ci: install uv and maturin from PyPI when GitHub release downloads fail

.github/actions/setup-uv/action.yml

@@ -0,0 +1,58 @@
+name: Set up uv
+description: >-
+  Install a pinned uv from PyPI and optionally cache its package cache. Installing from PyPI
+  keeps setup working when GitHub release downloads fail.
+inputs:
+  version:
+    description: Exact uv version to install
+    required: true
+  enable-cache:
+    description: Restore and save the uv cache, keyed on the dependency files
+    required: false
+    default: "false"
+  cache-dependency-glob:
+    description: Files whose contents key the cache, one path per line
+    required: false
+    default: uv.lock
+runs:
+  using: composite
+  steps:
+    # The runner's cached Python, left off PATH so jobs keep the Python they set up themselves.
+    - id: python
+      uses: actions/setup-python@v5
+      with:
+        python-version: "3.12"
+        update-environment: false
+    - name: Install uv from PyPI
+      shell: bash
+      env:
+        PYTHON: ${{ steps.python.outputs.python-path }}
+        UV_VERSION: ${{ inputs.version }}
+      run: |
+        package="${RUNNER_TEMP}/uv-package"
+        "${PYTHON}" -m pip install --disable-pip-version-check --no-warn-script-location \
+          --target "${package}" "uv==${UV_VERSION}"
+        mkdir -p "${RUNNER_TEMP}/uv-bin"
+        for executable in "${package}"/bin/uv* "${package}"/Scripts/uv*; do
+          if [[ -f "${executable}" ]]; then cp "${executable}" "${RUNNER_TEMP}/uv-bin/"; fi
+        done
+        echo "${RUNNER_TEMP}/uv-bin" >> "${GITHUB_PATH}"
+        "${RUNNER_TEMP}/uv-bin/uv" --version
+    - id: cache-key
+      if: inputs.enable-cache == 'true'
+      name: Key the uv cache on the dependency files
+      shell: bash
+      env:
+        FILES: ${{ inputs.cache-dependency-glob }}
+        UV_VERSION: ${{ inputs.version }}
+      run: |
+        echo "UV_CACHE_DIR=${RUNNER_TEMP}/setup-uv-cache" >> "${GITHUB_ENV}"
+        digest=$(while IFS= read -r file; do
+          if [[ -n "${file// /}" ]]; then sha256sum "${file// /}"; fi
+        done <<< "${FILES}" | sha256sum | cut -c1-64)
+        echo "key=uv-pypi-${RUNNER_OS}-${RUNNER_ARCH}-${UV_VERSION}-${digest}" >> "${GITHUB_OUTPUT}"
+    - if: inputs.enable-cache == 'true'
+      uses: actions/cache@v4
+      with:
+        path: ${{ runner.temp }}/setup-uv-cache
+        key: ${{ steps.cache-key.outputs.key }}

.github/workflows/benchmark-dbt.yml

@@ -70,7 +70,7 @@ jobs:
         shell: bash
     steps:
       - uses: actions/checkout@v4
-      - uses: astral-sh/setup-uv@v5
+      - uses: ./.github/actions/setup-uv
         with:
           version: "0.12.3"
       - name: Validate inputs

.github/workflows/build-distributions.yml

@@ -141,8 +141,13 @@ jobs:
         run: |
           npm ci
           npm run build
-      - uses: PyO3/maturin-action@v1
+      # maturin-action downloads maturin from GitHub releases, which can fail on its own. Each
+      # build retries once; macOS and Windows then fall back to the same maturin from PyPI. Linux
+      # builds need the action's manylinux container, so they have no fallback.
+      - id: extension
+        uses: PyO3/maturin-action@v1
         if: inputs.prebuilt-run-id == ''
+        continue-on-error: true
         with:
           command: build
           # One platform records a cargo build timing report for build time work.
@@ -151,8 +156,33 @@ jobs:
             ${{ matrix.platform.name == 'linux-x86_64' && '--timings' || '' }}
           target: ${{ matrix.platform.target }}
           manylinux: auto
-      - uses: PyO3/maturin-action@v1
+      - id: extension-retry
+        name: Retry the extension build
+        uses: PyO3/maturin-action@v1
+        if: inputs.prebuilt-run-id == '' && steps.extension.outcome == 'failure'
+        continue-on-error: ${{ runner.os != 'Linux' }}
+        with:
+          command: build
+          # One platform records a cargo build timing report for build time work.
+          args: >-
+            --profile ${{ inputs.cargo-profile }} --out dist --features extension-module
+            ${{ matrix.platform.name == 'linux-x86_64' && '--timings' || '' }}
+          target: ${{ matrix.platform.target }}
+          manylinux: auto
+      - name: Build the extension with maturin from PyPI
+        if: >-
+          inputs.prebuilt-run-id == '' && runner.os != 'Linux'
+          && steps.extension.outcome == 'failure' && steps.extension-retry.outcome == 'failure'
+        shell: bash
+        env:
+          MATURIN_ARGS: >-
+            --profile ${{ inputs.cargo-profile }} --out dist --features extension-module
+          TARGET: ${{ matrix.platform.target }}
+        run: scripts/maturin_from_pypi.sh build ${MATURIN_ARGS}
+      - id: cli
+        uses: PyO3/maturin-action@v1
         if: inputs.prebuilt-run-id == ''
+        continue-on-error: true
         # On macOS maturin links the extension with these flags for every crate, which changes
         # their build hash. Passing the same flags here lets sqb reuse the crates the extension
         # build just compiled instead of compiling them again; sqb has no undefined symbols, and
@@ -169,6 +199,37 @@ jobs:
             ${{ matrix.platform.name == 'linux-x86_64' && '--timings' || '' }}
           target: ${{ matrix.platform.target }}
           manylinux: auto
+      - id: cli-retry
+        name: Retry the sqb build
+        uses: PyO3/maturin-action@v1
+        if: inputs.prebuilt-run-id == '' && steps.cli.outcome == 'failure'
+        continue-on-error: ${{ runner.os != 'Linux' }}
+        env:
+          RUSTFLAGS: >-
+            ${{ runner.os == 'macOS' && '-C link-arg=-undefined -C link-arg=dynamic_lookup' || '' }}
+          # A wheel must never ship a sqb server without its UI.
+          SQLBUILD_UI_REQUIRED: "1"
+        with:
+          command: build
+          args: >-
+            --profile ${{ inputs.cargo-profile }} --out dist --manifest-path crates/sqlbuild-cli/Cargo.toml --features ui
+            ${{ matrix.platform.name == 'linux-x86_64' && '--timings' || '' }}
+          target: ${{ matrix.platform.target }}
+          manylinux: auto
+      - name: Build sqb with maturin from PyPI
+        if: >-
+          inputs.prebuilt-run-id == '' && runner.os != 'Linux'
+          && steps.cli.outcome == 'failure' && steps.cli-retry.outcome == 'failure'
+        shell: bash
+        env:
+          RUSTFLAGS: >-
+            ${{ runner.os == 'macOS' && '-C link-arg=-undefined -C link-arg=dynamic_lookup' || '' }}
+          # A wheel must never ship a sqb server without its UI.
+          SQLBUILD_UI_REQUIRED: "1"
+          MATURIN_ARGS: >-
+            --profile ${{ inputs.cargo-profile }} --out dist --manifest-path crates/sqlbuild-cli/Cargo.toml --features ui
+          TARGET: ${{ matrix.platform.target }}
+        run: scripts/maturin_from_pypi.sh build ${MATURIN_ARGS}
       - name: Upload the cargo build timing reports
         if: inputs.prebuilt-run-id == '' && matrix.platform.name == 'linux-x86_64'
         uses: actions/upload-artifact@v4
@@ -286,16 +347,46 @@ jobs:
         if: inputs.prebuilt-run-id == ''
         with:
           toolchain: stable
-      - uses: PyO3/maturin-action@v1
+      - id: sdist
+        uses: PyO3/maturin-action@v1
         if: inputs.prebuilt-run-id == ''
+        continue-on-error: true
         with:
           command: sdist
           args: --out dist
-      - uses: PyO3/maturin-action@v1
+      - id: sdist-retry
+        name: Retry the source distribution
+        uses: PyO3/maturin-action@v1
+        if: inputs.prebuilt-run-id == '' && steps.sdist.outcome == 'failure'
+        continue-on-error: true
+        with:
+          command: sdist
+          args: --out dist
+      - name: Build the source distribution with maturin from PyPI
+        if: >-
+          inputs.prebuilt-run-id == '' && steps.sdist.outcome == 'failure'
+          && steps.sdist-retry.outcome == 'failure'
+        run: scripts/maturin_from_pypi.sh sdist --out dist
+      - id: sdist-cli
+        uses: PyO3/maturin-action@v1
         if: inputs.prebuilt-run-id == ''
+        continue-on-error: true
+        with:
+          command: sdist
+          args: --out dist --manifest-path crates/sqlbuild-cli/Cargo.toml
+      - id: sdist-cli-retry
+        name: Retry the sqb source distribution
+        uses: PyO3/maturin-action@v1
+        if: inputs.prebuilt-run-id == '' && steps.sdist-cli.outcome == 'failure'
+        continue-on-error: true
         with:
           command: sdist
           args: --out dist --manifest-path crates/sqlbuild-cli/Cargo.toml
+      - name: Build the sqb source distribution with maturin from PyPI
+        if: >-
+          inputs.prebuilt-run-id == '' && steps.sdist-cli.outcome == 'failure'
+          && steps.sdist-cli-retry.outcome == 'failure'
+        run: scripts/maturin_from_pypi.sh sdist --out dist --manifest-path crates/sqlbuild-cli/Cargo.toml
       - name: Download prebuilt source distributions
         if: inputs.prebuilt-run-id != ''
         uses: actions/download-artifact@v4

.github/workflows/compiler-differential.yml

@@ -23,7 +23,7 @@ jobs:
         models: [3000, 10000]
     steps:
       - uses: actions/checkout@v4
-      - uses: astral-sh/setup-uv@v5
+      - uses: ./.github/actions/setup-uv
         with:
           version: "0.12.3"
           enable-cache: true

.github/workflows/release-performance.yml

@@ -52,7 +52,7 @@ jobs:
         with:
           # Release tags identify the previous release before its wheels reach PyPI.
           fetch-depth: 0
-      - uses: astral-sh/setup-uv@v5
+      - uses: ./.github/actions/setup-uv
         with:
           version: "0.12.3"
           enable-cache: true

.github/workflows/release-please.yml

@@ -74,7 +74,7 @@ jobs:
           ref: ${{ steps.release_branch.outputs.name }}
           token: ${{ steps.delivery-token.outputs.token }}
 
-      - uses: astral-sh/setup-uv@v5
+      - uses: ./.github/actions/setup-uv
         if: steps.release.outputs.prs_created == 'true'
         with:
           version: "0.12.3"

.github/workflows/rust-cache.yml

@@ -27,7 +27,7 @@ jobs:
     timeout-minutes: 60
     steps:
       - uses: actions/checkout@v4
-      - uses: astral-sh/setup-uv@v5
+      - uses: ./.github/actions/setup-uv
         with:
           version: "0.12.3"
       - uses: dtolnay/rust-toolchain@master
@@ -58,7 +58,7 @@ jobs:
     timeout-minutes: 60
     steps:
       - uses: actions/checkout@v4
-      - uses: astral-sh/setup-uv@v5
+      - uses: ./.github/actions/setup-uv
         with:
           version: "0.12.3"
       - uses: dtolnay/rust-toolchain@master
@@ -97,7 +97,7 @@ jobs:
         shell: bash
     steps:
       - uses: actions/checkout@v4
-      - uses: astral-sh/setup-uv@v5
+      - uses: ./.github/actions/setup-uv
         with:
           version: "0.12.3"
       - uses: dtolnay/rust-toolchain@master

.github/workflows/scope-performance.yml

@@ -19,7 +19,7 @@ jobs:
     timeout-minutes: 30
     steps:
       - uses: actions/checkout@v4
-      - uses: astral-sh/setup-uv@v5
+      - uses: ./.github/actions/setup-uv
         with:
           version: "0.12.3"
           enable-cache: true