rework

.github/workflows/build_wheels.yml

@@ -1,15 +1,23 @@
-name: Build
+# adapted from https://github.com/pypa/cibuildwheel/blob/main/examples/github-deploy.yml
+name: Build and upload to PyPI
 
-on: [push, pull_request]
+on:
+  workflow_dispatch:
+  pull_request:
+  push:
+  release:
+    types:
+      - published
 
 jobs:
   build_wheels:
     name: Build wheels on ${{ matrix.os }}
     runs-on: ${{ matrix.os }}
     strategy:
-      fail-fast: false  # remove eventually. This is for debugging
+      fail-fast: false # remove eventually. This is for debugging
       matrix:
-        os: [ubuntu-20.04, windows-2019, macos-11]
+        # macos-13 is an intel runner, macos-14 is apple silicon
+        os: [ubuntu-22.04, windows-2022, macos-13, macos-14]
 
     steps:
       - uses: actions/checkout@v4
@@ -21,7 +29,7 @@ jobs:
         uses: pypa/[email protected]
         env:
           CIBW_TEST_REQUIRES: pytest
-          CIBW_SKIP: musllinux_i686
+          CIBW_SKIP: "*-musllinux_i686"
           CIBW_TEST_COMMAND: "pytest {project}/tests"
           CIBW_BEFORE_BUILD_LINUX: "curl -o rustup.sh --proto '=https' --tlsv1.2 https://sh.rustup.rs && sh ./rustup.sh -y || apk add --no-cache rust cargo"
           CIBW_ENVIRONMENT: PATH=$PATH:$HOME/.cargo/bin
@@ -30,3 +38,38 @@ jobs:
         with:
           name: cibw-wheels-${{ matrix.os }}-${{ strategy.job-index }}
           path: ./wheelhouse/*.whl
+
+  build_sdist:
+    name: Build source distribution
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Build sdist
+        run: pipx run build --sdist
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: cibw-sdist
+          path: dist/*.tar.gz
+
+  upload_pypi:
+    needs: [build_wheels, build_sdist]
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      id-token: write
+    if: github.event_name == 'release' && github.event.action == 'published'
+    # or, alternatively, upload to PyPI on every tag starting with 'v' (remove on: release above to use this)
+    # if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          # unpacks all CIBW artifacts into dist/
+          pattern: cibw-*
+          path: dist
+          merge-multiple: true
+
+      - uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          # To test: repository-url: https://test.pypi.org/legacy/