Improve CI: build caching, self-contained packages, accurate deb deps

.github/workflows/build-deb.yml

@@ -4,6 +4,10 @@ on:
   push:
     branches: [ main ]
   workflow_dispatch:
+  workflow_call:
+
+permissions:
+  contents: read
 
 jobs:
   build:
@@ -95,22 +99,28 @@ jobs:
             --build-arg THREADS=3 \
             -t monero-python:${{ matrix.name }}-${{ matrix.arch }} \
             -f Dockerfile.linux \
+            --cache-from type=gha,scope=${{ matrix.name }}-${{ matrix.arch }} \
+            --cache-to type=gha,mode=max,scope=${{ matrix.name }}-${{ matrix.arch }} \
             --load \
             .
 
       - name: Build monero-python
-        run: |
-          PLATFORM=${{ matrix.arch == 'amd64' && 'linux/amd64' ||
-                      matrix.arch == 'armhf' && 'linux/arm/v7' ||
-                      'linux/arm64' }}
-          PACKAGE_NAME="python3-monero_${{ github.run_id }}-1${{ matrix.name }}1_${{ matrix.arch }}"
+        uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # v4.0.0
+        with:
+          max_attempts: 3
+          retry_wait_seconds: 15
+          command: |
+            PLATFORM=${{ matrix.arch == 'amd64' && 'linux/amd64' ||
+                        matrix.arch == 'armhf' && 'linux/arm/v7' ||
+                        'linux/arm64' }}
+            PACKAGE_NAME="python3-monero_${{ github.run_id }}-1${{ matrix.name }}1_${{ matrix.arch }}"
 
-          docker run --rm \
-            --platform $PLATFORM \
-            -v $PWD:/monero-python -w /monero-python \
-            -e PACKAGE_NAME="${PACKAGE_NAME}" \
-            monero-python:${{ matrix.name }}-${{ matrix.arch }} \
-            bash -euxc "./docker/build.sh"
+            docker run --rm \
+              --platform $PLATFORM \
+              -v $PWD:/monero-python -w /monero-python \
+              -e PACKAGE_NAME="${PACKAGE_NAME}" \
+              monero-python:${{ matrix.name }}-${{ matrix.arch }} \
+              bash -euxc "./docker/build.sh"
 
       - name: Upload deb package
         uses: actions/upload-artifact@v4

.github/workflows/build-macos.yml

@@ -4,23 +4,41 @@ on:
   push:
     branches: [ main ]
   workflow_dispatch:
+  workflow_call:
+
+permissions:
+  contents: read
 
 jobs:
   build:
-    name: ${{ matrix.os }} (arm64)
+    name: ${{ matrix.os }}
     runs-on: ${{ matrix.os }}
 
     strategy:
       fail-fast: false
       matrix:
-        os: [macos-14, macos-15]
+        os: [macos-14, macos-15, macos-15-intel]
 
     steps:
     - name: Checkout repository
       uses: actions/checkout@v4
       with:
         submodules: recursive
 
+    - name: Determine monero submodule version
+      run: git submodule status --recursive > .monero-submodule-version
+
+    - name: Cache monero/monero-cpp build
+      id: cache-monero
+      uses: actions/cache@v4
+      with:
+        path: |
+          external/monero-cpp/external/monero-project/build
+          external/monero-cpp/build
+        key: monero-build-macos-${{ matrix.os }}-${{ hashFiles('.monero-submodule-version') }}
+        restore-keys: |
+          monero-build-macos-${{ matrix.os }}-
+
     - name: Install dependencies
       run: |
         HOMEBREW_NO_AUTO_UPDATE=1 brew install python boost@1.85 hidapi openssl zmq libpgm miniupnpc expat libunwind-headers protobuf unbound
@@ -32,7 +50,12 @@ jobs:
       run: |
         pip3 install pybind11==2.13.6 pybind11-stubgen --break-system-packages
 
+    - name: Install delocate
+      run: |
+        pip3 install delocate --break-system-packages
+
     - name: Build monero
+      if: steps.cache-monero.outputs.cache-hit != 'true'
       run: |
         cd external/monero-cpp/external/monero-project
         mkdir -p build/release
@@ -42,6 +65,7 @@ jobs:
         cd ../../../../../../
 
     - name: Build monero-cpp
+      if: steps.cache-monero.outputs.cache-hit != 'true'
       run: |
         cd external/monero-cpp
         mkdir -p build
@@ -56,8 +80,12 @@ jobs:
         mkdir -p build
         python3 -m pip wheel . -w dist --no-build-isolation
 
+    - name: Repair wheel with delocate
+      run: |
+        delocate-wheel -w wheelhouse -v dist/*.whl
+
     - name: Upload artifacts
       uses: actions/upload-artifact@v4
       with:
         name: monero-${{ matrix.os }}
-        path: dist/*.whl
+        path: wheelhouse/*.whl

.github/workflows/build-windows.yml

@@ -4,6 +4,10 @@ on:
   push:
     branches: [ main ]
   workflow_dispatch:
+  workflow_call:
+
+permissions:
+  contents: read
 
 jobs:
   msys2-mingw64:
@@ -20,14 +24,34 @@ jobs:
         with:
           submodules: recursive
 
+      - name: Determine monero submodule version
+        shell: bash
+        run: git submodule status --recursive > .monero-submodule-version
+
+      - name: Cache monero/monero-cpp build
+        id: cache-monero
+        uses: actions/cache@v4
+        with:
+          path: |
+            external/monero-cpp/external/monero-project/build
+            external/monero-cpp/build
+          key: monero-build-windows-${{ hashFiles('.monero-submodule-version') }}
+          restore-keys: |
+            monero-build-windows-
+
       - name: Setup Python 3.13
         uses: actions/setup-python@v5
         with:
           python-version: '3.13'
           architecture: 'x64'
 
+      - name: Install Python build dependencies
+        shell: bash
+        run: |
+          python -m pip install scikit-build-core delvewheel
+
       - name: Setup MSYS2 MINGW64
-        uses: msys2/setup-msys2@v2
+        uses: msys2/setup-msys2@66cd2cce69caa17b53920067426061ca1de3a884 # v2.32.0
         with:
           msystem: MINGW64
           update: true
@@ -49,25 +73,25 @@ jobs:
             wget
 
       - name: Install ICU v75.1
-        shell: msys2 {0}
         run: |
           wget https://repo.msys2.org/mingw/mingw64/mingw-w64-x86_64-icu-75.1-2-any.pkg.tar.zst
+          echo "bf57882d43efcdfd746463613ea982c69b64aa4ba9bed4cb24c02a81ad06c3a9  mingw-w64-x86_64-icu-75.1-2-any.pkg.tar.zst" | sha256sum -c
           pacman -U --noconfirm mingw-w64-x86_64-icu-75.1-2-any.pkg.tar.zst
 
       - name: Install boost v1.87.0
-        shell: msys2 {0}
         run: |
           wget https://repo.msys2.org/mingw/mingw64/mingw-w64-x86_64-boost-1.87.0-3-any.pkg.tar.zst
+          echo "241919a5885a9270d0e0937e71cf5e146c2a8cabecc2714f09248350181cb1b6  mingw-w64-x86_64-boost-1.87.0-3-any.pkg.tar.zst" | sha256sum -c
           pacman -U --noconfirm mingw-w64-x86_64-boost-1.87.0-3-any.pkg.tar.zst
 
-      - name: Install pybind11 v2.13.1
-        shell: msys2 {0}
+      - name: Install pybind11 v2.13.6
         run: |
           wget https://repo.msys2.org/mingw/mingw64/mingw-w64-x86_64-pybind11-2.13.6-2-any.pkg.tar.zst
+          echo "5b56ad87bc544336b2d51edb8bb0614f46542571362daf4d7e53bf23120175a1  mingw-w64-x86_64-pybind11-2.13.6-2-any.pkg.tar.zst" | sha256sum -c
           pacman -U --noconfirm mingw-w64-x86_64-pybind11-2.13.6-2-any.pkg.tar.zst
 
       - name: Build monero
-        shell: msys2 {0}
+        if: steps.cache-monero.outputs.cache-hit != 'true'
         run: |
           cd external/monero-cpp/external/monero-project
           mkdir -p build/release
@@ -84,33 +108,30 @@ jobs:
             make wallet cryptonote_protocol
 
       - name: Build monero-cpp
-        shell: msys2 {0}
+        if: steps.cache-monero.outputs.cache-hit != 'true'
         run: |
           cd external/monero-cpp
           mkdir -p build
           cd build
           cmake ..
           cmake --build .
 
-      - name: Build monero-python
-        shell: msys2 {0}
+      - name: Build wheel
         run: |
-          mkdir -p build
-          cd build
-          export WIN_PYTHON_EXE=$(cygpath -u "$PYTHON")
-          cmake .. -DPython3_EXECUTABLE="$WIN_PYTHON_EXE" \
-            -DPython3_FIND_STRATEGY=LOCATION \
-            -DPython3_FIND_REGISTRY=NEVER
-          cmake --build .
-          mkdir -p ../dist
-          cp *.pyd ../dist/monero.pyd
-          cd ../dist
-          ntldd -R *.pyd | grep mingw64 | awk '{print $3}' | while read -r line; do
-            cp "$(cygpath -u "$line")" .
-          done
+          export WIN_PYTHON_EXE=$(cygpath -u "$pythonLocation/python.exe")
+          "$WIN_PYTHON_EXE" -m pip wheel . -w dist --no-build-isolation \
+            -C cmake.define.Python3_EXECUTABLE="$WIN_PYTHON_EXE" \
+            -C cmake.define.Python3_FIND_STRATEGY=LOCATION \
+            -C cmake.define.Python3_FIND_REGISTRY=NEVER
+
+      - name: Repair wheel with delvewheel
+        run: |
+          export WIN_PYTHON_EXE=$(cygpath -u "$pythonLocation/python.exe")
+          MINGW_BIN_WIN=$(cygpath -w "$MINGW_PREFIX/bin")
+          "$WIN_PYTHON_EXE" -m delvewheel repair dist/*.whl -w wheelhouse --add-path "$MINGW_BIN_WIN"
 
       - name: Upload artifacts
         uses: actions/upload-artifact@v4
         with:
           name: monero-python-win-amd64
-          path: dist/
+          path: wheelhouse/*.whl

.github/workflows/codacy.yml

@@ -13,7 +13,7 @@ permissions:
 
 jobs:
   report-coverage-linux:
-    if: github.repository == 'everoddandeven/monero-python'
+    if: github.repository == 'everoddandeven/monero-python' && (github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success')
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code

.github/workflows/release.yml

@@ -0,0 +1,59 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+permissions:
+  contents: read
+
+jobs:
+  build-deb:
+    uses: ./.github/workflows/build-deb.yml
+
+  build-macos:
+    uses: ./.github/workflows/build-macos.yml
+
+  build-windows:
+    uses: ./.github/workflows/build-windows.yml
+
+  release:
+    name: Publish draft release
+    needs: [build-deb, build-macos, build-windows]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+
+    steps:
+      - name: Download deb packages
+        uses: actions/download-artifact@v4
+        with:
+          pattern: python3-monero_*
+          path: release-assets
+          merge-multiple: true
+
+      - name: Download macos wheels
+        uses: actions/download-artifact@v4
+        with:
+          pattern: monero-macos-*
+          path: release-assets
+          merge-multiple: true
+
+      - name: Download windows wheel
+        uses: actions/download-artifact@v4
+        with:
+          name: monero-python-win-amd64
+          path: release-assets
+          merge-multiple: true
+
+      - name: Create draft release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh release create "${{ github.ref_name }}" \
+            --repo "${{ github.repository }}" \
+            --draft \
+            --title "${{ github.ref_name }}" \
+            --generate-notes \
+            release-assets/*.deb release-assets/*.whl