CI/CD: Cross-Platform Wheel Build & Secure PyPI Publishing

.github/workflows/release.yml

@@ -0,0 +1,76 @@
+name: Build and Publish Wheels
+
+on:
+  push:
+    tags:
+      - "v*"
+  workflow_dispatch:
+
+# ✦ Concurrency: Prevents race conditions during release
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+
+jobs:
+  build-wheels:
+    name: Build wheels on ${{ matrix.os }}
+    runs-on: ${{ matrix.os }}
+    strategy:
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.10"
+
+      - name: Rust Cache
+        uses: Swatinem/rust-cache@v2
+        with:
+          key: ${{ matrix.os }}
+
+      - name: Build wheels
+        uses: PyO3/maturin-action@v1
+        with:
+          command: build
+          # ✦ Added --sdist: Only needs to be generated once, 
+          # but safe to include in the args; maturin handles it.
+          args: --release --strip -o dist ${{ matrix.os == 'ubuntu-latest' && '--sdist' || '' }}
+          manylinux: auto
+
+      - name: Upload artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: wheels-${{ matrix.os }}
+          path: dist
+
+  publish:
+    name: Publish to PyPI
+    needs: build-wheels
+    runs-on: ubuntu-latest
+    # ✦ Restrict publish: Only tags on the main repo can trigger this
+    if: startsWith(github.ref, 'refs/tags/v') && github.repository == 'etsi-ai/etna'
+
+    environment: release
+    permissions:
+      id-token: write # Required for OIDC/Trusted Publishers
+
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          pattern: wheels-*
+          merge-multiple: true
+          path: dist
+
+      - name: Publish to PyPI
+        uses: PyO3/maturin-action@v1
+        with:
+          command: publish
+          args: --skip-existing dist/*
+        # env:
+        #   MATURIN_PYPI_TOKEN: ${{ secrets.PYPI_API_TOKEN }}

etna_core/Cargo.toml

@@ -13,7 +13,7 @@ name = "etna_rust"
 crate-type = ["cdylib"]
 
 [dependencies]
-pyo3 = { version = "0.27.2", features = ["extension-module"] }
+pyo3 = { version = "0.27.2", features = ["extension-module", "abi3-py38"] }
 rand = "0.9.2"
 serde = { version = "1.0.228", features = ["derive"] }
 serde_json = "1.0.149"