feat: build windows distributions with cibuildwheel in GH CI

Should avoid maintaining appveyor workflow (and free up appveyor account limitations 😉).

This also introduces windows aarch64 distributions 🎉

Lastly, I updated other spots in the GH actions workflow:

- upgrade `actions/checkout` to v5 (only breaking changes are internal like upgrade node version used for building their dist)
- turn off credential persistence in `actions/checkout` action (only useful if the workflow uses `git push` or similar)
- upgrade `actions/download-artifact` to v5 (only breaking changes are internal because this already uses `merge-multiple: true`)
- add job to check built distributions for non-tagged commits to default branch. This is meant to highlight any problems with dists' metadata before tagging a release.

Author: 2bndy5

.github/workflows/wheels.yml

@@ -7,6 +7,7 @@ on:
     - wheels-*
     tags:
     - 'v*'
+  workflow_dispatch: # REMOVE THIS BEFORE PR
 
 jobs:
   build_wheels:
@@ -21,9 +22,19 @@ jobs:
           os: ubuntu-24.04-arm
         - name: macos
           os: macos-13
+        - name: windows-x64
+          os: windows-latest
+        - name: windows-x32
+          os: windows-latest
+        - name: windows-arm64
+          # https://github.com/actions/partner-runner-images#available-images
+          os: windows-11-arm
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
+        with:
+          # avoid leaking credentials in uploaded artifacts
+          persist-credentials: false
 
       - uses: actions/setup-python@v6
         with:
@@ -33,7 +44,9 @@ jobs:
         run: python -m pip install cibuildwheel~=3.1.1
 
       - name: Build wheels
-        run: python -m cibuildwheel --output-dir wheelhouse
+        run: >-
+          python -m cibuildwheel --output-dir wheelhouse
+          ${{ matrix.name == 'windows-x32' && '--archs=auto32' }}
 
       - uses: actions/upload-artifact@v4
         with:
@@ -45,7 +58,10 @@ jobs:
     runs-on: ubuntu-24.04
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
+        with:
+          # avoid leaking credentials in uploaded artifacts
+          persist-credentials: false
 
       - uses: actions/setup-python@v6
         with:
@@ -69,13 +85,30 @@ jobs:
           name: wheels-linux-ppc
           path: ./wheelhouse/*.whl
 
+  twine-check:
+    name: Twine check
+    # It is good to do this check on non-tagged commits.
+    # Note, pypa/gh-action-pypi-publish (see job below) does this automatically.
+    if: ${{ !startsWith(github.ref, 'refs/tags/v') }}
+    needs: [build_wheels, build_wheels_ppc]
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/download-artifact@v5
+        with:
+          path: dist
+          pattern: wheels-*
+          merge-multiple: true
+      - name: check distribution files
+        run: pipx run twine check dist/*
+
   pypi:
     if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
     needs: [build_wheels, build_wheels_ppc]
     runs-on: ubuntu-24.04
 
     steps:
-    - uses: actions/download-artifact@v4
+    - uses: actions/download-artifact@v5
       with:
         path: dist
         pattern: wheels-*

build.ps1

@@ -0,0 +1,13 @@
+if (Test-Path -Path $env:LIBGIT2_SRC) {
+    Set-Location $env:LIBGIT2_SRC
+    if (Test-Path -Path build) {
+        Remove-Item -Recurse -Force build
+    }
+    git fetch --depth=1 --tags
+    git checkout v$env:LIBGIT2_VERSION
+} else {
+    git clone --depth=1 -b v$env:LIBGIT2_VERSION https://github.com/libgit2/libgit2.git $env:LIBGIT2_SRC
+    Set-Location $env:LIBGIT2_SRC
+}
+cmake -B build -S . -DBUILD_TESTS=OFF
+cmake --build build/ --config=Release --target install

pyproject.toml

@@ -24,6 +24,34 @@ archs = ["universal2"]
 environment = {LIBGIT2_VERSION="1.9.1", LIBSSH2_VERSION="1.11.1", OPENSSL_VERSION="3.3.3", LIBGIT2="/Users/runner/work/pygit2/pygit2/ci"}
 repair-wheel-command = "DYLD_LIBRARY_PATH=/Users/runner/work/pygit2/pygit2/ci/lib delocate-wheel --require-archs {delocate_archs} -w {dest_dir} {wheel}"
 
+[tool.cibuildwheel.windows]
+environment.LIBGIT2_SRC = "build/libgit2_src"
+before-all = "powershell -File build.ps1"
+
+[[tool.cibuildwheel.overrides]]
+select="*-win_amd64"
+inherit.environment="append"
+environment.CMAKE_GENERATOR = "Visual Studio 17 2022"
+environment.CMAKE_GENERATOR_PLATFORM = "x64"
+environment.CMAKE_INSTALL_PREFIX = "C:/libgit2_install_x86_64"
+environment.LIBGIT2 = "C:/libgit2_install_x86_64"
+
+[[tool.cibuildwheel.overrides]]
+select="*-win32"
+inherit.environment="append"
+environment.CMAKE_GENERATOR = "Visual Studio 17 2022"
+environment.CMAKE_GENERATOR_PLATFORM = "Win32"
+environment.CMAKE_INSTALL_PREFIX = "C:/libgit2_install_x86"
+environment.LIBGIT2 = "C:/libgit2_install_x86"
+
+[[tool.cibuildwheel.overrides]]
+select="*-win_arm64"
+inherit.environment="append"
+environment.CMAKE_GENERATOR = "Visual Studio 17 2022"
+environment.CMAKE_GENERATOR_PLATFORM = "ARM64"
+environment.CMAKE_INSTALL_PREFIX = "C:/libgit2_install_arm64"
+environment.LIBGIT2 = "C:/libgit2_install_arm64"
+
 [tool.ruff]
 extend-exclude = [ ".cache", ".coverage", "build", "site-packages", "venv*"]
 target-version = "py310"  # oldest supported Python version