Release v0.1.0

.github/workflows/ci.yml

@@ -0,0 +1,108 @@
+name: CI
+
+on:
+  push:
+    branches: [main, release]
+  pull_request:
+    branches: [main, release]
+  workflow_dispatch:
+
+env:
+  CARGO_TERM_COLOR: always
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  release-source-gate:
+    # PRs targeting `release` are only allowed from `main`. GitHub branch
+    # protection has no "restrict source branch" setting, so we enforce it
+    # here as a required check. Make this a required status check on the
+    # `release` branch so the PR can't merge without it.
+    if: github.event_name == 'pull_request' && github.base_ref == 'release'
+    runs-on: ubuntu-latest
+    steps:
+      - name: PRs to release must come from main
+        run: |
+          if [ "$GITHUB_HEAD_REF" != "main" ]; then
+            echo "::error::PRs to release must come from main, got '$GITHUB_HEAD_REF'."
+            exit 1
+          fi
+
+  ci:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: rustfmt, clippy
+
+      - uses: Swatinem/rust-cache@v2
+
+      - uses: astral-sh/setup-uv@v6
+        with:
+          enable-cache: true
+          cache-dependency-glob: uv.lock
+
+      - name: Rust formatting
+        run: cargo fmt --all --check
+
+      - name: Clippy
+        run: cargo clippy --all -- -D warnings
+
+      - name: Rust tests
+        run: cargo test --all
+
+      - name: Install Python deps
+        run: uv sync --locked
+
+      - name: Build extension
+        run: uv run maturin develop
+
+      - name: Ruff check
+        run: uv run ruff check
+
+      - name: Ruff format
+        run: uv run ruff format --check
+
+      - name: Python tests
+        run: uv run pytest
+
+  tier2:
+    # Tier 2: external regression against the full harfrust shaping corpus.
+    # Only runs on the release branch, where we care about version-drift signal.
+    if: github.ref == 'refs/heads/release' || github.base_ref == 'release'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Check out harfrust at 0.5.2
+        uses: actions/checkout@v6
+        with:
+          repository: harfbuzz/harfrust
+          # Pinned to the 0.5.2 commit so the test corpus matches the hr-shape
+          # version declared in Cargo.toml. Bump this alongside the dep.
+          ref: efdae3142ab76a2f1524d72cff9e3dfdc5afd7ca
+          path: harfrust-external
+
+      - uses: dtolnay/rust-toolchain@stable
+
+      - uses: Swatinem/rust-cache@v2
+
+      - uses: astral-sh/setup-uv@v6
+        with:
+          enable-cache: true
+          cache-dependency-glob: uv.lock
+
+      - name: Install Python deps
+        run: uv sync --locked
+
+      - name: Build extension
+        run: uv run maturin develop
+
+      - name: Tier 2 shaping regression
+        env:
+          HARFRUST_SOURCE: ${{ github.workspace }}/harfrust-external
+        run: uv run pytest -m external

.github/workflows/release.yml

@@ -0,0 +1,143 @@
+name: Release
+
+on:
+  push:
+    tags: ['v*']
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  gate:
+    # Enforce that the tag points to the current tip of `release`. The
+    # release-branch CI (ci.yml) runs Tier 1 + Tier 2 on every push to
+    # release, so tip-of-release is the SHA on which full CI passed.
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Tag must point to the tip of release
+        run: |
+          git fetch origin release --depth=1
+          expected=$(git rev-parse FETCH_HEAD)
+          if [ "$GITHUB_SHA" != "$expected" ]; then
+            echo "::error::Tag $GITHUB_REF_NAME ($GITHUB_SHA) is not the tip of release ($expected). See RELEASING.md."
+            exit 1
+          fi
+
+  linux:
+    runs-on: ubuntu-latest
+    needs: gate
+    strategy:
+      fail-fast: false
+      matrix:
+        target: [x86_64, aarch64]
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: PyO3/maturin-action@v1
+        with:
+          target: ${{ matrix.target }}
+          manylinux: auto
+          args: --release --out dist -i python3.11 -i python3.12 -i python3.13
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: wheels-linux-${{ matrix.target }}
+          path: dist
+
+  macos:
+    needs: gate
+    strategy:
+      fail-fast: false
+      matrix:
+        target: [x86_64, aarch64]
+        python-version: ['3.11', '3.12', '3.13']
+        include:
+          - target: x86_64
+            runner: macos-13
+          - target: aarch64
+            runner: macos-14
+    runs-on: ${{ matrix.runner }}
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - uses: PyO3/maturin-action@v1
+        with:
+          target: ${{ matrix.target }}
+          args: --release --out dist -i python${{ matrix.python-version }}
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: wheels-macos-${{ matrix.target }}-py${{ matrix.python-version }}
+          path: dist
+
+  windows:
+    runs-on: windows-latest
+    needs: gate
+    strategy:
+      fail-fast: false
+      matrix:
+        target: [x64]
+        python-version: ['3.11', '3.12', '3.13']
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+          architecture: ${{ matrix.target }}
+
+      - uses: PyO3/maturin-action@v1
+        with:
+          target: ${{ matrix.target }}
+          args: --release --out dist
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: wheels-windows-${{ matrix.target }}-py${{ matrix.python-version }}
+          path: dist
+
+  sdist:
+    runs-on: ubuntu-latest
+    needs: gate
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: PyO3/maturin-action@v1
+        with:
+          command: sdist
+          args: --out dist
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: sdist
+          path: dist
+
+  publish:
+    name: Publish to PyPI
+    runs-on: ubuntu-latest
+    needs: [linux, macos, windows, sdist]
+    if: startsWith(github.ref, 'refs/tags/v')
+    environment:
+      name: pypi
+      url: https://pypi.org/p/pyharfrust
+    permissions:
+      # Required for PyPI trusted publishing (OIDC). Configure the publisher
+      # at https://pypi.org/manage/account/publishing/ before tagging a release.
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          path: dist
+          merge-multiple: true
+
+      - uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          packages-dir: dist
+          skip-existing: true

.gitignore

@@ -0,0 +1,21 @@
+# Local Cargo config (dev overrides for sibling checkouts)
+.cargo/config.toml
+
+# Rust
+target/
+**/*.rs.bk
+
+# Python
+__pycache__/
+*.py[cod]
+*.so
+*.pyd
+*.egg-info/
+
+# Environments
+.venv/
+
+# Testing
+.pytest_cache/
+
+**/*.dSYM

.pre-commit-config.yaml

@@ -0,0 +1,65 @@
+default_install_hook_types: [pre-commit, pre-push]
+repos:
+- repo: https://github.com/pre-commit/pre-commit-hooks
+  rev: v6.0.0
+  hooks:
+    - id: trailing-whitespace
+    - id: end-of-file-fixer
+    - id: check-yaml
+    - id: check-added-large-files
+    - id: check-merge-conflict
+    - id: no-commit-to-branch
+      args: [--branch, main, --branch, release]
+
+- repo: https://github.com/astral-sh/uv-pre-commit
+  rev: 0.11.3
+  hooks:
+    - id: uv-lock
+      args: [--locked]
+
+# pre-commit: fast formatting and lint checks only
+- repo: local
+  hooks:
+    - id: cargo-fmt
+      name: cargo fmt
+      entry: cargo fmt --all --check
+      language: system
+      types: [rust]
+      pass_filenames: false
+
+    - id: ruff-check
+      name: ruff check
+      entry: uv run ruff check --fix
+      language: system
+      types: [python]
+
+    - id: ruff-format
+      name: ruff format
+      entry: uv run ruff format --force-exclude
+      language: system
+      types: [python]
+
+# pre-push: compilation, linting, and tests
+    - id: cargo-clippy
+      name: cargo clippy
+      entry: cargo clippy --all -- -D warnings
+      language: system
+      types: [rust]
+      pass_filenames: false
+      stages: [pre-push]
+
+    - id: cargo-test
+      name: cargo test
+      entry: cargo test --all
+      language: system
+      types: [rust]
+      pass_filenames: false
+      stages: [pre-push]
+
+    - id: pytest
+      name: pytest
+      entry: uv run pytest
+      language: system
+      types_or: [python, rust]
+      pass_filenames: false
+      stages: [pre-push]