updated python-publish workflow for multi envs

Author: nick

.github/workflows/python-publish.yml

@@ -1,10 +1,6 @@
-# This workflow will upload a Python Package to PyPI when a release is created
-# For more information see: https://docs.github.com/en/actions/automating-builds-and-tests/building-and-testing-python#publishing-to-package-registries
-
-# This workflow uses actions that are not certified by GitHub.
-# They are provided by a third-party and are governed by
-# separate terms of service, privacy policy, and support
-# documentation.
+# Builds platform wheels for Linux (manylinux), Windows, and macOS, then
+# publishes everything to PyPI via OIDC Trusted Publishing (no API token).
+# Triggered when a GitHub Release is published.
 
 name: Upload Python Package
 
@@ -16,7 +12,39 @@ permissions:
   contents: read
 
 jobs:
-  release-build:
+  # ── Build binary wheels (one runner per platform) ───────────────────────────
+  build-wheels:
+    name: Build wheels on ${{ matrix.os }}
+    runs-on: ${{ matrix.os }}
+    strategy:
+      matrix:
+        os: [ubuntu-latest, windows-latest, macos-latest]
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Build wheels
+        uses: pypa/cibuildwheel@v2.22.0
+        env:
+          # CPython 3.8 – 3.14 only; skip PyPy (not tested with this extension)
+          CIBW_BUILD: cp38-* cp39-* cp310-* cp311-* cp312-* cp313-* cp314-*
+          # Skip musl/Alpine — system zlib may not be present in all musl images
+          CIBW_SKIP: "*-musllinux_*"
+          # macOS: build both Intel and Apple-Silicon wheels
+          CIBW_ARCHS_MACOS: x86_64 arm64
+          # Linux: x86_64 only (add aarch64 later via QEMU if needed)
+          CIBW_ARCHS_LINUX: x86_64
+          # Windows: 64-bit only
+          CIBW_ARCHS_WINDOWS: AMD64
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: cibw-wheels-${{ matrix.os }}
+          path: ./wheelhouse/*.whl
+
+  # ── Build source distribution ────────────────────────────────────────────────
+  build-sdist:
+    name: Build source distribution
     runs-on: ubuntu-latest
 
     steps:
@@ -25,50 +53,38 @@ jobs:
       - uses: actions/setup-python@v5
         with:
           python-version: "3.x"
-      
-      - name: Install Dependencies
-        run: |
-          python -m pip install pybind11
 
-      - name: Build release distributions
+      - name: Build sdist
         run: |
-          # NOTE: put your own distribution build steps here.
           python -m pip install build
-          python -m build
+          python -m build --sdist
 
-      - name: Upload distributions
-        uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v4
         with:
-          name: release-dists
-          path: dist/
+          name: cibw-sdist
+          path: dist/*.tar.gz
 
+  # ── Publish to PyPI via OIDC Trusted Publishing ──────────────────────────────
   pypi-publish:
+    name: Publish to PyPI
     runs-on: ubuntu-latest
-    needs:
-      - release-build
+    needs: [build-wheels, build-sdist]
+
     permissions:
-      # IMPORTANT: this permission is mandatory for trusted publishing
+      # Required for OIDC Trusted Publishing — no API token needed
       id-token: write
 
-    # Dedicated environments with protections for publishing are strongly recommended.
-    # For more information, see: https://docs.github.com/en/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules
     environment:
       name: pypi
-      # OPTIONAL: uncomment and update to include your PyPI project URL in the deployment status:
       url: https://pypi.org/p/docx-comment-parser
-      #
-      # ALTERNATIVE: if your GitHub Release name is the PyPI project version string
-      # ALTERNATIVE: exactly, uncomment the following line instead:
-      # url: https://pypi.org/project/YOURPROJECT/${{ github.event.release.name }}
 
     steps:
-      - name: Retrieve release distributions
+      - name: Download all artifacts
         uses: actions/download-artifact@v4
         with:
-          name: release-dists
-          path: dist/
+          pattern: cibw-*
+          path: dist
+          merge-multiple: true
 
-      - name: Publish release distributions to PyPI
+      - name: Publish to PyPI
         uses: pypa/gh-action-pypi-publish@release/v1
-        with:
-          packages-dir: dist/