Validate wheel ABI, linkage, and runtime compatibility

HA
4d ago
+1091-65

Fixes #448

Summary

  • Inspect ELF, Mach-O, and PE headers and verify the wheel's platform tag, architecture, and bitness.
  • Require the exported xy_abi_version symbol and validate Linux, macOS, and Windows linkage policy.
  • Include the glibc 2.17 system libraries used by Rust and the Windows bcryptprimitives.dll and ntdll.dll imports.
  • Run an install and representative native-kernel smoke test for every published native wheel.
  • Keep the release matrix and expect-artifacts contract aligned, and document the supported prebuilt wheel targets.

Local validation

  • python -m pytest tests/test_verify_wheel.py tests/test_release_process.py tests/test_kernels.py -q: 193 passed, 1 skipped.
  • python scripts/verify_ci_workflow.py: passed.
  • Ruff check/format and git diff --check: passed.
  • cargo test: 137 passed.
  • scripts/abi_smoke.py: 140 checks passed against the built Windows DLL.
  • Built xy-0.0.0-py3-none-win_amd64.whl; the verifier passed platform, ABI export, and linkage checks against the wheel and real DLL.
  • uvx reflex-release@0.1.0a4 sync --check, Ruff, and git diff --check: passed.

The native install/load matrix cannot run on this Windows development machine; the hosted release workflow must supply the cross-platform runtime proof. The docs-site pytest could not be collected locally because the docs environment dependency reflex_base is not installed.

Platform coverage

The release matrix retains all eleven previously published native wheel targets. Each wheel gets an install and native-kernel smoke on a matching native runner, with ARMv7 targets exercised in QEMU containers and musllinux wheels installed in Alpine. The artifact contract and installation/release documentation list the same complete target set.

Summary by CodeRabbit

  • Release Improvements

    • Release packages target Linux glibc and musl (x86-64, aarch64, armv7), macOS Intel and Apple Silicon, and Windows x86, x64, and ARM64.
    • Packages are verified for platform compatibility, required native components, and system linkage before release.
    • Every package undergoes runtime smoke testing, including native NumPy kernel checks and installed-version validation.

  • Reliability

    • Improved detection of incompatible architectures, missing native symbols, and unsupported system library requirements.
    • Release checks now prevent packages built without native runtime support from being published.

  • Documentation

    • Updated platform support and release-readiness guidance to reflect the verified package targets.