actions: publish-wheels: support publishing GPL sources

Publish GPL sources alongside our wheels if they're present so we can be
license compliant.

AI-Generated: Uses Claude Sonnet 5

Signed-off-by: Trevor Gamblin <tgamblin@baylibre.com>

Author: threexc

actions/publish-wheels/action.yml

@@ -57,6 +57,35 @@ inputs:
     required: false
     default: ''
 
+  gpl-sources-artifact:
+    description: >
+      Name of an artifact (produced by an earlier job in the caller workflow)
+      containing a gpl-sources.tar file with bundled GPL source packages
+      (e.g. a manylinux toolchain's src.rpm, collected via
+      collect-gpl-sources). When set, it is downloaded, published
+      as an asset on the GitHub Release named by gpl-sources-release-tag,
+      and linked in the docs PR opened by update_doc.py. Leave empty to skip
+      GPL sources publishing entirely.
+    required: false
+    default: ''
+
+  gpl-sources-release-tag:
+    description: >
+      Git tag for the GitHub Release that hosts the gpl-sources-artifact
+      asset, e.g. "numpy-v2.5.1". Required when gpl-sources-artifact is set;
+      the release is created if it doesn't already exist.
+    required: false
+    default: ''
+
+  gpl-sources-description:
+    description: >
+      Short parenthetical describing what's bundled in the GPL sources
+      artifact, e.g. "gcc". Rendered in the docs comment as
+      "... bundled GPL libraries (gcc)". Only used when gpl-sources-artifact
+      is set.
+    required: false
+    default: ''
+
 runs:
   using: 'composite'
   steps:
@@ -83,6 +112,40 @@ runs:
         skip-existing: ${{ inputs.skip-existing }}
         twine-version: ${{ inputs.twine-version }}
 
+    - name: Download GPL sources artifact
+      if: inputs.gpl-sources-artifact != ''
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
+      with:
+        name: ${{ inputs.gpl-sources-artifact }}
+        path: gpl-sources
+
+    - name: Publish GPL sources as a GitHub Release asset
+      if: inputs.gpl-sources-artifact != ''
+      shell: bash
+      env:
+        GH_TOKEN: ${{ inputs.gh-token }}
+      run: |
+        set -euo pipefail
+
+        tag="${{ inputs.gpl-sources-release-tag }}"
+        if [[ -z "$tag" ]]; then
+          echo "::error::gpl-sources-release-tag must be set when gpl-sources-artifact is used."
+          exit 1
+        fi
+
+        asset="gpl-sources/gpl-sources.tar"
+
+        if gh release view "$tag" --repo "${{ github.repository }}" >/dev/null 2>&1; then
+          gh release upload "$tag" "$asset" --repo "${{ github.repository }}" --clobber
+        else
+          gh release create "$tag" "$asset" \
+            --repo "${{ github.repository }}" \
+            --title "$tag" \
+            --notes "Bundled GPL source packages for $tag."
+        fi
+
+        echo "GPL_SOURCES_URL=https://github.com/${{ github.repository }}/releases/download/$tag/gpl-sources.tar" >> "$GITHUB_ENV"
+
     - uses: actions/setup-python@v5
       with:
         python-version: '3'
@@ -96,4 +159,6 @@ runs:
       env:
         GH_TOKEN: ${{ inputs.gh-token }}
         ARTIFACTS_PATH: ${{ inputs.artifact-path }}
+        GPL_SOURCES_URL: ${{ env.GPL_SOURCES_URL }}
+        GPL_SOURCES_DESCRIPTION: ${{ inputs.gpl-sources-description }}
       run: python3 ci_scripts/update_doc.py