build-apache-beam.yml

# SPDX-FileCopyrightText: 2026 The RISE Project
# SPDX-License-Identifier: MIT
---
name: Build apache-beam wheels (riscv64)

on:
  workflow_dispatch:
    inputs:
      version:
        description: 'Version glob to (re)build; empty builds every version of docs/packages/apache-beam.yaml not released yet'
        required: false
        default: ''
  pull_request:
    branches: [main]
    paths:
      - '.github/workflows/build-apache-beam.yml'
      - 'docs/packages/apache-beam.yaml'
  push:
    branches: [main]
    paths:
      - '.github/workflows/build-apache-beam.yml'
      - 'docs/packages/apache-beam.yaml'

concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

permissions:
  contents: read  # to fetch code (actions/checkout)

env:
  MANYLINUX_RISCV64_IMAGE: quay.io/pypa/manylinux_2_39_riscv64

jobs:
  setup:
    uses: $/.github/workflows/_setup.yml
    with:
      package: apache-beam
      version: ${{ inputs.version }}

  python_sdist:
    needs: [setup]
    if: needs.setup.outputs.versions != '[]'
    strategy:
      fail-fast: false
      matrix:
        version: ${{ fromJSON(needs.setup.outputs.versions) }}
    # Mirrors upstream's build_wheels.yml build_source job: build the sdist from
    # the checkout on x86_64 (grpcio-tools' build-system.requires pin resolves
    # fine there), then build the riscv64 bdist from that sdist in `linux` below.
    runs-on: ubuntu-latest
    env:
      APACHE_BEAM_VERSION: ${{ matrix.version }}

    steps:
      - name: checkout apache/beam v${{ env.APACHE_BEAM_VERSION }}
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          repository: apache/beam
          ref: v${{ env.APACHE_BEAM_VERSION }}
          persist-credentials: false

      - name: setup python
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
        with:
          python-version: '3.11'

      - name: build sdist
        id: build_sdist
        working-directory: sdks/python
        run: |
          set -eux

          # MANIFEST.in already lists NOTICE/LICENSE/LICENSE.python, but they
          # live at the repo root, not sdks/python - upstream's own released
          # sdist on PyPI ships without them for the same reason.
          cp ../../LICENSE ../../NOTICE ../../LICENSE.python .

          # setup.py's own module-level `import pkg_resources` (2.61.0's era)
          # breaks under today's latest setuptools, which no longer ships it;
          # flink's own build-system.requires caps the same way for the same
          # reason. PIP_BUILD_CONSTRAINT covers the isolated build env `build`
          # creates for the sdist hook; PIP_CONSTRAINT is the belt-and-suspenders
          # match for anything installed outside it.
          echo "setuptools<82" > /tmp/build-constraint.txt
          export PIP_CONSTRAINT=/tmp/build-constraint.txt
          export PIP_BUILD_CONSTRAINT=/tmp/build-constraint.txt

          pip install -U build
          python -m build --sdist

      - name: upload sdist artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
        with:
          name: apache-beam-${{ env.APACHE_BEAM_VERSION }}-sdist
          path: sdks/python/dist/*.tar.gz
          if-no-files-found: error

  linux:
    # apache_beam/{coders,metrics,runners,transforms,utils}'s *.pyx/*.py get
    # cythonized into ~17 small extension modules - no external native
    # dependency, no CIBW_BEFORE_ALL needed.
    needs: [setup, python_sdist]
    if: needs.setup.outputs.versions != '[]'
    name: Build apache-beam ${{ matrix.version }} ${{ matrix.python }}-manylinux_riscv64
    runs-on: ubuntu-24.04-riscv
    strategy:
      fail-fast: false
      matrix:
        version: ${{ fromJSON(needs.setup.outputs.versions) }}
        # cp314t dropped: upstream's own build_wheels.yml matrix never builds
        # it (no free-threading support declared for Beam's Cython extensions).
        python: ["cp312", "cp313", "cp314"]
        exclude:
          # 2.61.0 is the newest release still inside apache-flink's declared
          # apache-beam<=2.61.0 window; it predates cp313 (and upstream itself
          # never shipped a wheel past cp312 for it).
          - version: "2.61.0"
            python: cp313
          - version: "2.61.0"
            python: cp314

    env:
      APACHE_BEAM_VERSION: ${{ matrix.version }}

    steps:
    - name: fetch sdist artifact
      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
      with:
        name: apache-beam-${{ env.APACHE_BEAM_VERSION }}-sdist
        path: sdist

    - name: setup uv
      uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d  # v10.0.1
      with:
        python-version: '3.12'
        activate-environment: true
        enable-cache: false

    - name: build wheel
      env:
        CIBW_BUILD: ${{ matrix.python }}-manylinux_riscv64
        CIBW_MANYLINUX_RISCV64_IMAGE: ${{ env.MANYLINUX_RISCV64_IMAGE }}
        # pyproject.toml's build-system.requires pins grpcio-tools==1.62.1 (or
        # 1.71.0 on 3.13+), which has no riscv64 wheel - but it's unused here:
        # the sdist ships pre-generated apache_beam/portability/api/*_pb2.py
        # with no .proto sources alongside them, so gen_protos.py's "no proto
        # files, reuse the existing output" branch never imports grpc_tools.
        # --no-build-isolation (CLAUDE.md gotcha 76) skips resolving that pin
        # instead of patching it.
        CIBW_BUILD_FRONTEND: "pip; args: --no-build-isolation"
        # setuptools<82 (CLAUDE.md gotcha 29): setup.py's module-level `import
        # pkg_resources` breaks under today's latest setuptools, which no
        # longer ships it - same reason the sdist job above pins it, but this
        # install is a separate one, inside the manylinux_riscv64 container.
        CIBW_BEFORE_BUILD: >-
          pip install "cython>=3.2.5,<4" "numpy>=1.14.3,<2.5.0"
          --config-settings=setup-args="-Dallow-noblas=true" "setuptools<82" wheel
        CIBW_ENVIRONMENT: >-
          PIP_EXTRA_INDEX_URL=https://pypi.riseproject.dev/simple/
          PIP_ONLY_BINARY=numpy
      run: |
        set -eux

        mkdir apache-beam
        tar zxf sdist/*.tar.gz --strip-components=1 -C apache-beam

        uv pip install --upgrade cibuildwheel
        python -m cibuildwheel --output-dir dist ./apache-beam

    - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
      with:
        name: apache-beam-${{ matrix.version }}-${{ matrix.python }}-manylinux_riscv64
        path: ./dist/*.whl
        if-no-files-found: error

  publish:
    name: Publish apache-beam ${{ matrix.version }}
    needs: [setup, python_sdist, linux]
    if: needs.setup.outputs.versions != '[]'
    strategy:
      fail-fast: false
      matrix:
        version: ${{ fromJSON(needs.setup.outputs.versions) }}
    permissions:
      contents: write
      pull-requests: write
    uses: $/.github/workflows/_publish-wheel.yml
    secrets:
      app-private-key: ${{ secrets.RISEPROJECT_APP_PRIVATE_KEY }}
    with:
      artifact-pattern: apache-beam-${{ matrix.version }}-*-manylinux_riscv64