feat: Automate Python Wheel Build And Release #1064
+788
−243
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
jac0626
requested review from
LHT129,
inabao,
jiaweizone and
wxyucs
as code owners
|
Important Installation incomplete: to start using Gemini Code Assist, please ask the organization owner(s) to visit the Gemini Code Assist Admin Console and sign the Terms of Services. |
Reviewer's GuideThis PR implements a complete CI/CD workflow for building and publishing manylinux Python wheels via GitHub Actions and cibuildwheel, migrates Python packaging to PEP 517/518 with pyproject.toml, and refactors the CMake infrastructure to support static MKL linking and enhanced Python bindings. Sequence diagram for automated wheel publishing on releasesequenceDiagram
participant Dev as Developer
participant GH as GitHub Actions
participant PyPI as PyPI
Dev->>GH: Create new release
GH->>GH: Build wheels (cibuildwheel)
GH->>GH: Upload artifacts
GH->>PyPI: Publish wheels (using PYPI_API_TOKEN)
PyPI-->>GH: Success/Failure response
GH-->>Dev: Notify of publish result
Sequence diagram for automated wheel publishing on push to main (TestPyPI)sequenceDiagram
participant Dev as Developer
participant GH as GitHub Actions
participant TestPyPI as TestPyPI
Dev->>GH: Push to main branch
GH->>GH: Build wheels (cibuildwheel)
GH->>GH: Upload artifacts
GH->>TestPyPI: Publish wheels (using TEST_PYPI_API_TOKEN)
TestPyPI-->>GH: Success/Failure response
GH-->>Dev: Notify of publish result
Class diagram for the updated Python packaging structureclassDiagram
class pyvsag {
<<package>>
_pyvsag*.so
_version.py
}
class pyproject.toml {
build-system
project
tool.setuptools
tool.setuptools_scm
tool.cibuildwheel
}
pyvsag <.. pyproject.toml : defined in
File-Level Changes
Possibly linked issues
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey there - I've reviewed your changes and they look great!
Blocking issues:
- An action sourced from a third-party repository on GitHub is not pinned to a full length commit SHA. Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload. (link)
- An action sourced from a third-party repository on GitHub is not pinned to a full length commit SHA. Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload. (link)
- An action sourced from a third-party repository on GitHub is not pinned to a full length commit SHA. Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload. (link)
Prompt for AI Agents
Please address the comments from this code review:
## Individual Comments
### Comment 1
<location> `extern/mkl/mkl.cmake:56` </location>
<code_context>
+ message(FATAL_ERROR "Could not find Intel MKL in standard locations; use -DMKL_PATH to specify the install location")
+ endif()
+
+ if(NOT MKL_INCLUDE_PATH)
+ message(WARNING "Could not find MKL headers, continuing without include path")
+ endif()
</code_context>
<issue_to_address>
Build continues with a warning if MKL headers are missing.
If MKL headers are required, consider treating their absence as a fatal error. Otherwise, clearly document what functionality will be unavailable when headers are missing.
Suggested implementation:
```
if(NOT MKL_INCLUDE_PATH)
message(FATAL_ERROR "Could not find MKL headers. MKL headers are required for building MKL-dependent functionality. Please specify the header location with -DMKL_INCLUDE_PATH.")
endif()
```
If MKL headers are optional, use:
message(WARNING "Could not find MKL headers. MKL-dependent functionality will be disabled. Specify the header location with -DMKL_INCLUDE_PATH to enable full MKL support.")
and ensure the rest of the build system disables or excludes MKL-dependent features when headers are missing.
</issue_to_address>
### Comment 2
<location> `extern/mkl/mkl.cmake:63` </location>
<code_context>
+
+
+ link_directories(${MKL_PATH})
+ if(OMP_PATH)
+ link_directories(${OMP_PATH})
+ endif()
</code_context>
<issue_to_address>
OMP_PATH is now optional for linking.
If OMP_PATH is unset, please ensure the build system checks for OpenMP availability or falls back to system libraries to prevent runtime errors.
Suggested implementation:
```
link_directories(${MKL_PATH})
if(OMP_PATH)
link_directories(${OMP_PATH})
else()
find_package(OpenMP)
if(OpenMP_FOUND)
message(STATUS "OpenMP found: ${OpenMP_C_FLAGS}")
# Link OpenMP libraries if found
if(TARGET OpenMP::OpenMP_CXX)
set(OPENMP_LIBRARIES OpenMP::OpenMP_CXX)
elseif(OpenMP_CXX_LIBRARIES)
set(OPENMP_LIBRARIES ${OpenMP_CXX_LIBRARIES})
elseif(OpenMP_C_LIBRARIES)
set(OPENMP_LIBRARIES ${OpenMP_C_LIBRARIES})
endif()
else()
message(WARNING "OMP_PATH not set and OpenMP not found; build may fail or run without OpenMP support")
endif()
endif()
```
You may need to ensure that `${OPENMP_LIBRARIES}` is actually linked to your targets later in your CMake configuration, e.g., using `target_link_libraries(your_target ${OPENMP_LIBRARIES})`. Adjust as needed for your project's structure.
</issue_to_address>
### Comment 3
<location> `extern/mkl/mkl.cmake:95` </location>
<code_context>
- message ("enable intel-mkl as blas backend")
-else ()
+
+ add_compile_options(-m64)
+
+
</code_context>
<issue_to_address>
Explicitly adds -m64 compile option.
Consider applying -m64 only when the target architecture is 64-bit to avoid compatibility issues on platforms that require 32-bit builds or lack support for this flag.
</issue_to_address>
<suggested_fix>
<<<<<<< SEARCH
+ add_compile_options(-m64)
+
+
=======
+ # Add -m64 only if building for 64-bit architecture
+ if(CMAKE_SIZEOF_VOID_P EQUAL 8)
+ add_compile_options(-m64)
+ endif()
>>>>>>> REPLACE
</suggested_fix>
### Comment 4
<location> `scripts/build_cpp_for_cibw.sh:119` </location>
<code_context>
+ echo "Found libvsag.so at: $LIBVSAG_SO"
+
+
+ if ldd "$PYVSAG_CPYTHON_SO" 2>/dev/null | grep -q "libvsag.so.*=> not found"; then
+ echo "libvsag.so not in standard path, copying to package"
+ strip --strip-unneeded "$LIBVSAG_SO" || true
</code_context>
<issue_to_address>
Script checks for missing libvsag.so and copies it if needed.
If multiple libvsag.so versions exist, the script may not select the correct one. Match the version or build timestamp to avoid inconsistencies.
</issue_to_address>
<suggested_fix>
<<<<<<< SEARCH
LIBVSAG_SO=$(find $CMAKE_BUILD_DIR -name "libvsag.so*" -type f | head -n1)
if [ -n "$LIBVSAG_SO" ]; then
echo "Found libvsag.so at: $LIBVSAG_SO"
if ldd "$PYVSAG_CPYTHON_SO" 2>/dev/null | grep -q "libvsag.so.*=> not found"; then
echo "libvsag.so not in standard path, copying to package"
strip --strip-unneeded "$LIBVSAG_SO" || true
cp "$LIBVSAG_SO" python/pyvsag/
else
strip --strip-unneeded "$LIBVSAG_SO" || true
echo "libvsag.so is accessible, letting auditwheel handle it"
fi
fi
=======
# Find all libvsag.so* files and select the most recently modified one
LIBVSAG_SO=$(find "$CMAKE_BUILD_DIR" -name "libvsag.so*" -type f -printf "%T@ %p\n" | sort -nr | head -n1 | awk '{print $2}')
if [ -n "$LIBVSAG_SO" ]; then
echo "Selected libvsag.so for packaging: $LIBVSAG_SO"
if ldd "$PYVSAG_CPYTHON_SO" 2>/dev/null | grep -q "libvsag.so.*=> not found"; then
echo "libvsag.so not in standard path, copying to package"
strip --strip-unneeded "$LIBVSAG_SO" || true
cp "$LIBVSAG_SO" python/pyvsag/
else
strip --strip-unneeded "$LIBVSAG_SO" || true
echo "libvsag.so is accessible, letting auditwheel handle it"
fi
fi
>>>>>>> REPLACE
</suggested_fix>
## Security Issues
### Issue 1
<location> `.github/workflows/build_release_wheel.yml:31` </location>
<issue_to_address>
**security (yaml.github-actions.security.third-party-action-not-pinned-to-commit-sha):** An action sourced from a third-party repository on GitHub is not pinned to a full length commit SHA. Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload.
*Source: opengrep*
</issue_to_address>
### Issue 2
<location> `.github/workflows/build_release_wheel.yml:110` </location>
<issue_to_address>
**security (yaml.github-actions.security.third-party-action-not-pinned-to-commit-sha):** An action sourced from a third-party repository on GitHub is not pinned to a full length commit SHA. Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload.
*Source: opengrep*
</issue_to_address>
### Issue 3
<location> `.github/workflows/build_release_wheel.yml:143` </location>
<issue_to_address>
**security (yaml.github-actions.security.third-party-action-not-pinned-to-commit-sha):** An action sourced from a third-party repository on GitHub is not pinned to a full length commit SHA. Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload.
*Source: opengrep*
</issue_to_address>Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
extern/mkl/mkl.cmake
Outdated
| message(FATAL_ERROR "Could not find Intel MKL in standard locations; use -DMKL_PATH to specify the install location") | ||
| endif() | ||
|
|
||
| if(NOT MKL_INCLUDE_PATH) |
There was a problem hiding this comment.
suggestion (bug_risk): Build continues with a warning if MKL headers are missing.
If MKL headers are required, consider treating their absence as a fatal error. Otherwise, clearly document what functionality will be unavailable when headers are missing.
Suggested implementation:
if(NOT MKL_INCLUDE_PATH)
message(FATAL_ERROR "Could not find MKL headers. MKL headers are required for building MKL-dependent functionality. Please specify the header location with -DMKL_INCLUDE_PATH.")
endif()
If MKL headers are optional, use:
message(WARNING "Could not find MKL headers. MKL-dependent functionality will be disabled. Specify the header location with -DMKL_INCLUDE_PATH to enable full MKL support.")
and ensure the rest of the build system disables or excludes MKL-dependent features when headers are missing.
extern/mkl/mkl.cmake
Outdated
|
|
||
|
|
||
| link_directories(${MKL_PATH}) | ||
| if(OMP_PATH) |
There was a problem hiding this comment.
suggestion (bug_risk): OMP_PATH is now optional for linking.
If OMP_PATH is unset, please ensure the build system checks for OpenMP availability or falls back to system libraries to prevent runtime errors.
Suggested implementation:
link_directories(${MKL_PATH})
if(OMP_PATH)
link_directories(${OMP_PATH})
else()
find_package(OpenMP)
if(OpenMP_FOUND)
message(STATUS "OpenMP found: ${OpenMP_C_FLAGS}")
# Link OpenMP libraries if found
if(TARGET OpenMP::OpenMP_CXX)
set(OPENMP_LIBRARIES OpenMP::OpenMP_CXX)
elseif(OpenMP_CXX_LIBRARIES)
set(OPENMP_LIBRARIES ${OpenMP_CXX_LIBRARIES})
elseif(OpenMP_C_LIBRARIES)
set(OPENMP_LIBRARIES ${OpenMP_C_LIBRARIES})
endif()
else()
message(WARNING "OMP_PATH not set and OpenMP not found; build may fail or run without OpenMP support")
endif()
endif()
You may need to ensure that ${OPENMP_LIBRARIES} is actually linked to your targets later in your CMake configuration, e.g., using target_link_libraries(your_target ${OPENMP_LIBRARIES}). Adjust as needed for your project's structure.
extern/mkl/mkl.cmake
Outdated
Comment on lines
95
to
97
| add_compile_options(-m64) | ||
|
|
||
|
|
There was a problem hiding this comment.
suggestion: Explicitly adds -m64 compile option.
Consider applying -m64 only when the target architecture is 64-bit to avoid compatibility issues on platforms that require 32-bit builds or lack support for this flag.
Suggested change
| add_compile_options(-m64) | |
| + # Add -m64 only if building for 64-bit architecture | |
| + if(CMAKE_SIZEOF_VOID_P EQUAL 8) | |
| + add_compile_options(-m64) | |
| + endif() |
Comment on lines
+113
to
+128
| LIBVSAG_SO=$(find $CMAKE_BUILD_DIR -name "libvsag.so*" -type f | head -n1) | ||
|
|
||
| if [ -n "$LIBVSAG_SO" ]; then | ||
| echo "Found libvsag.so at: $LIBVSAG_SO" | ||
|
|
||
|
|
||
| if ldd "$PYVSAG_CPYTHON_SO" 2>/dev/null | grep -q "libvsag.so.*=> not found"; then | ||
| echo "libvsag.so not in standard path, copying to package" | ||
| strip --strip-unneeded "$LIBVSAG_SO" || true | ||
| cp "$LIBVSAG_SO" python/pyvsag/ | ||
| else | ||
|
|
||
| strip --strip-unneeded "$LIBVSAG_SO" || true | ||
| echo "libvsag.so is accessible, letting auditwheel handle it" | ||
| fi | ||
| fi |
There was a problem hiding this comment.
suggestion (bug_risk): Script checks for missing libvsag.so and copies it if needed.
If multiple libvsag.so versions exist, the script may not select the correct one. Match the version or build timestamp to avoid inconsistencies.
Suggested change
| LIBVSAG_SO=$(find $CMAKE_BUILD_DIR -name "libvsag.so*" -type f | head -n1) | |
| if [ -n "$LIBVSAG_SO" ]; then | |
| echo "Found libvsag.so at: $LIBVSAG_SO" | |
| if ldd "$PYVSAG_CPYTHON_SO" 2>/dev/null | grep -q "libvsag.so.*=> not found"; then | |
| echo "libvsag.so not in standard path, copying to package" | |
| strip --strip-unneeded "$LIBVSAG_SO" || true | |
| cp "$LIBVSAG_SO" python/pyvsag/ | |
| else | |
| strip --strip-unneeded "$LIBVSAG_SO" || true | |
| echo "libvsag.so is accessible, letting auditwheel handle it" | |
| fi | |
| fi | |
| # Find all libvsag.so* files and select the most recently modified one | |
| LIBVSAG_SO=$(find "$CMAKE_BUILD_DIR" -name "libvsag.so*" -type f -printf "%T@ %p\n" | sort -nr | head -n1 | awk '{print $2}') | |
| if [ -n "$LIBVSAG_SO" ]; then | |
| echo "Selected libvsag.so for packaging: $LIBVSAG_SO" | |
| if ldd "$PYVSAG_CPYTHON_SO" 2>/dev/null | grep -q "libvsag.so.*=> not found"; then | |
| echo "libvsag.so not in standard path, copying to package" | |
| strip --strip-unneeded "$LIBVSAG_SO" || true | |
| cp "$LIBVSAG_SO" python/pyvsag/ | |
| else | |
| strip --strip-unneeded "$LIBVSAG_SO" || true | |
| echo "libvsag.so is accessible, letting auditwheel handle it" | |
| fi | |
| fi |
| fetch-depth: 0 | ||
|
|
||
| - name: Build wheels | ||
| uses: pypa/[email protected] |
There was a problem hiding this comment.
security (yaml.github-actions.security.third-party-action-not-pinned-to-commit-sha): An action sourced from a third-party repository on GitHub is not pinned to a full length commit SHA. Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload.
Source: opengrep
|
|
||
| - name: Publish to TestPyPI | ||
| uses: pypa/gh-action-pypi-publish@release/v1 |
There was a problem hiding this comment.
security (yaml.github-actions.security.third-party-action-not-pinned-to-commit-sha): An action sourced from a third-party repository on GitHub is not pinned to a full length commit SHA. Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload.
Source: opengrep
|
|
||
| - name: Publish to PyPI | ||
| uses: pypa/gh-action-pypi-publish@release/v1 |
There was a problem hiding this comment.
security (yaml.github-actions.security.third-party-action-not-pinned-to-commit-sha): An action sourced from a third-party repository on GitHub is not pinned to a full length commit SHA. Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload.
Source: opengrep
Codecov Report✅ All modified and coverable lines are covered by tests. @@ Coverage Diff @@
## main #1064 +/- ##
==========================================
+ Coverage 91.43% 92.00% +0.56%
==========================================
Files 317 312 -5
Lines 18956 18889 -67
==========================================
+ Hits 17333 17378 +45
+ Misses 1623 1511 -112
Flags with carried forward coverage won't be shown. Click here to find out more.
Continue to review full report in Codecov by Sentry.
🚀 New features to boost your workflow:
|
jac0626
force-pushed
the
build_wheel
branch
6 times, most recently
from
941cc58 to
6793c3c
Compare
|
https://pypi.org/project/pyvsag-test-jc/ this is the test wheels uploaded by my test branch |
|
Hi @jac0626, thanks for your contribution. This change is large, so I need more time to review and validate it. |
wxyucs
reviewed
Aug 27, 2025
There was a problem hiding this comment.
@LHT129 @ShawnShawnYou, please review changes in this file to make sure it's correct for the library packaging (include our internal usage)
jac0626
changed the title
jac0626
force-pushed
the
build_wheel
branch
7 times, most recently
from
ed82b13 to
429179b
Compare
jac0626
force-pushed
the
build_wheel
branch
6 times, most recently
from
09f64f4 to
c078185
Compare
jac0626
force-pushed
the
build_wheel
branch
2 times, most recently
from
468f9f4 to
d8d976c
Compare
jac0626
changed the title
LHT129
approved these changes
Oct 16, 2025
LHT129
reviewed
Oct 16, 2025
LHT129
approved these changes
Oct 20, 2025
wxyucs
reviewed
Oct 20, 2025
Makefile
Outdated
Comment on lines
136
to
146
| # Target to build a specific Python version wheel. | ||
| # Usage: make pyvsag PY_VERSION=3.10 | ||
| pyvsag: | ||
| @echo "Building wheel for Python $(PY_VERSION)..." | ||
| bash ./scripts/local_build_wheel.sh $(PY_VERSION) | ||
|
|
||
| .PHONY: pyvsag | ||
| pyvsag: ## Build pyvsag wheel. | ||
| bash ./scripts/build_pyvsag_multiple_version.sh $(PARAM1) $(PARAM2) $(PARAM3) | ||
| # Target to build wheels for all supported versions. | ||
| # Usage: make pyvsag-all | ||
| pyvsag-all: | ||
| @echo "Building wheels for all supported versions..." | ||
| bash ./scripts/local_build_wheel.sh |
There was a problem hiding this comment.
Add comments that start with ##. so that we can use the make help command to show the command list.
scripts/prepare_python_build.sh
Outdated
| esac | ||
| echo " - pyproject.toml patched." | ||
|
|
||
| echo "✅ Build preparation complete for Python ${PY_VERSION}." No newline at end of file |
scripts/local_build_wheel.sh
Outdated
| echo "" | ||
| echo "✅ All tasks completed." | ||
| echo "📦 Wheels have been generated in the 'wheelhouse' directory:" | ||
| ls -l wheelhouse No newline at end of file |
scripts/build_cpp_for_cibw.sh
Outdated
|
|
||
|
|
||
| echo "" | ||
| echo "Build script completed successfully!" No newline at end of file |
python/pyproject.toml
Outdated
| [tool.cibuildwheel.linux] | ||
| repair-wheel-command = "auditwheel repair -w {dest_dir} {wheel}" | ||
| manylinux-x86_64-image = "manylinux2014" | ||
| manylinux-aarch64-image = "manylinux2014" No newline at end of file |
extern/mkl/mkl.cmake
Outdated
| endif () | ||
| endif() | ||
|
|
||
| set(BLAS_LIBRARIES "${BLAS_LIBRARIES}" CACHE STRING "Final list of BLAS libraries to link against.") |
Signed-off-by: jac <[email protected]>
wxyucs
reviewed
Oct 24, 2025
|
|
||
| .PHONY: pyvsag pyvsag-all | ||
|
|
||
| pyvsag: ## Build a specific Python version wheel. Usage: make pyvsag PY_VERSION=3.10 |
There was a problem hiding this comment.
use <space> instead of <tab>, and keep the comments aligned in make help output.
| .PHONY: pyvsag | ||
| pyvsag: ## Build pyvsag wheel. | ||
| bash ./scripts/build_pyvsag_multiple_version.sh $(PARAM1) $(PARAM2) $(PARAM3) | ||
| pyvsag-all: ## Build wheels for all supported versions. Usage: make pyvsag-all |
| @@ -0,0 +1,158 @@ | |||
| #!/bin/bash | |||
|
|
|||
There was a problem hiding this comment.
remove this blank line, keep only one blank line between statements
Comment on lines
+8
to
+10
|
|
||
|
|
||
|
|
There was a problem hiding this comment.
remove these blank lines, make VARS definitions together
|
|
||
|
|
||
| set -eo pipefail | ||
|
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
feat: Automate Python Wheel Builds and Optimize Dependencies
This PR modernizes the Python packaging process by introducing a fully automated CI/CD pipeline to build
and publish wheels, while also optimizing the binary dependencies.
Key Changes:
wheels for x86_64 and aarch64 architectures. The workflow automatically publishes to TestPyPI on pushes
to main and to the official PyPI when a new release is created.
replacing the previous setup.py-based scripts for a more robust and reliable process.
Note for Maintainers: Required Secrets
To enable the new automated publishing workflow (build_release_wheel.yml), the following secrets must be
added to the repository's settings under Settings > Secrets and variables > Actions:
a new release is published.
pushes to main.
These secrets are essential for the workflow to publish packages automatically. For more details, please
see the GitHub documentation on creating secrets
(https://docs.github.com/en/actions/security-guides/using-secrets-in-github-actions).
Future work should include adding build support for Windows and macOS
close #1020
Summary by Sourcery
Modernize and automate the Python packaging workflow by replacing setup.py with a pyproject.toml-based build, adding CMake support for static MKL linking, and implementing a GitHub Actions pipeline with cibuildwheel to build and publish manylinux wheels across multiple architectures.
New Features:
Enhancements:
CI: