CI: skip win_arm64 for tests, add final publish block

Author: evgenii

.github/workflows/wheels.yml

@@ -100,7 +100,7 @@ jobs:
         # Note: M1 images on Github Actions start from macOS 14
         - [macos-14, macosx_arm64]
         - [windows-2022, win_amd64]
-        - [windows-11-arm, win_arm64]
+        # - [windows-11-arm, win_arm64]
         # TODO: support PyPy?
         python: [["cp310", "3.10"], ["cp311", "3.11"], ["cp312", "3.12"], ["cp313", "3.13"], ["cp313t", "3.13"]]
         include:
@@ -110,12 +110,13 @@ jobs:
         - buildplat: [ubuntu-24.04, pyodide_wasm32]
           python: ["cp312", "3.12"]
           cibw_build_frontend: 'build'
-        exclude:
-          - buildplat: [windows-11-arm, win_arm64]
-            python: ["cp310", "3.10"]
-        # BackendUnavailable: Cannot import 'mesonpy'
-          - buildplat: [windows-11-arm, win_arm64]
-            python: ["cp313t", "3.13"]
+        # TEMP: exclude block no longer needed when win_arm64 is commented
+        # exclude:
+        #   - buildplat: [windows-11-arm, win_arm64]
+        #     python: ["cp310", "3.10"]
+        # # BackendUnavailable: Cannot import 'mesonpy'
+        #   - buildplat: [windows-11-arm, win_arm64]
+        #     python: ["cp313t", "3.13"]
 
     env:
       IS_PUSH: ${{ github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v') }}
@@ -219,3 +220,53 @@ jobs:
           source ci/upload_wheels.sh
           set_upload_vars
           upload_wheels
+
+  publish:
+    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
+    needs:
+      - build_sdist
+      - build_wheels
+    runs-on: ubuntu-latest
+
+    # ---------- current TEST settings ----------
+    environment:
+      name: testpypi                # keep while testing
+    # ---------- FINAL settings (uncomment) ----------
+    # environment:
+    #   name: pypi                  # ← enable for PyPI
+
+    permissions:
+      id-token: write               # OIDC token for Trusted Publishing
+      contents: read
+
+    steps:
+      # 1. Pull every artifact produced by the two upstream jobs
+      - name: Download all artifacts
+        uses: actions/download-artifact@v4
+        with:
+          path: dist                # all files land in ./dist/**
+
+      # 2. Move wheels & sdist into a flat 'upload' dir (skip Pyodide wheels)
+      - name: Collect files
+        run: |
+          mkdir -p upload
+          # skip anything containing 'pyodide' in the filename
+          find dist -name '*pyodide*.whl' -prune -o \
+                    -name '*.whl'   -exec mv {} upload/ \;
+          find dist -name '*.tar.gz' -exec mv {} upload/ \;
+
+      # 3. Publish to TestPyPI using Trusted Publishing
+      - name: Publish to TestPyPI (Trusted Publishing)
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          repository-url: https://test.pypi.org/legacy/   # test endpoint
+          packages-dir: upload
+          skip-existing: true
+
+      # ---------- FINAL publish block (uncomment, remove test one above) ----------
+      # - name: Publish to PyPI (Trusted Publishing)      # ← enable for PyPI
+      #   uses: pypa/gh-action-pypi-publish@release/v1
+      #   with:
+      #     repository-url: https://upload.pypi.org/legacy/  # ← production endpoint
+      #     packages-dir: upload
+      #     # skip-existing: true    # ← remove for production