ci: publish tag wheel assets and use rustls for HTTP

.github/workflows/ci.yml

@@ -47,8 +47,6 @@ jobs:
       - uses: actions/setup-python@v7
         with:
           python-version: "3.14"
-      - name: Install native build dependencies
-        run: sudo apt-get update && sudo apt-get install -y cmake clang libclang-dev
       - name: Install Rust tooling
         run: rustup toolchain install stable --profile minimal --component rustfmt --component clippy && rustup default stable
       - uses: actions/cache@v5
@@ -79,8 +77,6 @@ jobs:
         with:
           python-version: ${{ matrix.python }}
           allow-prereleases: ${{ matrix.python == '3.15' }}
-      - name: Install native build dependencies
-        run: sudo apt-get update && sudo apt-get install -y cmake clang libclang-dev
       - name: Install Rust
         run: rustup toolchain install stable --profile minimal && rustup default stable
       - uses: actions/cache@v5
@@ -108,8 +104,6 @@ jobs:
       - uses: actions/setup-python@v7
         with:
           python-version: "3.14"
-      - name: Install native build dependencies
-        run: sudo apt-get update && sudo apt-get install -y cmake clang libclang-dev
       - name: Install coverage tooling
         run: |
           rustup toolchain install stable --profile minimal --component llvm-tools-preview

.github/workflows/release.yml

@@ -0,0 +1,101 @@
+name: Release wheels
+
+on:
+  push:
+    tags: ["v*"]
+  pull_request:
+    paths: [".github/workflows/release.yml"]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  wheels:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 60
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
+        with:
+          python-version: "3.14"
+      - name: Validate release version
+        if: startsWith(github.ref, 'refs/tags/')
+        env:
+          RELEASE_TAG: ${{ github.ref_name }}
+        run: |
+          python - <<'PY'
+          import os
+          import tomllib
+          from pathlib import Path
+          project = tomllib.loads(Path("pyproject.toml").read_text())["project"]["version"]
+          crate = tomllib.loads(Path("Cargo.toml").read_text())["package"]["version"]
+          tag = os.environ["RELEASE_TAG"]
+          if tag != f"v{project}" or project != crate:
+              raise SystemExit(f"Version mismatch: tag={tag}, Python={project}, Rust={crate}")
+          PY
+      - name: Build portable Linux wheels
+        uses: PyO3/maturin-action@v1
+        with:
+          target: x86_64
+          manylinux: "2_28"
+          before-script: dnf install -y cmake
+          args: --release --locked --out dist --interpreter python3.10 python3.11 python3.12 python3.13 python3.14 python3.15
+      - uses: actions/upload-artifact@v7
+        with:
+          name: release-wheels
+          path: dist/*.whl
+          if-no-files-found: error
+
+  smoke:
+    needs: wheels
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    strategy:
+      fail-fast: false
+      matrix:
+        python: ["3.10", "3.11", "3.12", "3.13", "3.14", "3.15"]
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
+        with:
+          python-version: ${{ matrix.python }}
+          allow-prereleases: ${{ matrix.python == '3.15' }}
+      - uses: actions/download-artifact@v8
+        with:
+          name: release-wheels
+          path: dist
+      - name: Install built wheel
+        run: |
+          python -m pip install --only-binary=:all: --no-index --no-deps --find-links dist proxyprobe
+      - name: Install runtime dependencies
+        run: python -m pip install "rsloop>=0.1.56"
+      - name: Test installed wheel
+        run: python -m unittest discover -s tests -v
+
+  release:
+    if: startsWith(github.ref, 'refs/tags/')
+    needs: [wheels, smoke]
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/download-artifact@v8
+        with:
+          name: release-wheels
+          path: dist
+      - name: Create release and upload wheels
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+          RELEASE_TAG: ${{ github.ref_name }}
+        run: |
+          if ! gh release view "$RELEASE_TAG" >/dev/null 2>&1; then
+            gh release create "$RELEASE_TAG" --verify-tag --generate-notes
+          fi
+          gh release upload "$RELEASE_TAG" dist/*.whl --clobber