From 90923fa2f5413ca5c089b9608931b293a9426778 Mon Sep 17 00:00:00 2001
From: ammar siddiqui <ammar.siddiqui847@gmail.com>
Date: Tue, 26 May 2026 15:10:23 -0400
Subject: [PATCH] ci: add release workflow for multi-platform PyPI wheels
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Triggers on `v*` tag push (or manual workflow_dispatch). Builds
wheels for:
- Linux x86_64 + aarch64 (manylinux via PyO3/maturin-action)
- macOS x86_64 + aarch64
- Windows x86_64
× Python 3.10 / 3.11 / 3.12 / 3.13

Plus a sdist job so platforms without a prebuilt wheel can fall back
to a source build. A final `publish` job downloads every artifact and
uploads them to PyPI via Trusted Publishing (OIDC) — no long-lived
token in repo secrets. The publish step gates on tag push, so manual
runs are build-only dry runs.

To use:
1. On PyPI, configure a Trusted Publisher for `hebb-py`
   (owner: hebb-project, repo: hebb, workflow: release.yml,
   environment: pypi). See the URL in the workflow comment.
2. `git tag v0.1.1 && git push --tags` — workflow runs.

For pre-Trusted-Publishing setup, swap the OIDC `permissions:
id-token: write` block for a `MATURIN_PYPI_TOKEN` env var sourced
from a repo secret.
---
 .github/workflows/release.yml | 139 ++++++++++++++++++++++++++++++++++
 1 file changed, 139 insertions(+)
 create mode 100644 .github/workflows/release.yml

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..d1fedc6
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,139 @@
+name: Release wheels
+
+# Builds wheels for Linux / macOS / Windows × Python 3.10–3.13 and
+# publishes them to PyPI on a tag push. Trigger:
+#   git tag v0.1.1 && git push --tags
+# Or manually via the Actions tab → "Run workflow".
+
+on:
+  push:
+    tags:
+      - "v*"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  linux:
+    name: build linux ${{ matrix.target }} py${{ matrix.python-version }}
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        target: [x86_64, aarch64]
+        python-version: ["3.10", "3.11", "3.12", "3.13"]
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: build wheel
+        uses: PyO3/maturin-action@v1
+        with:
+          target: ${{ matrix.target }}
+          args: --release --out dist -i python${{ matrix.python-version }}
+          manylinux: auto
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: wheels-linux-${{ matrix.target }}-py${{ matrix.python-version }}
+          path: dist
+
+  macos:
+    name: build macos ${{ matrix.target }} py${{ matrix.python-version }}
+    runs-on: macos-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        target: [x86_64, aarch64]
+        python-version: ["3.10", "3.11", "3.12", "3.13"]
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: build wheel
+        uses: PyO3/maturin-action@v1
+        with:
+          target: ${{ matrix.target }}
+          args: --release --out dist -i python${{ matrix.python-version }}
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: wheels-macos-${{ matrix.target }}-py${{ matrix.python-version }}
+          path: dist
+
+  windows:
+    name: build windows x86_64 py${{ matrix.python-version }}
+    runs-on: windows-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.10", "3.11", "3.12", "3.13"]
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: build wheel
+        uses: PyO3/maturin-action@v1
+        with:
+          target: x86_64
+          args: --release --out dist -i python${{ matrix.python-version }}
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: wheels-windows-x86_64-py${{ matrix.python-version }}
+          path: dist
+
+  sdist:
+    name: build sdist
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: build sdist
+        uses: PyO3/maturin-action@v1
+        with:
+          command: sdist
+          args: --out dist
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: wheels-sdist
+          path: dist
+
+  publish:
+    name: publish to PyPI
+    needs: [linux, macos, windows, sdist]
+    runs-on: ubuntu-latest
+    # Only run on tag push, not on manual dispatch (use dispatch for build-only dry runs).
+    if: startsWith(github.ref, 'refs/tags/v')
+    # Trusted Publishing (OIDC). Configure at:
+    #   https://pypi.org/manage/account/publishing/
+    # with: project=hebb-py, owner=hebb-project, repo=hebb,
+    #       workflow=release.yml, environment=pypi
+    environment:
+      name: pypi
+      url: https://pypi.org/p/hebb-py
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          pattern: wheels-*
+          merge-multiple: true
+          path: dist
+
+      - name: publish to PyPI
+        uses: PyO3/maturin-action@v1
+        with:
+          command: upload
+          args: --non-interactive --skip-existing dist/*