build Python wheels with cibuildwheel and add to build workflow

Author: zacharyburnett

.github/workflows/build.yml

@@ -46,7 +46,7 @@ jobs:
       - run: mkdir build
       - run: >
           cmake
-          -DWITH_PYTHON=yes
+          -DWITH_PYTHON=OFF
           -DFETCH_ABSEIL=ON
           -DCMAKE_CXX_STANDARD=17
           -DCMAKE_C_COMPILER_LAUNCHER=ccache
@@ -88,3 +88,50 @@ jobs:
           --test_verbose_timeout_warnings --test_output=errors \
           //...
       working-directory: src
+  python:
+    strategy:
+      matrix:
+        target:
+          - cp3*-manylinux_x86_64
+          - cp3*-macosx_x86_64
+          - cp3*-macosx_arm64
+    runs-on: ${{ contains(matrix.target, 'macos') && 'macos-latest' || contains(matrix.target, 'win') && 'windows-latest' || 'ubuntu-latest' }}
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-tags: true
+          persist-credentials: false
+      - uses: pypa/cibuildwheel@8d2b08b68458a16aeb24b64e68a09ab1c8e82084 # v3.4.1
+        with:
+          package-dir: ./
+          output-dir: dist/
+        env:
+          CIBW_BUILD: ${{ matrix.target }}
+          CIBW_TEST_COMMAND: python -c "import s2geometry"
+      - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        with:
+          name: dist-${{ runner.os }}-${{ runner.arch }}
+          path: ./dist/
+  python-publish:
+    if: (github.event_name == 'release') && (github.event.action == 'released')
+    needs: [python]
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      attestations: write
+    # Requires environment protection rules in GitHub Settings:
+    # Settings > Environments > pypi > Add required reviewers
+    environment:
+      name: pypi
+      url: https://pypi.org/p/s2geometry
+    steps:
+      - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
+        with:
+          pattern: dist*
+          path: dist/
+          merge-multiple: true
+      - uses: actions/attest-build-provenance@96278af6caaf10aea03fd8d33a09a777ca52d62f # v3.2.0
+        with:
+          subject-path: "dist/*"
+      # To upload to PyPI without a token, add this workflow file as a Trusted Publisher in the project settings on the PyPI website
+      - uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0

setup.py

@@ -22,7 +22,9 @@
                                         '-DCALL_FROM_SETUP_PY:BOOL=ON',
                                         '-DBUILD_SHARED_LIBS:BOOL=OFF',
                                         '-DCMAKE_POSITION_INDEPENDENT_CODE=ON',
-                                        '-DWITH_PYTHON=ON'
+                                        '-DWITH_PYTHON=ON',
+                                        '-DBUILD_TESTS=OFF',
+                                        '-DFETCH_ABSEIL=ON',
                                     ]
         )
     ],