python.yml

name: Python bindings

# The pyo3 bindings live in a standalone workspace (python/) outside the main
# tree's `unsafe_code = "forbid"`, so the main ci.yml does not build them. This
# workflow builds the wheel with maturin and runs the Python integration tests
# (roadmap §3.2).
on:
  push:
    paths:
      - "python/**"
      - "core/**"
      - "forensic/**"
      - ".github/workflows/python.yml"
  pull_request:
    paths:
      - "python/**"
      - "core/**"
      - "forensic/**"
  workflow_dispatch:

permissions:
  contents: read

jobs:
  bindings:
    name: Build + test bindings
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: dtolnay/rust-toolchain@stable
      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: "3.11"
      # python/ is a standalone workspace that release-plz does not manage, so a
      # library version bump (sqlite-core/sqlite-forensic) leaves python/Cargo.lock
      # pinning the old version and breaks the --locked steps below. Re-lock only
      # those two path deps to the current source version; every third-party crate
      # (pyo3, …) stays locked, so the wheel remains reproducible.
      - name: Sync bindings lockfile to current crate versions
        working-directory: python
        run: cargo update -p sqlite-core -p sqlite-forensic
      - name: clippy (bindings)
        working-directory: python
        run: cargo clippy --all-targets --locked -- -D warnings
      - name: Install maturin + pytest
        run: pip install "maturin>=1,<2" pytest
      - name: Build + install the extension
        working-directory: python
        run: maturin build --release --locked --out dist && pip install dist/*.whl
      - name: Run the Python tests
        working-directory: python
        run: python -m pytest tests/ -q