Get rid of ziggy-pydust dependency

.github/workflows/ci.yml

@@ -20,22 +20,30 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           fetch-depth: 0
 
       - name: Ruff format
-        uses: astral-sh/ruff-action@v3
+        uses: astral-sh/ruff-action@146cd51f235777a9bc491eead18e0d5a4b05406a # v3
         with:
           version: "0.13.3"
           args: "format --check ."
 
       - name: Ruff check
-        uses: astral-sh/ruff-action@v3
+        uses: astral-sh/ruff-action@146cd51f235777a9bc491eead18e0d5a4b05406a # v3
         with:
           version: "0.13.3"
           args: "check ."
 
+      - name: Install uv
+        uses: astral-sh/setup-uv@94527f2e458b27549849d47d273a16bec83a01e9 # v7
+        with:
+          version: "0.8.22"
+
+      - name: Type check
+        run: uv sync --no-install-project && uv run --no-sync ty check
+
   build:
     name: Build wheels on ${{ matrix.os }}
     needs: [lint]
@@ -48,25 +56,39 @@ jobs:
           - ubuntu-24.04-arm
           - macos-15-intel
           - macos-14
-#           - windows-latest
-#           - windows-11-arm
+          - windows-latest
+          - windows-11-arm
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           fetch-depth: 0
 
+      # The native aarch64-windows zig crashes on any compilation (ziglang/zig#16665),
+      # so run the x86_64 zig under Windows x64 emulation; the wheel's DLL is still
+      # cross-compiled for aarch64.
+      - name: Install x86_64 Zig for Windows ARM64
+        if: matrix.os == 'windows-11-arm'
+        shell: pwsh
+        run: |
+          $expected = "68659eb5f1e4eb1437a722f1dd889c5a322c9954607f5edcf337bc3684a75a7e"
+          Invoke-WebRequest -Uri https://ziglang.org/download/0.16.0/zig-x86_64-windows-0.16.0.zip -OutFile $env:RUNNER_TEMP\zig.zip
+          $actual = (Get-FileHash "$env:RUNNER_TEMP\zig.zip" -Algorithm SHA256).Hash.ToLower()
+          if ($actual -ne $expected) { throw "zig.zip SHA-256 mismatch: expected $expected, got $actual" }
+          Expand-Archive $env:RUNNER_TEMP\zig.zip -DestinationPath $env:RUNNER_TEMP\zig
+          "SECRETSWEEPER_ZIG=$env:RUNNER_TEMP\zig\zig-x86_64-windows-0.16.0\zig.exe" | Out-File -FilePath $env:GITHUB_ENV -Append
+
       - name: Build wheels
-        uses: pypa/cibuildwheel@v3.3.1
+        uses: pypa/cibuildwheel@c6c39891d69e0d1e7448c727f68b7b4d5e660e7f # v3.3.1
         env:
           CIBW_ENVIRONMENT_MACOS: MACOSX_DEPLOYMENT_TARGET=${{ runner.arch == 'X64' && '15.7' || '14.8' }}
           CIBW_BUILD_FRONTEND: pip
           CIBW_BUILD_VERBOSITY: 0
           CIBW_TEST_COMMAND: "pip install pytest && pytest {project}/tests"
-          CIBW_SKIP: "cp3??t-*"
+          CIBW_SKIP: "*-win32"
 
       - name: Upload artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: wheels-${{ matrix.os }}-${{ strategy.job-index }}
           path: ./wheelhouse/*.whl
@@ -78,28 +100,25 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           fetch-depth: 0
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
         with:
           python-version: "3.13"
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@94527f2e458b27549849d47d273a16bec83a01e9 # v7
         with:
           version: "0.8.22"
 
-      - name: Install dependencies
-        run: uv sync --no-install-project
-
       - name: Build sdist package
-        run: uv run poetry build -f sdist && ls -al dist
+        run: uv build --sdist && ls -al dist
 
       - name: Upload sdist package
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: wheels-sdist
           path: ./dist/*.tar.gz
@@ -110,9 +129,12 @@ jobs:
     if: startsWith(github.ref, 'refs/tags/')
     needs: [build, build-sdist]
     runs-on: ubuntu-latest
+    permissions:
+      # Required for PyPI Trusted Publishing (OIDC).
+      id-token: write
 
     steps:
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
         with:
           pattern: wheels-*
           merge-multiple: true
@@ -121,9 +143,6 @@ jobs:
       - name: Display structure of downloaded files
         run: ls -lh dist
 
-      - uses: pypa/gh-action-pypi-publish@release/v1
-        if: startsWith(github.ref, 'refs/tags/')
+      - uses: pypa/gh-action-pypi-publish@6733eb7d741f0b11ec6a39b58540dab7590f9b7d # v1.14.0
         with:
           skip-existing: true
-          user: ${{ secrets.PYPI_USERNAME }}
-          password: ${{ secrets.PYPI_PASSWORD }}

.gitignore

@@ -13,10 +13,11 @@ wheels/
 .*
 !.gitignore
 !.github
+!.pre-commit-config.yaml
 
 # Build files
 /zig-out
 /.zig-cache
 *.so
-/build.zig
-/pydust.build.zig
+*.dylib
+*.dll

.pre-commit-config.yaml

@@ -0,0 +1,13 @@
+repos:
+  - repo: https://github.com/astral-sh/ruff-pre-commit
+    # Keep in sync with the ruff version in pyproject.toml and ci.yml.
+    rev: v0.13.3
+    hooks:
+      - id: ruff-check
+      - id: ruff-format
+
+  - repo: https://github.com/astral-sh/ty-pre-commit
+    # Keep in sync with the ty version in pyproject.toml.
+    rev: v0.0.56
+    hooks:
+      - id: ty

README.md

@@ -18,7 +18,7 @@ SecretSweeper is a ⚡ fast, in-memory secret-sanitizing Python module written i
 
 SecretSweeper is a Python library that can mask or remove known secrets from byte literals, files, or any file-like objects (`io.BinaryIO`). 
 
-- Written in Zig with no third-party dependencies. Leverages the stability of the Python Limited C API to create a single binary extension.
+- Written in Zig with no third-party dependencies. The core is a plain C-ABI shared library driven through the standard library `ctypes` module, so a single binary works across Python versions.
 - Can wrap a file descriptor to read and sanitize data directly from the stream.
 - Works well with multi-line secrets.
 

build.zig

@@ -0,0 +1,30 @@
+const std = @import("std");
+
+pub fn build(b: *std.Build) void {
+    const target = b.standardTargetOptions(.{});
+    const optimize = b.standardOptimizeOption(.{});
+
+    const lib = b.addLibrary(.{
+        .name = "secretsweeper",
+        .linkage = .dynamic,
+        .root_module = b.createModule(.{
+            .root_source_file = b.path("src/export.zig"),
+            .target = target,
+            .optimize = optimize,
+            .link_libc = true,
+        }),
+    });
+    b.installArtifact(lib);
+
+    const tests = b.addTest(.{
+        .root_module = b.createModule(.{
+            .root_source_file = b.path("src/export.zig"),
+            .target = target,
+            .optimize = optimize,
+            .link_libc = true,
+        }),
+    });
+    const run_tests = b.addRunArtifact(tests);
+    const test_step = b.step("test", "Run library tests");
+    test_step.dependOn(&run_tests.step);
+}

hatch_build.py

@@ -0,0 +1,86 @@
+"""Hatchling build hook: compiles the Zig shared library and bundles it into the wheel."""
+
+import os
+import platform
+import shutil
+import subprocess
+import sys
+from pathlib import Path
+
+from hatchling.builders.hooks.plugin.interface import BuildHookInterface
+
+LIBRARY_NAMES = ("libsecretsweeper.so", "libsecretsweeper.dylib", "secretsweeper.dll")
+
+
+def zig_command() -> list[str]:
+    """Use the zig binary from SECRETSWEEPER_ZIG if set, otherwise prefer the `ziglang`
+    wheel from build requirements, and fall back to a system zig."""
+    if zig := os.environ.get("SECRETSWEEPER_ZIG"):
+        return [zig]
+    try:
+        import ziglang  # noqa: F401
+    except ImportError:
+        if shutil.which("zig") is None:
+            raise RuntimeError("zig is required to build secretsweeper: pip install ziglang")
+        return ["zig"]
+    return [sys.executable, "-m", "ziglang"]
+
+
+def windows_target() -> str | None:
+    """On Windows, target the GNU ABI explicitly: it uses Zig's bundled mingw instead of
+    relying on MSVC and Windows SDK detection, which the native default ABI requires."""
+    if sys.platform != "win32":
+        return None
+    arch = {"AMD64": "x86_64", "ARM64": "aarch64"}.get(platform.machine().upper())
+    if arch is None:
+        raise RuntimeError(f"unsupported Windows architecture: {platform.machine()}")
+    return f"{arch}-windows-gnu"
+
+
+def run_zig(args: list[str], cwd: str) -> None:
+    command = [*zig_command(), *args]
+    result = subprocess.run(command, capture_output=True, text=True, cwd=cwd)
+    if result.returncode != 0:
+        raise RuntimeError(
+            f"{' '.join(command)} failed with exit code {result.returncode}\n"
+            f"--- stdout ---\n{result.stdout}\n--- stderr ---\n{result.stderr}"
+        )
+
+
+class ZigBuildHook(BuildHookInterface):
+    def initialize(self, version: str, build_data: dict) -> None:
+        target = windows_target()
+        try:
+            target_options = [f"-Dtarget={target}"] if target else []
+            run_zig(["build", "-Doptimize=ReleaseFast", *target_options], cwd=self.root)
+        except RuntimeError:
+            if target is None:
+                raise
+            # `zig build` crashes silently on Windows ARM64 (zig support for aarch64-windows
+            # is partial: ziglang/zig#16665). Unlike `zig build`, compiling the library
+            # directly involves neither building nor running a build-runner executable.
+            Path(self.root, "zig-out", "bin").mkdir(parents=True, exist_ok=True)
+            run_zig(
+                [
+                    "build-lib",
+                    "src/export.zig",
+                    "--name",
+                    "secretsweeper",
+                    "-dynamic",
+                    "-OReleaseFast",
+                    "-lc",
+                    "-target",
+                    target,
+                    "-femit-bin=zig-out/bin/secretsweeper.dll",
+                ],
+                cwd=self.root,
+            )
+        for out_dir in ("lib", "bin"):
+            for name in LIBRARY_NAMES:
+                artifact = Path(self.root) / "zig-out" / out_dir / name
+                if artifact.exists():
+                    build_data["force_include"][str(artifact)] = f"secretsweeper/{name}"
+                    build_data["pure_python"] = False
+                    build_data["infer_tag"] = True
+                    return
+        raise RuntimeError("zig build did not produce a shared library in zig-out")

pyproject.toml

@@ -1,46 +1,50 @@
 [project]
 name = "secretsweeper"
-version = "0.0.1a3"
+version = "0.0.1a4"
+description = "Fast, in-memory secret-sanitizing CPython module written in Zig, designed for speed."
+authors = [{ name = "Vitaliy Demidov", email = "notifications.recipient@gmail.com" }]
+readme = "README.md"
 requires-python = ">=3.11"
 license = "MIT"
 license-files = ["LICENSE"]
 
 [build-system]
-requires = ["poetry-core==2.2.1", "ziggy-pydust==0.26.0"]
-build-backend = "poetry.core.masonry.api"
+requires = ["hatchling==1.28.0", "ziglang==0.16.0"]
+build-backend = "hatchling.build"
 
-[tool.poetry]
-name = "secretsweeper"
-description = "Fast, in-memory secret-sanitizing CPython module written in Zig, designed for speed."
-authors = ["Vitaliy Demidov <notifications.recipient@gmail.com>"]
-readme = "README.md"
-packages = [{ include = "secretsweeper" }]
-include = [
-    { path = "src/", format = "sdist" },
-    { path = "secretsweeper/*.so", format = "wheel" },
-    "secretsweeper/*.pyi",
-]
+[tool.hatch.build.targets.wheel]
+packages = ["secretsweeper"]
 
-[tool.poetry.build]
-script = "build.py"
+[tool.hatch.build.targets.wheel.hooks.custom]
+path = "hatch_build.py"
 
-[tool.poetry.dependencies]
-python = "^3.11"
+[tool.hatch.build.targets.sdist]
+include = [
+    "secretsweeper",
+    "src",
+    "build.zig",
+    "hatch_build.py",
+    "tests",
+]
+exclude = [
+    "secretsweeper/*.so",
+    "secretsweeper/*.dylib",
+    "secretsweeper/*.dll",
+]
 
 [tool.ruff]
 line-length = 120
 
 [tool.ruff.lint]
 select = ["F", "E", "W", "UP", "I001", "I002"]
 
-[[tool.pydust.ext_module]]
-name = "secretsweeper._core"
-root = "src/core.zig"
-
 [dependency-groups]
 dev = [
-    "poetry>=2.2.1",
-    "ziggy-pydust==0.26.0",
+    "gevent (>=25.4.1,<26.0.0)",
+    "hatchling==1.28.0",
+    "ziglang==0.16.0",
+    "pre-commit (>=4.6.0,<5.0.0)",
     "pytest (>=8.4.2,<9.0.0)",
-    "ruff (>=0.13.3,<0.14.0)"
+    "ruff (>=0.13.3,<0.14.0)",
+    "ty (==0.0.56)"
 ]