modernize the wheel builderwheels

1 files changed, 53 insertions, 20 deletions

diff --git a/.github/workflows/wheel-builder.yml b/.github/workflows/wheel-builder.yml
index 33810b4..c5007a0 100644
--- a/.github/workflows/wheel-builder.yml
+++ b/.github/workflows/wheel-builder.yml
@@ -1,8 +1,11 @@
 name: Wheel Builder
+permissions:
+  contents: read
 on:
   workflow_dispatch:
     inputs:
       version:
+        description: The version to build
         required: true
 
 
@@ -14,16 +17,22 @@ jobs:
         PYTHON:
           - {VERSION: "cp36-cp36m", ABI_VERSION: 'cp36'}
         CONTAINER:
-          - {IMAGE: "pyca/cryptography-manylinux1:x86_64", NAME: "manylinux1"}
-          - {IMAGE: "pyca/cryptography-manylinux2010:x86_64", NAME: "manylinux2010"}
-          - {IMAGE: "pyca/cryptography-musllinux_1_1:x86_64", NAME: "cryptography-musllinux_1_1"}
+          - {IMAGE: "cryptography-manylinux2010:x86_64", NAME: "manylinux2010"}
+          - {IMAGE: "cryptography-manylinux_2_24:x86_64", NAME: "manylinux_2_24"}
+          - {IMAGE: "cryptography-musllinux_1_1:x86_64", NAME: "musllinux_1_1"}
     name: "${{ matrix.PYTHON.ABI_VERSION }} ${{ matrix.CONTAINER.NAME }}"
-    container: ${{ matrix.CONTAINER.IMAGE }}
+    container: ghcr.io/pyca/${{ matrix.CONTAINER.IMAGE }}
     steps:
+      - uses: actions/checkout@v1 # Need v1 because manylinux2010 can't run node from v2
+        with:
+          # The tag to build or the tag received by the tag event
+          ref: ${{ github.event.inputs.version || github.ref }}
       - run: /opt/python/${{ matrix.PYTHON.VERSION }}/bin/python -m venv .venv
       - name: Install python dependencies
-        run: .venv/bin/pip install -U pip wheel cffi
-      - run: .venv/bin/pip download bcrypt==${{ github.event.inputs.version }} --no-deps --no-binary bcrypt && tar zxvf bcrypt*.tar.gz && mkdir tmpwheelhouse
+        run: .venv/bin/pip install -U pip wheel cffi six
+      - name: Make sdist
+        run: .venv/bin/python setup.py sdist
+      - run: tar zxvf dist/bcrypt*.tar.gz && mkdir tmpwheelhouse
       - run: cd bcrypt* && ../.venv/bin/python setup.py bdist_wheel --py-limited-api=${{ matrix.PYTHON.ABI_VERSION }} && mv dist/bcrypt*.whl ../tmpwheelhouse
       - run: auditwheel repair tmpwheelhouse/bcrypt*.whl -w wheelhouse/
       - run: .venv/bin/pip install bcrypt --no-index -f wheelhouse/
@@ -38,23 +47,37 @@ jobs:
           path: bcrypt-wheelhouse/
 
   macos:
-    runs-on: macos-latest
+    runs-on: macos-11
     strategy:
       matrix:
         PYTHON:
-          - ABI_VERSION: 'cp36'
-            DOWNLOAD_URL: 'https://www.python.org/ftp/python/3.8.5/python-3.8.5-macosx10.9.pkg'
-            BIN_PATH: '/Library/Frameworks/Python.framework/Versions/3.8/bin/python3'
-    name: "${{ matrix.PYTHON.ABI_VERSION }} macOS"
+          - VERSION: '3.10'
+            ABI_VERSION: 'cp36'
+            DOWNLOAD_URL: 'https://www.python.org/ftp/python/3.10.1/python-3.10.1-macos11.pkg'
+            BIN_PATH: '/Library/Frameworks/Python.framework/Versions/3.10/bin/python3'
+    name: "Python ${{ matrix.PYTHON.VERSION }} for ABI ${{ matrix.PYTHON.ABI_VERSION }} on macOS"
     steps:
       - uses: actions/checkout@v2.4.0
+        with:
+          # The tag to build or the tag received by the tag event
+          ref: ${{ github.event.inputs.version || github.ref }}
+          persist-credentials: false
       - run: |
           curl "${{ matrix.PYTHON.DOWNLOAD_URL }}" -o python.pkg
           sudo installer -pkg python.pkg -target /
       - run: ${{ matrix.PYTHON.BIN_PATH }} -m venv venv
-      - run: venv/bin/pip install -U pip wheel cffi
-      - run: venv/bin/pip download bcrypt==${{ github.event.inputs.version }} --no-deps --no-binary bcrypt && tar zxvf bcrypt*.tar.gz && mkdir wheelhouse
-      - run: cd bcrypt* && ../venv/bin/python setup.py bdist_wheel --py-limited-api=${{ matrix.PYTHON.ABI_VERSION }} && mv dist/bcrypt*.whl ../wheelhouse
+      - run: venv/bin/pip install -U pip wheel cffi six
+      - name: Make sdist
+        run: venv/bin/python setup.py sdist
+      - run: tar zxvf dist/bcrypt*.tar.gz && mkdir wheelhouse
+      - name: Build the wheel
+        run: cd bcrypt* && ../venv/bin/python setup.py bdist_wheel --py-limited-api=${{ matrix.PYTHON.ABI_VERSION }} && mv dist/bcrypt*.whl ../wheelhouse
+        env:
+          PYTHON_VERSION: ${{ matrix.PYTHON.ABI_VERSION }}
+          MACOSX_DEPLOYMENT_TARGET: '10.10'
+          CFLAGS: '-arch arm64 -arch x86_64'
+          ARCHFLAGS: '-arch arm64 -arch x86_64'
+          _PYTHON_HOST_PLATFORM: 'macosx-10.9-universal2'
       - run: venv/bin/pip install -f wheelhouse --no-index bcrypt
       - run: |
           venv/bin/python -c "import bcrypt;password = b'super secret password';hashed = bcrypt.hashpw(password, bcrypt.gensalt());bcrypt.checkpw(password, hashed)"
@@ -78,13 +101,19 @@ jobs:
     name: "${{ matrix.PYTHON.VERSION }} ${{ matrix.PYTHON.ABI_VERSION }} ${{ matrix.WINDOWS}}"
     steps:
       - uses: actions/checkout@v2.4.0
+        with:
+          # The tag to build or the tag received by the tag event
+          ref: ${{ github.event.inputs.version || github.ref }}
+          persist-credentials: false
       - name: Setup python
         uses: actions/setup-python@v2.3.1
         with:
           python-version: ${{ matrix.PYTHON.VERSION }}
           architecture: ${{ matrix.WINDOWS }}
-      - run: python -m pip install -U pip wheel cffi
-      - run: pip download bcrypt==${{ github.event.inputs.version }} --no-deps --no-binary bcrypt && tar zxvf bcrypt*.tar.gz && mkdir wheelhouse
+      - run: python -m pip install -U pip wheel cffi six
+      - name: Make sdist
+        run: python setup.py sdist
+      - run: tar zxvf dist/bcrypt*.tar.gz && mkdir wheelhouse
         shell: bash
       - run: cd bcrypt* && python setup.py bdist_wheel --py-limited-api=${{ matrix.PYTHON.ABI_VERSION }} && mv dist/bcrypt*.whl ../wheelhouse
       - run: pip install -f wheelhouse --no-index bcrypt
@@ -108,9 +137,13 @@ jobs:
           - {VERSION: "cp36-cp36m", ABI_VERSION: 'cp36'}
     steps:
       - uses: actions/checkout@v2.4.0
+        with:
+          # The tag to build or the tag received by the tag event
+          ref: ${{ github.event.inputs.version || github.ref }}
+          persist-credentials: false
       - run: |
           docker run --rm --privileged hypriot/qemu-register
-      - uses: docker://quay.io/pypa/manylinux2014_aarch64
+      - uses: docker://ghcr.io/pyca/cryptography-manylinux2014_aarch64:latest
         # The weird pip cache nonsense below is due to docker ownership issues. We want
         # a cache because otherwise we end up building cffi twice.
         with:
@@ -119,9 +152,9 @@ jobs:
               mkdir -p /github/home/.cache/pip;
               chown -R $(whoami) /github/home/.cache;
               /opt/python/${{ matrix.PYTHON.VERSION }}/bin/python -m venv .venv;
-              .venv/bin/pip install -U pip wheel cffi;
-              .venv/bin/pip download bcrypt==${{ github.event.inputs.version }} --no-deps --no-binary bcrypt;
-              tar zxvf bcrypt*.tar.gz;
+              .venv/bin/pip install -U pip wheel cffi six;
+              .venv/bin/python setup.py sdist;
+              tar zxvf dist/bcrypt*.tar.gz;
               mkdir tmpwheelhouse;
               pushd bcrypt*;
               ../.venv/bin/python setup.py bdist_wheel --py-limited-api=${{ matrix.PYTHON.ABI_VERSION }};