ci: validate and publish Python runtime wheels

.gitlab-ci.yml

@@ -0,0 +1,120 @@
+workflow:
+  rules:
+    - if: '$CI_COMMIT_TAG =~ /^python-v\d+\.\d+\.\d+$/'
+    - when: never
+
+stages:
+  - build
+  - publish
+
+variables:
+  GIT_DEPTH: "0"
+  PIP_DISABLE_PIP_VERSION_CHECK: "1"
+
+.python-tools:
+  before_script:
+    - python3 -m venv .ci-python
+    - . .ci-python/bin/activate
+    - python -m pip install uv==0.11.23
+
+sdk-wheel:
+  extends: .python-tools
+  stage: build
+  tags: [linux-x64]
+  script:
+    - python scripts/build-python-release.py --package sdk --tag "$CI_COMMIT_TAG" --output-dir release/sdk
+  artifacts:
+    paths: [release/sdk/*.whl]
+    expire_in: 1 week
+
+.runtime-wheel:
+  extends: .python-tools
+  stage: build
+  script:
+    - corepack enable
+    - pnpm install --frozen-lockfile
+    - pnpm run verify-runtime-closure
+    - pnpm exec tsx scripts/build-exe-for-python-sdk.ts --targets="$PKG_TARGET"
+    - EXE="$PWD/dist-exe/dsh-jsonrpc-agent-pkg-$PLATFORM"
+    - test -x "$EXE"
+    - uv run --python 3.10 --group test --project python/sdk python scripts/smoke-python-runtime.py --scenario all --exe "$EXE"
+    - python scripts/build-python-release.py --package runtime --tag "$CI_COMMIT_TAG" --platform "$PLATFORM" --runtime-exe "$EXE" --output-dir "release/$PLATFORM"
+    - python -m venv .wheel-smoke
+    - .wheel-smoke/bin/python -m pip install --find-links "release/$PLATFORM" --find-links release/sdk deepseek-harness=="${CI_COMMIT_TAG#python-v}"
+    - .wheel-smoke/bin/python scripts/smoke-python-runtime.py --scenario sdk-default
+    - |
+      if [ "${PLATFORM#linux-}" != "$PLATFORM" ]; then
+        readelf --version-info "$EXE" > glibc-versions.txt
+        maximum="$(sed -n 's/.*Name: GLIBC_\([0-9.]*\).*/\1/p' glibc-versions.txt | sort -V | tail -1)"
+        test -n "$maximum"
+        dpkg --compare-versions "$maximum" le 2.28
+        case "$PLATFORM" in
+          linux-x64) image=quay.io/pypa/manylinux_2_28_x86_64 ;;
+          linux-arm64) image=quay.io/pypa/manylinux_2_28_aarch64 ;;
+          *) echo "Unsupported Linux platform $PLATFORM"; exit 1 ;;
+        esac
+        docker run --rm -v "$PWD:/work" -w /work "$image" bash -euxo pipefail -c "/opt/python/cp310-cp310/bin/python -m venv /tmp/dsh-sdk && /tmp/dsh-sdk/bin/python -m pip install --find-links /work/release/$PLATFORM --find-links /work/release/sdk deepseek-harness==${CI_COMMIT_TAG#python-v} && /tmp/dsh-sdk/bin/python /work/scripts/smoke-python-runtime.py --scenario sdk-default"
+      fi
+  artifacts:
+    paths: [release/$PLATFORM/*.whl]
+    expire_in: 1 week
+
+runtime-linux-x64:
+  extends: .runtime-wheel
+  tags: [linux-x64]
+  variables:
+    PKG_TARGET: node24-linux-x64
+    PLATFORM: linux-x64
+  needs:
+    - job: sdk-wheel
+      artifacts: true
+
+runtime-linux-arm64:
+  extends: .runtime-wheel
+  tags: [linux-arm64]
+  variables:
+    PKG_TARGET: node24-linux-arm64
+    PLATFORM: linux-arm64
+  needs:
+    - job: sdk-wheel
+      artifacts: true
+
+runtime-macos-arm64:
+  extends: .runtime-wheel
+  tags: [macos-arm64]
+  variables:
+    PKG_TARGET: node24-macos-arm64
+    PLATFORM: macos-arm64
+  needs:
+    - job: sdk-wheel
+      artifacts: true
+
+publish-python:
+  stage: publish
+  tags: [linux-x64]
+  resource_group: python-release
+  needs:
+    - job: sdk-wheel
+      artifacts: true
+    - job: runtime-linux-x64
+      artifacts: true
+    - job: runtime-linux-arm64
+      artifacts: true
+    - job: runtime-macos-arm64
+      artifacts: true
+  before_script:
+    - python3 -m venv .ci-python
+    - . .ci-python/bin/activate
+    - python -m pip install twine==6.2.0
+  script:
+    - version="${CI_COMMIT_TAG#python-v}"
+    - test "$(find release -name '*.whl' | wc -l | tr -d ' ')" = 4
+    - test -f "release/sdk/deepseek_harness-${version}-py3-none-any.whl"
+    - test -f "release/linux-x64/deepseek_harness_runtime_bin-${version}-py3-none-manylinux_2_28_x86_64.whl"
+    - test -f "release/linux-arm64/deepseek_harness_runtime_bin-${version}-py3-none-manylinux_2_28_aarch64.whl"
+    - test -f "release/macos-arm64/deepseek_harness_runtime_bin-${version}-py3-none-macosx_11_0_arm64.whl"
+    - python -m twine check release/*/*.whl
+    - export TWINE_USERNAME=gitlab-ci-token
+    - export TWINE_PASSWORD="$CI_JOB_TOKEN"
+    - export TWINE_REPOSITORY_URL="$CI_API_V4_URL/projects/$CI_PROJECT_ID/packages/pypi"
+    - python -m twine upload --non-interactive release/*/*.whl || { echo 'Publish failed. GitLab does not overwrite an existing version; create a new python-vX.Y.Z tag.'; exit 1; }