update CIs

Author: mscheltienne

.github/workflows/publish.yaml

@@ -1,67 +1,50 @@
 name: publish
 concurrency:
   group: ${{ github.workflow }}
-  cancel-in-progress: true
 on:  # yamllint disable-line rule:truthy
   release:
     types: [published]
 
 jobs:
-  build:
+  build-wheels:
     if: ${{ github.repository == 'Dandelion-Science/python-evdev' }}
-    name: build py${{ matrix.python-version }}
-    runs-on: codebuild-dandelion-linux-amd64-${{ github.run_id }}-${{ github.run_attempt }}
+    name: wheels on ${{ matrix.os }}
+    # evdev is Linux-only (needs <linux/input.h>); no macOS/Windows wheels are
+    # possible. Native runners build their own arch (archs = "native"), no QEMU.
+    runs-on: ${{ matrix.os }}
     strategy:
       fail-fast: false
       matrix:
-        python-version: ["3.13", "3.13t", "3.14", "3.14t"]
-    timeout-minutes: 15
-    permissions:
-      id-token: write
-      contents: read
+        os: [ubuntu-latest, ubuntu-24.04-arm]
+    timeout-minutes: 30
     steps:
-      - uses: aws-actions/configure-aws-credentials@v6
-        with:
-          aws-region: ${{ vars.AWS_REGION }}
-          role-to-assume: ${{ vars.ARN_IAM_ROLE_GHA_CORE }}
       - uses: actions/checkout@v7
         with:
           fetch-depth: 0
-      - uses: Dandelion-Science/github-actions/setup-uv@main
-        with:
-          python-version: ${{ matrix.python-version }}
-      - run: uv build --wheel
+      - uses: pypa/cibuildwheel@v4.1.0
       - uses: actions/upload-artifact@v4
         with:
-          name: dist-${{ matrix.python-version }}
-          path: dist/
+          name: cibw-wheels-${{ matrix.os }}
+          path: ./wheelhouse/*.whl
 
   build-sdist:
     if: ${{ github.repository == 'Dandelion-Science/python-evdev' }}
-    runs-on: codebuild-dandelion-linux-arm64-${{ github.run_id }}-${{ github.run_attempt }}
+    runs-on: ubuntu-slim
     timeout-minutes: 15
-    permissions:
-      id-token: write
-      contents: read
     steps:
-      - uses: aws-actions/configure-aws-credentials@v6
-        with:
-          aws-region: ${{ vars.AWS_REGION }}
-          role-to-assume: ${{ vars.ARN_IAM_ROLE_GHA_CORE }}
       - uses: actions/checkout@v7
         with:
           fetch-depth: 0
-      - uses: Dandelion-Science/github-actions/setup-uv@main
+      - uses: astral-sh/setup-uv@v7
       - run: uv build --sdist
       - uses: actions/upload-artifact@v4
         with:
-          name: dist-sdist
-          path: dist/
+          name: cibw-sdist
+          path: dist/*.tar.gz
 
   publish:
-    if: ${{ github.repository == 'Dandelion-Science/python-evdev' }}
-    needs: [build, build-sdist]
-    runs-on: codebuild-dandelion-linux-arm64-${{ github.run_id }}-${{ github.run_attempt }}
+    needs: [build-wheels, build-sdist]
+    runs-on: ubuntu-slim
     timeout-minutes: 15
     permissions:
       id-token: write
@@ -74,6 +57,7 @@ jobs:
       - uses: actions/download-artifact@v4
         with:
           path: dist
+          pattern: cibw-*
           merge-multiple: true
       - uses: softprops/action-gh-release@v3
         with:
@@ -92,4 +76,4 @@ jobs:
         env:
           UV_PUBLISH_USERNAME: aws
           UV_PUBLISH_PASSWORD: ${{ env.AWS_CODEARTIFACT_TOKEN }}
-          UV_PUBLISH_URL: ${{ vars.CODEARTIFACT_DANDELION_PYPI_REPOSITORY_URL }}
+          UV_PUBLISH_URL: ${{ vars.CODEARTIFACT_PYPI_STORE_REPOSITORY_URL }}

.github/workflows/pytest.yaml

@@ -12,27 +12,23 @@ jobs:
   pytest:
     if: ${{ !cancelled() && github.repository == 'Dandelion-Science/python-evdev' && (github.event_name != 'pull_request' || github.event.pull_request.draft == false) }}
     name: py${{ matrix.python-version }}
-    runs-on: codebuild-dandelion-linux-arm64-${{ github.run_id }}-${{ github.run_attempt }}
+    runs-on: ubuntu-latest
     strategy:
       fail-fast: false
       matrix:
         python-version: ["3.13", "3.13t", "3.14", "3.14t"]
     timeout-minutes: 30
-    permissions:
-      id-token: write
-      contents: read
     steps:
-      - uses: aws-actions/configure-aws-credentials@v6
-        with:
-          aws-region: ${{ vars.AWS_REGION }}
-          role-to-assume: ${{ vars.ARN_IAM_ROLE_GHA_CORE }}
       - uses: actions/checkout@v7
         with:
           fetch-depth: 0
-      - uses: Dandelion-Science/github-actions/setup-uv@main
+      - uses: astral-sh/setup-uv@v7
         with:
           activate-environment: true
           python-version: ${{ matrix.python-version }}
       - run: uv sync -q --no-default-groups --group test
-      - run: pytest tests/test_ecodes.py tests/test_events.py tests/test_util.py
+      # test_uinput.py needs root (opens /dev/uinput) and does not skip without it,
+      # so the rest of the suite runs as the normal user and uinput runs under sudo.
+      - run: pytest tests --ignore=tests/test_uinput.py
+      - run: sudo modprobe uinput
       - run: sudo .venv/bin/pytest tests/test_uinput.py

pyproject.toml

@@ -37,6 +37,25 @@ line-length = 120
 [tool.ruff.lint]
 ignore = ["E265", "E241", "F403", "F401", "E401", "E731"]
 
+[tool.cibuildwheel]
+# evdev is Linux-only (needs <linux/input.h>): no macOS/Windows wheels exist.
+# Build CPython 3.11-3.14 incl. the free-threaded 3.13t/3.14t builds; glibc only
+# (musllinux skipped), CPython only (no PyPy).
+build = ["cp311-*", "cp312-*", "cp313-*", "cp314-*", "cp313t-*", "cp314t-*"]
+enable = ["cpython-freethreading"]
+skip = ["*-musllinux*", "pp*"]
+archs = "native"
+build-frontend = "build[uv]"
+# Smoke-test that the wheel imports and every compiled extension loads.
+test-command = "python -c \"import evdev, evdev.ecodes, evdev._input, evdev._uinput, evdev._ecodes\""
+
+[tool.cibuildwheel.linux]
+# manylinux images are glibc/AlmaLinux based and normally ship kernel-headers
+# (pulled in by glibc-devel), but evdev's build hard-fails without <linux/input.h>;
+# ensure they are present. No-op when already installed.
+before-all = "yum install -y kernel-headers || true"
+repair-wheel-command = "auditwheel repair -w {dest_dir} {wheel}"
+
 [tool.bumpversion]
 current_version = "1.9.3"
 commit = true

tests/test_free_threaded.py

@@ -5,17 +5,23 @@
 import pytest
 
 
-def _is_freethreaded_build():
+def _is_freethreaded_build() -> bool:
     import sysconfig
+
     return bool(sysconfig.get_config_var("Py_GIL_DISABLED"))
 
 
 @pytest.mark.skipif(not _is_freethreaded_build(), reason="requires free-threaded Python build")
 def test_evdev_does_not_reenable_gil():
+    # Run with PYTHON_GIL unset (not 0): PYTHON_GIL=0 force-disables the GIL
+    # regardless of the module, which would make this pass even for a C extension
+    # that has not declared Py_MOD_GIL_NOT_USED. We want the default behavior so
+    # importing a non-free-threaded extension actually re-enables the GIL and fails.
+    env = {k: v for k, v in os.environ.items() if k != "PYTHON_GIL"}
     result = subprocess.run(
         [sys.executable, "-c", "import sys; import evdev; assert not sys._is_gil_enabled()"],
         capture_output=True,
         text=True,
-        env={**os.environ, "PYTHON_GIL": "0"},
+        env=env,
     )
     assert result.returncode == 0, f"evdev re-enabled the GIL:\n{result.stderr}"