pycryptodome: add build-pycryptodome.yml for riscv64 wheels (#358)

pycryptodome ships no riscv64 wheels on PyPI. Mirror upstream's
wheels.yml (cibuildwheel from a tag checkout, `python -m Crypto.SelfTest
--skip-slow-tests`), narrowed to manylinux_riscv64.

setup.py sets bdist_wheel's py_limited_api to cp37 unless the
interpreter is free-threaded, so the matrix collapses to one cp37-abi3
wheel (built on cp312, re-tested on cp313/cp314) plus cp314t.

Author: luhenry

.github/workflows/build-pycryptodome.yml

@@ -0,0 +1,109 @@
+# SPDX-FileCopyrightText: 2026 The RISE Project
+# SPDX-License-Identifier: MIT
+---
+# Based on upstream's wheel builder:
+#   https://github.com/Legrandin/pycryptodome/blob/v3.23.0/.github/workflows/wheels.yml
+name: Build pycryptodome wheels (riscv64)
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'pycryptodome version to build (git tag without leading v, e.g. 3.23.0)'
+        required: true
+        default: '3.23.0'
+  pull_request:
+    paths:
+      - '.github/workflows/build-pycryptodome.yml'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ inputs.version || '3.23.0' }}-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read  # to fetch code (actions/checkout)
+
+env:
+  PYCRYPTODOME_VERSION: ${{ inputs.version || '3.23.0' }}
+  MANYLINUX_RISCV64_IMAGE: quay.io/pypa/manylinux_2_39_riscv64
+  # Upstream's requirements-test.txt; without it SelfTest skips its Wycheproof vectors.
+  TEST_REQUIRES: pycryptodome-test-vectors==1.0.22
+  TEST_COMMAND: python -m Crypto.SelfTest --skip-slow-tests
+
+jobs:
+  # setup.py passes py_limited_api=cp37 to bdist_wheel, so one wheel covers every
+  # non-free-threaded CPython; cibuildwheel builds it on cp312 and re-tests it on
+  # cp313/cp314 (find_compatible_wheel).
+  build_abi3:
+    name: Build pycryptodome ${{ inputs.version || '3.23.0' }} cp37-abi3-manylinux_riscv64
+    runs-on: ubuntu-24.04-riscv
+    timeout-minutes: 180
+
+    steps:
+      - name: Checkout pycryptodome v${{ env.PYCRYPTODOME_VERSION }}
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        with:
+          repository: Legrandin/pycryptodome
+          ref: v${{ env.PYCRYPTODOME_VERSION }}
+          persist-credentials: false
+
+      - uses: pypa/cibuildwheel@1828c10ab37f080699c7b81cea34097c684a7074  # v4.2.0
+        env:
+          CIBW_ARCHS: riscv64
+          CIBW_BUILD: cp312-manylinux_riscv64 cp313-manylinux_riscv64 cp314-manylinux_riscv64
+          CIBW_MANYLINUX_RISCV64_IMAGE: ${{ env.MANYLINUX_RISCV64_IMAGE }}
+          CIBW_TEST_REQUIRES: ${{ env.TEST_REQUIRES }}
+          CIBW_TEST_COMMAND: ${{ env.TEST_COMMAND }}
+
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+        with:
+          name: pycryptodome-${{ env.PYCRYPTODOME_VERSION }}-cp37-abi3-manylinux_riscv64
+          path: ./wheelhouse/*.whl
+          if-no-files-found: error
+
+  # Free-threaded builds get no abi3 wheel (setup.py skips py_limited_api under
+  # Py_GIL_DISABLED); cp314t is the only free-threaded interpreter in the image.
+  build_freethreaded:
+    name: Build pycryptodome ${{ inputs.version || '3.23.0' }} cp314t-manylinux_riscv64
+    runs-on: ubuntu-24.04-riscv
+    timeout-minutes: 180
+
+    steps:
+      - name: Checkout pycryptodome v${{ env.PYCRYPTODOME_VERSION }}
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        with:
+          repository: Legrandin/pycryptodome
+          ref: v${{ env.PYCRYPTODOME_VERSION }}
+          persist-credentials: false
+
+      - uses: pypa/cibuildwheel@1828c10ab37f080699c7b81cea34097c684a7074  # v4.2.0
+        env:
+          CIBW_ARCHS: riscv64
+          CIBW_BUILD: cp314t-manylinux_riscv64
+          CIBW_MANYLINUX_RISCV64_IMAGE: ${{ env.MANYLINUX_RISCV64_IMAGE }}
+          CIBW_TEST_REQUIRES: ${{ env.TEST_REQUIRES }}
+          CIBW_TEST_COMMAND: ${{ env.TEST_COMMAND }}
+
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+        with:
+          name: pycryptodome-${{ env.PYCRYPTODOME_VERSION }}-cp314t-manylinux_riscv64
+          path: ./wheelhouse/*.whl
+          if-no-files-found: error
+
+  publish:
+    name: Publish pycryptodome ${{ inputs.version || '3.23.0' }} to GitLab
+    needs: [build_abi3, build_freethreaded]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+
+    steps:
+      - name: Publish wheels and open docs PR
+        uses: riseproject-dev/python-wheels/actions/publish-wheels@main
+        with:
+          artifact-pattern: pycryptodome-${{ env.PYCRYPTODOME_VERSION }}-*-manylinux_riscv64
+          gitlab-username: ${{ vars.GITLAB_DEPLOY_USER }}
+          gitlab-token: ${{ secrets.GITLAB_DEPLOY_TOKEN }}
+          gitlab-project-id: ${{ vars.GITLAB_PROJECT_ID }}
+          gh-token: ${{ secrets.GITHUB_TOKEN }}