Fix publish workflow

.github/workflows/pr-validation.yml

@@ -81,6 +81,15 @@ jobs:
             make native
           fi
 
+      # Relays the built static libs to python-publish.yml's wheel jobs (same workflow run) so they
+      # don't need to rebuild ~15 native libs for yum/manylinux; those jobs only link, never build here.
+      - name: Upload native libraries
+        uses: actions/upload-artifact@v7
+        with:
+          name: orcsome3-built-libraries
+          path: orcsome3_built_libraries
+          retention-days: 1
+
       - name: Validate backend stub
         id: stubs
         run: make stubs-check

.github/workflows/python-publish.yml

@@ -14,6 +14,9 @@ permissions:
 env:
   CIBW_SKIP: "*-musllinux_* *t-*"
   CIBW_BEFORE_BUILD: "pip install 'Cython>=3.0'"
+  # The manylinux container has none of the X11 dev headers orcsome3_backend.pyx needs; the static
+  # libs from `validate`'s native build are relayed in separately (see wheels jobs' download step).
+  CIBW_BEFORE_ALL_LINUX: "yum install -y libX11-devel libXext-devel libXScrnSaver-devel libXtst-devel"
   CIBW_ENVIRONMENT: "ORCSOME3_BUILD_JOBS=2"
   CIBW_TEST_SKIP: "*"
 
@@ -32,14 +35,12 @@ jobs:
         with:
           persist-credentials: false
 
-      - name: Install build dependencies
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y \
-            git cmake autoconf automake libtool pkg-config meson ninja-build \
-            libx11-dev libxss-dev libxext-dev libxtst-dev curl
-          curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable
-          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
+      # Static libs already built by `validate` (native, Linux glibc) — only linking happens here,
+      # so no cmake/meson/rust toolchain is needed in this job.
+      - uses: actions/download-artifact@v8
+        with:
+          name: orcsome3-built-libraries
+          path: orcsome3_built_libraries
 
       - uses: pypa/cibuildwheel@v4.2.0
         env:
@@ -58,14 +59,31 @@ jobs:
         with:
           persist-credentials: false
 
-      - name: Install build dependencies
+      # setuptools>=77 (needed for the SPDX `license = "MIT"` form checked into pyproject.toml) has
+      # dropped Python 3.8; this job resolves an older setuptools that rejects that form outright.
+      # Patch just this job's checkout back to the old {file=...} form + classifier before building.
+      - name: Use classic license form (setuptools<77, no Python 3.8 support past that)
         run: |
-          sudo apt-get update
-          sudo apt-get install -y \
-            git cmake autoconf automake libtool pkg-config meson ninja-build \
-            libx11-dev libxss-dev libxext-dev libxtst-dev curl
-          curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable
-          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
+          python3 -c "
+          content = open('pyproject.toml').read()
+          content = content.replace(
+              'license = \"MIT\"\nlicense-files = [\"LICENSE\"]',
+              'license = {file = \"LICENSE\"}',
+          )
+          content = content.replace(
+              '\"Programming Language :: Python :: 3\",\n    \"Development Status :: 4 - Beta\",',
+              '\"Programming Language :: Python :: 3\",\n    \"License :: OSI Approved :: MIT License\",\n    \"Development Status :: 4 - Beta\",',
+          )
+          open('pyproject.toml', 'w').write(content)
+          "
+          grep -A1 "^license" pyproject.toml
+
+      # Static libs already built by `validate` (native, Linux glibc) — only linking happens here,
+      # so no cmake/meson/rust toolchain is needed in this job.
+      - uses: actions/download-artifact@v8
+        with:
+          name: orcsome3-built-libraries
+          path: orcsome3_built_libraries
 
       - uses: pypa/cibuildwheel@v3.4.1
         env:
@@ -104,20 +122,30 @@ jobs:
       - wheels-cp39-plus
       - wheels-cp38
       - build_sdist
+    # A real release always publishes (github.ref is the tag, e.g. refs/tags/v1.0.0, not a branch);
+    # a manual workflow_dispatch only publishes when run from master, not a stray feature branch.
+    if: github.event_name == 'release' || github.ref == 'refs/heads/master'
     runs-on: ubuntu-latest
     permissions:
       id-token: write
     environment:
       name: pypi
       url: https://pypi.org/p/orcsome3
     steps:
+      # Explicit names, not "download everything" — orcsome3-built-libraries (relayed to the wheel
+      # jobs) also exists in this run and would otherwise land in dist/ and break the publish step.
       - uses: actions/download-artifact@v8
         with:
+          pattern: "wheels-*"
           path: dist
           merge-multiple: true
 
+      - uses: actions/download-artifact@v8
+        with:
+          name: sdist
+          path: dist
+
       - name: Publish package distributions to PyPI
         uses: pypa/gh-action-pypi-publish@release/v1
         with:
           packages-dir: dist/
-          password: ${{ secrets.PYPI_API_TOKEN }}

orcsome3/aliases.py

@@ -1,5 +1,7 @@
 """Short key names mapped to X11 keysym names (`xev` / `X11/keysymdef.h` without the `XK_` prefix)."""
 
+from __future__ import annotations
+
 KEYS: dict[str, str] = {
     "`": "grave",
     "-": "minus",

orcsome3/libs/build/libraries.py

@@ -8,7 +8,7 @@
 import traceback
 import urllib.request
 from pathlib import Path
-from typing import Any, Callable, Optional, cast
+from typing import Any, Callable, List, Optional, cast
 
 from setuptools import setup
 from setuptools.extension import Extension
@@ -841,8 +841,10 @@ def _build() -> None:
 
 
 def _cythonize_extensions(module_list: list[Extension], **options: Any) -> list[Extension]:
+    # list[...] inside cast()'s first arg is evaluated at runtime (not deferred by `from __future__
+    # import annotations`, unlike real annotations); bare generics need 3.9+, so use typing.List here.
     cythonize: Callable[..., list[Extension]] = cast(
-        Callable[..., list[Extension]],
+        Callable[..., List[Extension]],
         __import__(name="Cython.Build.Dependencies", fromlist=["cythonize"]).cythonize,
     )
     return cythonize(module_list=module_list, **options)

orcsome3/libs/build/recipes.py

@@ -1,5 +1,7 @@
 """Library source versions and declarative build recipes (used by engine.py)."""
 
+from __future__ import annotations
+
 from pathlib import Path
 from typing import Any
 
@@ -216,7 +218,13 @@ def _recipe(name: str, **kwargs: Any) -> CMakeGitRecipe:
         url=LIBRARIES_SOURCES_VERSION["pixman"][0],
         tag=LIBRARIES_SOURCES_VERSION["pixman"][1],
         source_folder=versioned_folder(
-            name="pixman", version=LIBRARIES_SOURCES_VERSION["pixman"][1].removeprefix("pixman-")
+            # str.removeprefix() is 3.9+; this project targets 3.8.
+            name="pixman",
+            version=(
+                LIBRARIES_SOURCES_VERSION["pixman"][1][len("pixman-") :]
+                if LIBRARIES_SOURCES_VERSION["pixman"][1].startswith("pixman-")
+                else LIBRARIES_SOURCES_VERSION["pixman"][1]
+            ),
         ),
         pkg_config_names=["pixman-1"],
         include_subdirs=["include", "include/pixman-1"],