workflow:
  rules:
    - if: '$CI_COMMIT_TAG =~ /^python-v[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.]+)?$/'
    - when: never

stages:
  - build
  - publish

variables:
  GIT_DEPTH: "0"
  PIP_DISABLE_PIP_VERSION_CHECK: "1"

.python-tools:
  before_script:
    - python3 -m venv .ci-python
    - . .ci-python/bin/activate
    - export DSH_VERSION="$(python -c 'import json; print(json.load(open("package.json"))["version"])')"
    - export DSH_WHEEL_VERSION="$(python -c 'import runpy; release = runpy.run_path("scripts/build-python-release.py"); print(release["pep440_version"](release["repository_version"]()))')"
    - test "$CI_COMMIT_TAG" = "python-v$DSH_VERSION" || { echo "Tag $CI_COMMIT_TAG does not match package.json version $DSH_VERSION"; exit 1; }
    - python -m pip install uv==0.11.23

sdk-wheel:
  extends: .python-tools
  stage: build
  tags: [linux-x64]
  script:
    - python scripts/build-python-release.py --package sdk --tag "$CI_COMMIT_TAG" --output-dir release/sdk
  artifacts:
    paths: [release/sdk/*.whl]
    expire_in: 1 week

.runtime-wheel:
  extends: .python-tools
  stage: build
  script:
    - corepack enable
    - pnpm install --frozen-lockfile
    - pnpm run verify-runtime-closure
    - pnpm exec tsx scripts/build-exe-for-python-sdk.ts --targets="$PKG_TARGET"
    - EXE="$PWD/dist-exe/dsh-jsonrpc-agent-pkg-$PLATFORM"
    - test -x "$EXE"
    - uv run --python 3.10 --group test --project python/sdk python scripts/smoke-python-runtime.py --scenario all --exe "$EXE"
    - python scripts/build-python-release.py --package runtime --tag "$CI_COMMIT_TAG" --platform "$PLATFORM" --runtime-exe "$EXE" --output-dir "release/$PLATFORM"
    - python -m venv .wheel-smoke
    - .wheel-smoke/bin/python -m pip install --find-links "release/$PLATFORM" --find-links release/sdk deepseek-harness-sdk=="$DSH_WHEEL_VERSION"
    - .wheel-smoke/bin/python scripts/smoke-python-runtime.py --scenario sdk-default
    - |
      if [ "${PLATFORM#linux-}" != "$PLATFORM" ]; then
        readelf --version-info "$EXE" > glibc-versions.txt
        maximum="$(sed -n 's/.*Name: GLIBC_\([0-9.]*\).*/\1/p' glibc-versions.txt | sort -V | tail -1)"
        test -n "$maximum"
        dpkg --compare-versions "$maximum" le 2.28
        case "$PLATFORM" in
          linux-x64) image=quay.io/pypa/manylinux_2_28_x86_64 ;;
          linux-arm64) image=quay.io/pypa/manylinux_2_28_aarch64 ;;
          *) echo "Unsupported Linux platform $PLATFORM"; exit 1 ;;
        esac
        docker run --rm -v "$PWD:/work" -w /work "$image" bash -euxo pipefail -c "/opt/python/cp310-cp310/bin/python -m venv /tmp/dsh-sdk && /tmp/dsh-sdk/bin/python -m pip install --find-links /work/release/$PLATFORM --find-links /work/release/sdk deepseek-harness-sdk==$DSH_WHEEL_VERSION && /tmp/dsh-sdk/bin/python /work/scripts/smoke-python-runtime.py --scenario sdk-default"
      fi
    - |
      if [ "$PLATFORM" = macos-arm64 ]; then
        python3 scripts/check-macos-deployment-target.py "$EXE" "$EXE-spawn-helper"
      fi
  artifacts:
    paths: [release/$PLATFORM/*.whl]
    expire_in: 1 week

runtime-linux-x64:
  extends: .runtime-wheel
  tags: [linux-x64]
  variables:
    PKG_TARGET: node24-linux-x64
    PLATFORM: linux-x64
  needs:
    - job: sdk-wheel
      artifacts: true

runtime-linux-arm64:
  extends: .runtime-wheel
  tags: [linux-arm64]
  variables:
    PKG_TARGET: node24-linux-arm64
    PLATFORM: linux-arm64
  needs:
    - job: sdk-wheel
      artifacts: true

runtime-macos-arm64:
  extends: .runtime-wheel
  tags: [macos-arm64]
  variables:
    PKG_TARGET: node24-macos-arm64
    PLATFORM: macos-arm64
  needs:
    - job: sdk-wheel
      artifacts: true

publish-python:
  stage: publish
  tags: [linux-x64]
  resource_group: python-release
  needs:
    - job: sdk-wheel
      artifacts: true
    - job: runtime-linux-x64
      artifacts: true
    - job: runtime-linux-arm64
      artifacts: true
    - job: runtime-macos-arm64
      artifacts: true
  before_script:
    - python3 -m venv .ci-python
    - . .ci-python/bin/activate
    - export DSH_VERSION="$(python -c 'import json; print(json.load(open("package.json"))["version"])')"
    - export DSH_WHEEL_VERSION="$(python -c 'import runpy; release = runpy.run_path("scripts/build-python-release.py"); print(release["pep440_version"](release["repository_version"]()))')"
    - test "$CI_COMMIT_TAG" = "python-v$DSH_VERSION" || { echo "Tag $CI_COMMIT_TAG does not match package.json version $DSH_VERSION"; exit 1; }
    - python -m pip install twine==6.2.0
  script:
    - test "$(find release -name '*.whl' | wc -l | tr -d ' ')" = 4
    - test -f "release/sdk/deepseek_harness_sdk-${DSH_WHEEL_VERSION}-py3-none-any.whl"
    - test -f "release/linux-x64/deepseek_harness_runtime_bin-${DSH_WHEEL_VERSION}-py3-none-manylinux_2_28_x86_64.whl"
    - test -f "release/linux-arm64/deepseek_harness_runtime_bin-${DSH_WHEEL_VERSION}-py3-none-manylinux_2_28_aarch64.whl"
    - test -f "release/macos-arm64/deepseek_harness_runtime_bin-${DSH_WHEEL_VERSION}-py3-none-macosx_14_0_arm64.whl"
    - python -m twine check release/*/*.whl
    - export TWINE_USERNAME=gitlab-ci-token
    - export TWINE_PASSWORD="$CI_JOB_TOKEN"
    - export TWINE_REPOSITORY_URL="$CI_API_V4_URL/projects/$CI_PROJECT_ID/packages/pypi"
    - python -m twine upload --non-interactive release/*/*.whl || { echo 'Publish failed. GitLab does not overwrite an existing version; create a new python-v<repository-version> tag.'; exit 1; }