Add optional pip testing to wheel smoketest

Adds test-pip input to wheel smoketest action and enables it for
CPython linux builders. The pip testing is split into three steps
(venv creation, installation, verification) to match the uv approach.

Resolves #13456

Author: claude

.github/actions/wheel-smoketest/action.yml

@@ -9,6 +9,10 @@ inputs:
   build-requirements-path:
     description: 'Path to the build requirements file'
     required: true
+  test-pip:
+    description: 'Optional flag to also test installation with pip'
+    required: false
+    default: 'false'
 
 runs:
   using: "composite"
@@ -45,3 +49,28 @@ runs:
         print(f"Linked Against: {backend._ffi.string(backend._lib.OPENSSL_VERSION_TEXT).decode('ascii')}")
         EOF
       shell: bash
+
+    - name: Create virtual environment for pip testing
+      if: inputs.test-pip == 'true'
+      run: |
+        if [ -n "${{ inputs.python-path }}" ]; then
+          "${{ inputs.python-path }}" -m venv .venv-pip-test
+        else
+          python3 -m venv .venv-pip-test
+        fi
+      shell: bash
+
+    - name: Install cryptography wheel with pip
+      if: inputs.test-pip == 'true'
+      run: .venv-pip-test/bin/pip install cryptography --no-index -f wheelhouse/
+      shell: bash
+
+    - name: Verify pip installation and OpenSSL version
+      if: inputs.test-pip == 'true'
+      run: |
+        .venv-pip-test/bin/python - <<'EOF'
+        from cryptography.hazmat.backends.openssl.backend import backend
+        print(f"pip install - Loaded: {backend.openssl_version_text()}")
+        print(f"pip install - Linked Against: {backend._ffi.string(backend._lib.OPENSSL_VERSION_TEXT).decode('ascii')}")
+        EOF
+      shell: bash

.github/workflows/wheel-builder.yml

@@ -168,6 +168,7 @@ jobs:
         with:
           python-path: /opt/python/${{ matrix.PYTHON.VERSION }}/bin/python
           build-requirements-path: ${{ env.BUILD_REQUIREMENTS_PATH }}
+          test-pip: ${{ startsWith(matrix.PYTHON.VERSION, 'cp') }}
 
       - uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with: