build-ddtrace.yml

# SPDX-FileCopyrightText: 2026 The RISE Project
# SPDX-License-Identifier: MIT
---
# Based on upstream's wheel builder:
#   https://github.com/DataDog/dd-trace-py/blob/v4.13.1/.github/workflows/build_python_3.yml
name: Build ddtrace wheels (riscv64)

on:
  workflow_dispatch:
    inputs:
      version:
        description: 'Version glob to (re)build; empty builds every version of docs/packages/ddtrace.yaml not released yet'
        required: false
        default: ''
  pull_request:
    branches: [main]
    paths:
      - '.github/workflows/build-ddtrace.yml'
      - 'docs/packages/ddtrace.yaml'
  push:
    branches: [main]
    paths:
      - '.github/workflows/build-ddtrace.yml'
      - 'docs/packages/ddtrace.yaml'

concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

permissions:
  contents: read  # to fetch code (actions/checkout)

env:
  MANYLINUX_RISCV64_IMAGE: quay.io/pypa/manylinux_2_39_riscv64
  # setup.py's LIBDDWAF_VERSION. Upstream downloads a prebuilt libddwaf, which
  # is published for aarch64/x86_64 only, so riscv64 compiles it from source.
  LIBDDWAF_VERSION: '2.0.0'

jobs:
  setup:
    uses: $/.github/workflows/_setup.yml
    with:
      package: ddtrace
      version: ${{ inputs.version }}

  build_wheels:
    needs: [setup]
    if: needs.setup.outputs.versions != '[]'
    name: Build ddtrace ${{ matrix.version }} ${{ matrix.python }}-manylinux_riscv64
    runs-on: ubuntu-24.04-riscv
    timeout-minutes: 720
    strategy:
      fail-fast: false
      matrix:
        version: ${{ fromJSON(needs.setup.outputs.versions) }}
        # Upstream skips cp314t and publishes no free-threaded wheel anywhere.
        python: ["cp312", "cp313", "cp314"]

    env:
      DDTRACE_VERSION: ${{ matrix.version }}

    steps:
      - name: Checkout dd-trace-py v${{ env.DDTRACE_VERSION }}
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          repository: DataDog/dd-trace-py
          ref: v${{ env.DDTRACE_VERSION }}
          persist-credentials: false

      - name: Checkout python-wheels
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          path: python-wheels
          persist-credentials: false

      - name: Apply riscv64 patches
        run: git apply -v python-wheels/patches/ddtrace/${{ env.DDTRACE_VERSION }}/*.patch

      - name: Build wheels
        uses: pypa/cibuildwheel@1828c10ab37f080699c7b81cea34097c684a7074  # v4.2.0
        with:
          only: ${{ matrix.python }}-manylinux_riscv64
        env:
          CIBW_MANYLINUX_RISCV64_IMAGE: ${{ env.MANYLINUX_RISCV64_IMAGE }}
          CIBW_ENVIRONMENT_LINUX: >-
            PATH=$PATH:$HOME/.cargo/bin
            PIP_EXTRA_INDEX_URL=https://pypi.riseproject.dev/simple/
          # setup.py drops libddwaf into the wheel from
          # ddtrace/appsec/_ddwaf/libddwaf/<arch>/lib/ and skips the download
          # when that tree already exists, so building it here is enough.
          CIBW_BEFORE_ALL_LINUX: |
            set -euxo pipefail
            curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
            dnf -y install libstdc++-static  # libddwaf links -static-libstdc++
            git clone --depth 1 --branch "${{ env.LIBDDWAF_VERSION }}" \
              https://github.com/DataDog/libddwaf.git /tmp/libddwaf
            cmake -S /tmp/libddwaf -B /tmp/libddwaf/build \
              -DCMAKE_BUILD_TYPE=RelWithDebInfo \
              -DLIBDDWAF_BUILD_STATIC=OFF -DLIBDDWAF_TESTING=OFF
            cmake --build /tmp/libddwaf/build --parallel "$(nproc)"
            cmake --install /tmp/libddwaf/build --prefix /tmp/libddwaf/install
            install -D /tmp/libddwaf/install/lib*/libddwaf.so \
              {project}/ddtrace/appsec/_ddwaf/libddwaf/riscv64/lib/libddwaf.so
          # setup.py drives CMake through the `cmake` PyPI package, whose oldest
          # riscv64 wheel is 4.1.0 — outside pyproject.toml's `cmake<3.28` pin,
          # hence the preinstall and pip's unvalidated --no-build-isolation.
          CIBW_BEFORE_BUILD: >-
            pip install cython "cmake>=4.1" "setuptools-rust<2"
            "patchelf>=0.17.0.0" setuptools wheel
          CIBW_BUILD_FRONTEND: "pip; args: --no-build-isolation"
          CIBW_TEST_COMMAND: python {project}/tests/smoke_test.py

      - name: Check the native extensions made it into the wheel
        run: |
          python3 - wheelhouse/*.whl <<'EOF'
          import sys, zipfile
          for whl in sys.argv[1:]:
              names = [n for n in zipfile.ZipFile(whl).namelist() if n.endswith(".so")]
              assert "ddtrace/appsec/_ddwaf/libddwaf/riscv64/lib/libddwaf.so" in names, whl
              assert len(names) > 15, (whl, names)
              print(whl, len(names), "shared objects")
          EOF

      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
        with:
          name: ddtrace-${{ env.DDTRACE_VERSION }}-${{ matrix.python }}-manylinux_riscv64
          path: wheelhouse/*.whl
          if-no-files-found: error

  publish:
    name: Publish ddtrace ${{ matrix.version }}
    needs: [setup, build_wheels]
    if: needs.setup.outputs.versions != '[]'
    strategy:
      fail-fast: false
      matrix:
        version: ${{ fromJSON(needs.setup.outputs.versions) }}
    permissions:
      contents: write
      pull-requests: write
    uses: $/.github/workflows/_publish-wheel.yml
    secrets:
      app-private-key: ${{ secrets.RISEPROJECT_APP_PRIVATE_KEY }}
    with:
      artifact-pattern: ddtrace-${{ matrix.version }}-*-manylinux_riscv64