CI/CD: Cross-Platform Wheel Build & Secure PyPI Publishing

[akshajtiwari]

Fixes

Closes: #74

Type of Change

• Bug fix
• New feature
• Documentation / Refactor
• Math / Logic correction

Description

Polished and optimized the GitHub Actions workflow for building and publishing Python wheels via Maturin.
Key improvements include:

• Rust Caching: Integrated Swatinem/rust-cache to significantly reduce build times by caching the target/ directory and Cargo dependencies.
• Workflow Streamlining: Unified the build matrix to handle Linux (manylinux), macOS, and Windows under a single logic block using maturin-action.
• Security & OIDC: Prepared the workflow for Trusted Publishing (OIDC), removing the need for long-lived PyPI tokens and implementing a release environment.
• Robustness: Added concurrency controls to prevent race conditions and restricted publishing to the main repository to prevent unauthorized releases from forks.
• Source Distribution: Added logic to automatically generate and upload an sdist during the Linux build phase.

How Has This Been Tested?

• Unit Tests: Ran existing or new test scripts.
• Manual Testing: Verified the workflow triggers on tags and successfully bundles artifacts into a unified dist/ folder.
• Integration: Confirmed the download-artifact step correctly merges multi-platform wheels for the publish job.

Screenshots / Logs

Workflow successfully validated across Arch Linux and macOS runners.

Arch Linux

macOS

Contribution Context

• I am contributing through the SWOC program.

---

Maintainer Instructions

To finalize this setup, please complete these steps:

1. Create the Environment:

   • Go to Settings > Environments in this repo.
   • Click New environment and name it release.
   • (Recommended) Required Reviewers: Add yourself or a lead maintainer as a required reviewer.
   • Note: This ensures that even after a tag is pushed, the package will not be published to PyPI until a maintainer manually clicks "Approve" on the GitHub Actions page for that specific run.

2. Connect to PyPI (OIDC):

   • Go to your project settings on PyPI.org.
   • Navigate to Publishing and add a new GitHub Publisher.
   • Use the following exact values:
     • Owner: etsi-ai
     • Repository: etna
     • Workflow: release.yml
     • Environment: release
   • (Keep the variable names exactly as mentioned above)

3. API Token (Alternative):

   • I have included the traditional API token logic in the code as a fallback, but I have commented it out.
   • This is because OIDC (Step 2) is more secure and removes the tedious task of managing long-lived secrets.
   • Changes can be made to uncomment these lines if you specifically request to use the old token method.

4. Trigger a Release:

   • Simply push a tag starting with v (e.g., git tag v0.1.0 && git push origin v0.1.0).

[github-actions]

Thank you for opening this PR! Our automated system is currently verifying the PR requirements.
Internal Discussion: Discord

[github-actions]

Validation Successful!

This pull request has been verified and linked to issue #74. The system is now synchronizing metadata from the referenced issue. Kindly await maintainer review of your changes.

[github-actions]

Validation Successful!

This pull request has been verified and linked to issue #74. The system is now synchronizing metadata from the referenced issue. Kindly await maintainer review of your changes.

[github-actions]

Validation Successful!

This pull request has been verified and linked to issue #74. The system is now synchronizing metadata from the referenced issue. Kindly await maintainer review of your changes.

[github-actions]

Validation Successful!

This pull request has been verified and linked to issue #74. The system is now synchronizing metadata from the referenced issue. Kindly await maintainer review of your changes.

[Aamod007]

What's Good

• Multi-platform builds (Linux, macOS, Windows)
• Proper OIDC security
• ABI3 support
• All tests pass (28 Rust tests)

Great Work

[debug-soham]

Excellent work!

[github-actions]

This PR has been successfully merged. We appreciate your effort in improving the library and look forward to your future contributions to the Etsi AI ecosystem.