name: Wheels

on:
  schedule:
  #        ┌───────────── minute (0 - 59)
  #        │  ┌───────────── hour (0 - 23)
  #        │  │ ┌───────────── day of the month (1 - 31)
  #        │  │ │ ┌───────────── month (1 - 12 or JAN-DEC)
  #        │  │ │ │ ┌───────────── day of the week (0 - 6 or SUN-SAT)
  #        │  │ │ │ │
  - cron: "42 1 * * 0,3"
  push:
    paths: &paths
      - ".ci/requirements-cibw.txt"
      - ".ci/requirements-sbom.txt"
      - ".github/compare-dist-sizes.py"
      - ".github/dependencies.json"
      - ".github/embed-sbom.py"
      - ".github/generate-sbom.py"
      - ".github/workflows/wheels*"
      - "pyproject.toml"
      - "setup.py"
      - "wheels/*"
      - "winbuild/build_prepare.py"
      - "winbuild/fribidi.cmake"
    tags:
      - "*"
  pull_request:
    paths: *paths
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  EXPECTED_DISTS: 78
  FORCE_COLOR: 1

jobs:
  sbom:
    if: github.event_name != 'schedule' || github.event.repository.fork == false
    runs-on: ubuntu-latest
    name: Generate SBOM
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.x"

      - name: Generate CycloneDX SBOM
        run: python3 .github/generate-sbom.py

      - name: Validate SBOM
        run: |
          python3 -m pip install -r .ci/requirements-sbom.txt
          check-jsonschema --schemafile "https://raw.githubusercontent.com/CycloneDX/specification/1.7/schema/bom-1.7.schema.json" pillow-*.cdx.json

      - name: Upload SBOM as workflow artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: sbom
          path: "pillow-*.cdx.json"

  build-native-wheels:
    needs: sbom
    if: github.event_name != 'schedule' || github.event.repository.fork == false
    name: ${{ matrix.name }}
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: "macOS 10.10 x86_64"
            platform: macos
            os: macos-26-intel
            cibw_arch: x86_64
            build: "cp311*"
            macosx_deployment_target: "10.10"
          - name: "macOS 10.13 x86_64"
            platform: macos
            os: macos-26-intel
            cibw_arch: x86_64
            build: "cp3{12,13}*"
            macosx_deployment_target: "10.13"
          - name: "macOS 10.15 x86_64"
            platform: macos
            os: macos-26-intel
            cibw_arch: x86_64
            build: "{cp314,cp315,pp3}*"
            macosx_deployment_target: "10.15"
          - name: "macOS arm64"
            platform: macos
            os: macos-latest
            cibw_arch: arm64
            macosx_deployment_target: "11.0"
          - name: "manylinux_2_28 x86_64"
            platform: linux
            os: ubuntu-latest
            cibw_arch: x86_64
            build: "*manylinux*"
          - name: "musllinux x86_64"
            platform: linux
            os: ubuntu-latest
            cibw_arch: x86_64
            build: "*musllinux*"
          - name: "manylinux_2_28 aarch64"
            platform: linux
            os: ubuntu-24.04-arm
            cibw_arch: aarch64
            build: "*manylinux*"
          - name: "musllinux aarch64"
            platform: linux
            os: ubuntu-24.04-arm
            cibw_arch: aarch64
            build: "*musllinux*"
          - name: "iOS arm64 device"
            platform: ios
            os: macos-latest
            cibw_arch: arm64_iphoneos
          - name: "iOS arm64 simulator"
            platform: ios
            os: macos-latest
            cibw_arch: arm64_iphonesimulator
          - name: "iOS x86_64 simulator"
            platform: ios
            os: macos-26-intel
            cibw_arch: x86_64_iphonesimulator
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          submodules: true

      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.x"

      - name: Install cibuildwheel
        run: |
          python3 -m pip install -r .ci/requirements-cibw.txt

      - name: Build wheels
        run: |
          python3 -m cibuildwheel --output-dir wheelhouse
        env:
          CIBW_PLATFORM: ${{ matrix.platform }}
          CIBW_ARCHS: ${{ matrix.cibw_arch }}
          CIBW_BUILD: ${{ matrix.build }}
          CIBW_ENABLE: cpython-prerelease pypy
          CIBW_ENVIRONMENT_PASS_LINUX: FORCE_COLOR
          MACOSX_DEPLOYMENT_TARGET: ${{ matrix.macosx_deployment_target }}

      - name: Download SBOM
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: sbom
          path: sbom

      - name: Embed SBOM in wheels
        run: python3 .github/embed-sbom.py wheelhouse sbom

      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: dist-${{ matrix.name }}
          path: ./wheelhouse/*.whl

  windows:
    needs: sbom
    if: github.event_name != 'schedule' || github.event.repository.fork == false
    name: Windows ${{ matrix.cibw_arch }}
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - cibw_arch: x86
            os: windows-latest
          - cibw_arch: AMD64
            os: windows-latest
          - cibw_arch: ARM64
            os: windows-11-arm
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Checkout extra test images
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          repository: python-pillow/test-images
          path: Tests\test-images

      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.x"

      - name: Install cibuildwheel
        run: |
          python.exe -m pip install -r .ci/requirements-cibw.txt

      - name: Prepare for build
        run: |
          choco install nasm --no-progress
          echo "C:\Program Files\NASM" >> $env:GITHUB_PATH

          # Install extra test images
          xcopy /S /Y Tests\test-images\* Tests\images

          & python.exe winbuild\build_prepare.py -v --no-imagequant --architecture=${{ matrix.cibw_arch }}
        shell: pwsh

      - name: Build wheels
        run: |
          for f in winbuild/build/license/*; do
            name=$(basename "${f%.*}")
            # Skip FriBiDi license, it is not included in the wheel.
            [[ $name == fribidi* ]] && continue
            # Skip imagequant license, it is not included in the wheel.
            [[ $name == libimagequant* ]] && continue
            echo "" >> LICENSE
            echo "===== $name =====" >> LICENSE
            echo "" >> LICENSE
            cat "$f" >> LICENSE
          done
          cmd //c "winbuild\\build\\build_env.cmd && $pythonLocation\\python.exe -m cibuildwheel . --output-dir wheelhouse"
        env:
          CIBW_ARCHS: ${{ matrix.cibw_arch }}
          CIBW_BEFORE_ALL: "{package}\\winbuild\\build\\build_dep_all.cmd"
          CIBW_CACHE_PATH: "C:\\cibw"
          CIBW_ENABLE: cpython-prerelease pypy
          CIBW_TEST_SKIP: "*-win_arm64"
          CIBW_TEST_COMMAND: 'docker run --rm
            -v {project}:C:\pillow
            -v C:\cibw:C:\cibw
            -v %CD%\..\venv-test:%CD%\..\venv-test
            -e CI -e GITHUB_ACTIONS -e FORCE_COLOR
            mcr.microsoft.com/windows/servercore:ltsc2022
            powershell C:\pillow\.github\workflows\wheels-test.ps1 %CD%\..\venv-test'
        shell: bash

      - name: Download SBOM
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: sbom
          path: sbom

      - name: Embed SBOM in wheels
        run: python3 .github/embed-sbom.py wheelhouse sbom

      - name: Upload wheels
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: dist-windows-${{ matrix.cibw_arch }}
          path: ./wheelhouse/*.whl

      - name: Upload fribidi.dll
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: fribidi-windows-${{ matrix.cibw_arch }}
          path: winbuild\build\bin\fribidi*

  sdist:
    if: github.event_name != 'schedule' || github.event.repository.fork == false
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      with:
        persist-credentials: false

    - name: Set up Python
      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
      with:
        python-version: "3.x"

    - run: make sdist

    - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
      with:
        name: dist-sdist
        path: dist/*.tar.gz

  count-dists:
    needs: [build-native-wheels, windows, sdist]
    runs-on: ubuntu-latest
    name: Count dists
    steps:
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          pattern: dist-*
          path: dist
          merge-multiple: true
      - name: "What did we get?"
        run: |
          ls -alR
          echo "Number of dists, should be $EXPECTED_DISTS:"
          files=$(ls dist 2>/dev/null | wc -l)
          echo $files
          [ "$files" -eq $EXPECTED_DISTS ] || exit 1

  compare-dist-sizes:
    needs: [build-native-wheels, windows, sdist]
    runs-on: ubuntu-latest
    name: Compare dist sizes vs PyPI
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
        with:
          enable-cache: false

      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          pattern: dist-*
          path: dist
          merge-multiple: true

      - name: Compare dist sizes vs latest PyPI release
        run: uv run .github/compare-dist-sizes.py dist

  scientific-python-nightly-wheels-publish:
    if: github.event.repository.fork == false && (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch')
    needs: count-dists
    runs-on: ubuntu-latest
    name: Upload wheels to scientific-python-nightly-wheels
    environment:
      name: release-anaconda
      url: https://anaconda.org/channels/scientific-python-nightly-wheels/packages/pillow/overview
    steps:
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          pattern: dist-!(sdist)*
          path: dist
          merge-multiple: true
      - name: Upload wheels to scientific-python-nightly-wheels
        uses: scientific-python/upload-nightly-action@e76cfec8a4611fd02808a801b0ff5a7d7c1b2d99 # 0.6.4
        with:
          artifacts_path: dist
          anaconda_nightly_upload_token: ${{ secrets.ANACONDA_ORG_UPLOAD_TOKEN }}

  sbom-publish:
    if: |
      github.event.repository.fork == false
      && github.event_name == 'push'
      && startsWith(github.ref, 'refs/tags')
    needs: [count-dists, sbom]
    runs-on: ubuntu-latest
    name: Publish SBOM to GitHub release
    permissions:
      contents: write
    steps:
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: sbom
          path: .

      - name: Attach SBOM to GitHub release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: gh release upload "$GITHUB_REF_NAME" pillow-*.cdx.json --repo "$GITHUB_REPOSITORY"

  pypi-publish:
    if: github.event.repository.fork == false && github.event_name == 'push' && startsWith(github.ref, 'refs/tags')
    needs: count-dists
    runs-on: ubuntu-latest
    name: Upload release to PyPI
    environment:
      name: release-pypi
      url: https://pypi.org/p/Pillow
    permissions:
      id-token: write
    steps:
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          pattern: dist-*
          path: dist
          merge-multiple: true
      - name: Publish to PyPI
        uses: pypa/gh-action-pypi-publish@ba38be9e461d3875417946c167d0b5f3d385a247 # v1.14.1
        with:
          attestations: true
