Update release workflows for Python 3.13, Ubuntu 24.04, etc

Add Python 3.13 to release workflows and update cibuildwheel to a release
that uses 3.13-final.

Run GitHub release workflow based on pushing tags or release/* branches.
Building wheels based on the GitHub Release going live means the wheels
take longer to appear than they need to.

GitHub Action's macos-latest is now ARM, which we have to date built on
Cirrus CI instead. Build on ubuntu-latest and macos-13 (which is x86_64)
and add a script and step to check that architectures are as expected.

GitHub's Ubuntu 24.04 image has fewer development packages pre-installed;
ensure that libbz2 and liblzma development files are present.

On macOS, wheels don't carry their own shared libraries, so avoid linking
with the non-system-provided library libdeflate.dylib.

.cirrus.yml

@@ -11,15 +11,15 @@ build_wheels_task:
         - name: Build ARM Linux py3.6-9 wheels
           env:
             CIBW_BUILD: "cp36-* cp37-* cp38-* cp39-*"
-        - name: Build ARM Linux py3.10-12 wheels
+        - name: Build ARM Linux py3.10-13 wheels
           env:
-            CIBW_BUILD: "cp310-* cp311-* cp312-*"
+            CIBW_BUILD: "cp310-* cp311-* cp312-* cp313-*"
 
     - name: Build ARM macOS wheels
       macos_instance:
         image: ghcr.io/cirruslabs/macos-sonoma-base:latest
       env:
-        CIBW_BUILD: "cp39-* cp310-* cp311-* cp312-*"
+        CIBW_BUILD: "cp39-* cp310-* cp311-* cp312-* cp313-*"
 
   alias: build_wheels
 
@@ -32,11 +32,14 @@ build_wheels_task:
     CIBW_SKIP: "*-musllinux_*"
     CIBW_BUILD_VERBOSITY: 1
 
+    # Avoid linking with non-system library libdeflate.dylib
+    CIBW_ENVIRONMENT_MACOS: HTSLIB_CONFIGURE_OPTIONS="--without-libdeflate"
+
     CIBW_MANYLINUX_AARCH64_IMAGE: manylinux_2_28
 
   install_script: |
     python3 -m venv $VENV
-    pip3 install cibuildwheel==2.17.0
+    pip3 install cibuildwheel==2.22.0
 
   build_script: |
     cibuildwheel

.github/workflows/release.yaml

@@ -3,25 +3,22 @@ name: Publish wheels
 on:
   push:
     branches:
-      - v[0-9]+.*
+      - release/*
     tags:
       - v[0-9]+.*
-  release:
-    types:
-      - published
 
 jobs:
   build_wheels:
-    runs-on: ${{ matrix.os }}-latest
+    runs-on: ${{ matrix.os }}
     strategy:
       matrix:
-        os: [ubuntu, macos]
-        build: ["cp36-* cp37-* cp38-* cp39-*", "cp310-* cp311-* cp312-*"]
+        os: [ubuntu-latest, macos-13]
+        build: ["cp36-* cp37-* cp38-* cp39-*", "cp310-* cp311-* cp312-* cp313-*"]
         x64image: [manylinux_2_28]
         nametag: [none]
 
         include:
-          - os: ubuntu
+          - os: ubuntu-latest
             build: "cp38-manylinux_x86_64"
             x64image: manylinux2014
             nametag: focal
@@ -30,13 +27,19 @@ jobs:
       - name: Checkout pysam
         uses: actions/checkout@v4
 
+      - name: Check platform ${{ matrix.os }} is the expected architecture
+        run:  devtools/check-platform.sh ${{ matrix.os }}
+
       - name: Build wheels
-        uses: pypa/cibuildwheel@v2.17.0
+        uses: pypa/cibuildwheel@v2.22.0
         env:
           CIBW_BUILD: ${{ matrix.build }}
           CIBW_SKIP: "*-musllinux_*"
           CIBW_BUILD_VERBOSITY: 1
 
+          # Avoid linking with non-system library libdeflate.dylib
+          CIBW_ENVIRONMENT_MACOS: HTSLIB_CONFIGURE_OPTIONS="--without-libdeflate"
+
           CIBW_ARCHS_LINUX: x86_64
           CIBW_ARCHS_MACOS: x86_64
 
@@ -75,7 +78,7 @@ jobs:
       - name: Install build prerequisites
         run: |
           sudo apt-get update
-          sudo apt-get install -q --no-install-recommends --no-install-suggests libcurl4-openssl-dev
+          sudo apt-get install -q --no-install-recommends --no-install-suggests libbz2-dev libcurl4-openssl-dev liblzma-dev
 
       - name: Create source distribution
         run:  python setup.py sdist --owner=root --group=root
@@ -88,7 +91,7 @@ jobs:
   upload_pypi:
     needs: [build_wheels, build_sdist]
     runs-on: ubuntu-latest
-    environment: ${{ github.event_name == 'release' && 'pypi' || 'testpypi' }}
+    environment: ${{ github.ref_type == 'tag' && 'pypi' || 'testpypi' }}
 
     permissions:
       id-token: write
@@ -101,11 +104,11 @@ jobs:
           path: dist
 
       - name: Publish distribution to Test PyPI
-        if: github.event_name == 'push'
+        if: github.ref_type == 'branch'
         uses: pypa/gh-action-pypi-publish@release/v1
         with:
           repository-url: https://test.pypi.org/legacy/
 
       - name: Publish distribution to PyPI
-        if: github.event_name == 'release' && github.event.action == 'published'
+        if: github.ref_type == 'tag'
         uses: pypa/gh-action-pypi-publish@release/v1

devtools/check-platform.sh

@@ -0,0 +1,32 @@
+#!/bin/sh -e
+
+case $1 in
+    ubuntu-*-arm)  expected=arm ;;
+    macos-13)      expected=x86_64 ;;
+    ubuntu-*)      expected=x86_64 ;;
+    macos-*)       expected=arm ;;
+    windows-*)     expected=x86_64 ;;
+    *)
+	echo Unknown platform $1 >&2
+	exit 2
+	;;
+esac
+
+arch=$(uname -m)
+case $arch in
+    arm*|aarch*)  actual=arm ;;
+    x86*)         actual=x86_64 ;;
+    *)
+	echo Unrecognized uname result $arch >&2
+	exit 2
+	;;
+esac
+
+if test $actual = $expected
+then
+    echo Running on $arch as expected
+    exit 0
+else
+    echo Platform $arch is not the expected $expected >&2
+    exit 1
+fi