Test: wheel build CLI

.github/workflows/ci.yml

@@ -7,13 +7,6 @@ on:
     branches: [main]
   workflow_dispatch: {}
 
-# Explicit least-privilege GITHUB_TOKEN scope. None of the jobs below write
-# to the repo, comment on PRs, or publish anything - they only check out
-# code, build/test it, and upload log artifacts - so read-only access to
-# contents is all that's needed. Without this block, jobs run with the
-# default token scope, which can be broader than necessary depending on
-# repo/org settings (this is what CodeQL's "workflow does not contain
-# permissions" alert flags).
 permissions:
   contents: read
 
@@ -24,9 +17,6 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        # Both compilers are exercised in CI since this project's behavior
-        # (SIMD dispatch, precision) has measurably differed between them -
-        # see CONTRIBUTING.md and the README's GCC vs. Clang benchmarks.
         include:
           - compiler: gcc
             cc: gcc
@@ -49,9 +39,6 @@ jobs:
           python-version: "3.x"
 
       - name: Install system dependencies
-        # NOTE: per CMakeLists.txt, SLEEF and Google Benchmark are fetched
-        # from source via FetchContent at configure time - they are NOT
-        # system packages, so they are deliberately absent here.
         run: |
           sudo apt-get update
           sudo apt-get install -y \
@@ -82,15 +69,6 @@ jobs:
   build-and-test-windows:
     name: build-and-test (windows, clang)
     runs-on: windows-latest
-    # NOTE: unlike the Linux job above, this one does NOT go through
-    # build.py. build.py's configure step is hardcoded to
-    # `-DCMAKE_BUILD_TYPE=... -DDEEPITY_BUILD_TESTS=ON` with no way to pass
-    # extra defines, but Windows+Clang needs several more (OpenMP_libomp_
-    # LIBRARY, CMAKE_TOOLCHAIN_FILE, BLA_VENDOR). Those live in the
-    # "windows-clang" preset in CMakePresets.json, which this job invokes
-    # directly via `cmake --preset` - see the Configure step below. If
-    # build.py grows support for passthrough CMake args or preset selection,
-    # this job should switch to using it, the same as the Linux job.
     steps:
       - name: Check out repository
         uses: actions/checkout@v4
@@ -194,3 +172,69 @@ jobs:
 
       - name: Run pyright
         run: pyright
+
+  build-wheels:
+    name: wheels (${{ matrix.os }})
+    needs: [build-and-test, build-and-test-windows]
+    strategy:
+      fail-fast: false
+      matrix:
+        # macOS intentionally excluded for now: macos-latest runners are
+        # arm64, and CMakeLists.txt's SIMD flags (DEEPITY_ARCH_FLAGS's
+        # x86-64-v2, SLEEF_ENABLE_AVX2/AVX512F) are x86-only with no
+        # arch-conditional branching yet.
+        os: [ubuntu-latest, windows-latest]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+      # --- Linux and macOS need no host-side setup: OpenBLAS/libgomp
+      # install inside the manylinux container (Linux) or via Homebrew
+      # (macOS) through the before-all hooks in pyproject.toml's
+      # [tool.cibuildwheel.linux] / [tool.cibuildwheel.macos] tables.
+      - name: Build wheels
+        uses: pypa/cibuildwheel@v2.21
+
+      - name: Upload wheels
+        uses: actions/upload-artifact@v4
+        with:
+          name: wheels-${{ matrix.os }}
+          path: wheelhouse/*.whl
+          if-no-files-found: error
+
+  build-sdist:
+    name: sdist
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.x"
+
+      - name: Install build
+        run: pip install build
+
+      - name: Build sdist
+        # NOT `python -m build` - `-m` makes Python search sys.path with the
+        # current working directory prepended, and this repo has a
+        # `build.py` at the root, which shadows the installed `build`
+        # package entirely (the error you'd see is literally build.py's own
+        # --help text). `pyproject-build` is the console-script entry point
+        # the `build` package ships specifically to avoid this collision.
+        run: pyproject-build --sdist
+
+      - name: Upload sdist
+        uses: actions/upload-artifact@v4
+        with:
+          name: sdist
+          path: dist/*.tar.gz
+          if-no-files-found: error
+
+  # Not wired up yet: publishing needs the PyPI project configured for
+  # Trusted Publishing (pypi.org project settings -> Publishing) with this
+  # repo/workflow registered, then a job here gated on a tag push using
+  # `pypa/gh-action-pypi-publish` and `permissions: id-token: write` -
+  # no API token needs to live in repo secrets with that approach.

.gitignore

@@ -1,6 +1,6 @@
 .vscode/*
-build/*
-bin/*
+build/
+bin/
 __pycache__/*
 MNIST/*
 pyrightconfig.json
@@ -10,10 +10,19 @@ repomix-output.xml
 experiments/outputs/
 experiments/data/
 experiments/checkpoints/
+
 *.lib
 *.dll
 *.so
 *.pyd
 *.exe
 *.obj
 *.o
+CMakeCache.txt
+CMakeFiles/
+.ninja_log
+
+wheelhouse/
+dist/
+*.egg-info/
+_skbuild/