From 1a70a395ebe3e5d7e7f8112f29b30dea1e0ea38a Mon Sep 17 00:00:00 2001
From: aidannewsome <aidan.newsome@me.com>
Date: Tue, 6 Oct 2026 11:24:52 -0400
Subject: [PATCH 1/2] Build wheels with cibuildwheel and publish them to PyPI
 when a release is published

Wheels for every CPython cibuildwheel supports, free-threaded included, on Linux
(glibc and musl, x86-64 and ARM), Windows x86-64 and macOS on Apple silicon, each
tested with cdt_bindings_test.py, and an sdist. Publishing uses PyPI trusted
publishing, so no token is stored.

cibuildwheel's tests also need numpy, which the test extra does not install, and
the tests' input files, which they read by paths relative to the project.
---
 .github/workflows/wheels.yml | 72 ++++++++++++++++++++++++++++++++++++
 pyproject.toml               |  4 +-
 2 files changed, 75 insertions(+), 1 deletion(-)
 create mode 100644 .github/workflows/wheels.yml

diff --git a/.github/workflows/wheels.yml b/.github/workflows/wheels.yml
new file mode 100644
index 0000000..1fdfcca
--- /dev/null
+++ b/.github/workflows/wheels.yml
@@ -0,0 +1,72 @@
+name: Wheels
+
+# Wheels are checked on pull requests and published when a GitHub release is published,
+# under the release's tag, such as 2.0.0.
+on:
+  pull_request:
+  release:
+    types: [published]
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  sdist:
+    name: Source distribution
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          submodules: recursive
+      - run: pipx run build --sdist
+      - uses: actions/upload-artifact@v7
+        with:
+          name: dist-sdist
+          path: dist/*.tar.gz
+
+  wheels:
+    name: Wheels on ${{ matrix.os }}
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, ubuntu-24.04-arm, windows-latest, macos-latest]
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          submodules: recursive
+      # Builds every CPython cibuildwheel supports, free-threaded included, and runs
+      # the tests in pyproject.toml's [tool.cibuildwheel] against each wheel.
+      - uses: pypa/cibuildwheel@v4.3.0
+        env:
+          CIBW_ARCHS_WINDOWS: AMD64  # 64-bit only, as CI covers
+      - uses: actions/upload-artifact@v7
+        with:
+          name: dist-wheels-${{ matrix.os }}
+          path: wheelhouse/*.whl
+
+  publish:
+    name: Publish to PyPI
+    if: github.event_name == 'release'
+    needs: [sdist, wheels]
+    runs-on: ubuntu-latest
+    # PyPI trusted publishing: no token is stored, PyPI trusts this workflow in this repository.
+    environment:
+      name: pypi
+      url: https://pypi.org/p/PythonCDT
+    permissions:
+      id-token: write
+      attestations: write
+      contents: read
+    steps:
+      - uses: actions/download-artifact@v8
+        with:
+          pattern: dist-*
+          path: dist
+          merge-multiple: true
+      - uses: actions/attest-build-provenance@v4
+        with:
+          subject-path: dist/*
+      - uses: pypa/gh-action-pypi-publish@release/v1
diff --git a/pyproject.toml b/pyproject.toml
index 135e709..4732ba5 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -18,8 +18,10 @@ filterwarnings = ["error"]
 testpaths = ["cdt_bindings_test.py"]
 
 [tool.cibuildwheel]
-test-command = "pytest {project}/cdt_bindings_test.py"
+test-command = "pytest cdt_bindings_test.py"
+test-sources = ["cdt_bindings_test.py", "CDT/visualizer/data"]  # the tests read input files by paths relative to the project
 test-extras = ["test"]
+test-requires = ["numpy"]  # the tests import numpy; the test extra holds only pytest
 test-skip = ["*universal2:arm64"]
 # Setuptools bug causes collision between pypy and cpython artifacts
 before-build = "rm -rf {project}/build"

From f19d5fe7de42f708a5e7be91e65fd18bfa3b2175 Mon Sep 17 00:00:00 2001
From: aidannewsome <aidan.newsome@me.com>
Date: Tue, 6 Oct 2026 16:47:51 -0400
Subject: [PATCH 2/2] Publish to PyPI only from artem-ogre/PythonCDT, so a
 fork's release builds the wheels without a failed publish

---
 .github/workflows/wheels.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/wheels.yml b/.github/workflows/wheels.yml
index 1fdfcca..15f1b4e 100644
--- a/.github/workflows/wheels.yml
+++ b/.github/workflows/wheels.yml
@@ -49,7 +49,7 @@ jobs:
 
   publish:
     name: Publish to PyPI
-    if: github.event_name == 'release'
+    if: github.event_name == 'release' && github.repository == 'artem-ogre/PythonCDT'  # a fork's release builds the wheels but never publishes
     needs: [sdist, wheels]
     runs-on: ubuntu-latest
     # PyPI trusted publishing: no token is stored, PyPI trusts this workflow in this repository.