY_BINARY=:all:"
          CIBW_ENVIRONMENT_PASS_LINUX: >-
            CCACHE_BASEDIR
            CCACHE_COMPILERCHECK
          CIBW_CONTAINER_ENGINE: "docker; create_args: --volume ${{ env.CCACHE_DIR }}:/root/.ccache"
          CIBW_BEFORE_BUILD: pip install -r requirements.txt
          CIBW_REPAIR_WHEEL_COMMAND: auditwheel repair --strip -w {dest_dir} {wheel}
          CIBW_TEST_REQUIRES: setuptools
          CIBW_TEST_COMMAND: >-
            cd {project}/tools/distrib &&
            PIP_NO_BUILD_ISOLATION=0 ./install_all_python_modules.sh &&
            cd {project}/src/python/grpcio_tests && python setup.py test_lite

      - name: Save compilation cache
        if: always() && github.ref == 'refs/heads/main'
        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v6.1.0
        with:
          path: ${{ env.CCACHE_DIR }}
          key: ccache-wheels-grpcio-v${{ env.GRPCIO_VERSION }}-manylinux_riscv64-${{ matrix.python }}

      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
        with:
          name: grpcio-${{ env.GRPCIO_VERSION }}-${{ matrix.python }}-manylinux_riscv64
          path: ./wheelhouse/*.whl
          if-no-files-found: error

  publish:
    name: Publish grpcio ${{ matrix.version }}
    needs: [setup, build_wheels]
    if: needs.setup.outputs.versions != '[]'
    strategy:
      fail-fast: false
      matrix:
        version: ${{ fromJSON(needs.setup.outputs.versions) }}
    permissions:
      contents: write
      pull-requests: write
    uses: $/.github/workflows/_publish-wheel.yml
    secrets:
      app-private-key: ${{ secrets.RISEPROJECT_APP_PRIVATE_KEY }}
    with:
      artifact-pattern: grpcio-${{ matrix.version }}-*-manylinux_riscv64