awscrt: add build-awscrt.yml for riscv64 wheels

[luhenry]

Adds .github/workflows/build-awscrt.yml, building riscv64 wheels for awscrt (aws-crt-python) 0.36.2.

Shape

Build-from-checkout with cibuildwheel. awscrt vendors the whole AWS Common Runtime C stack as submodules (crt/aws-c-*, crt/aws-checksums, crt/aws-lc, crt/s2n) and setup.py's build_ext runs CMake over crt/ before compiling _awscrt, so the only riscv64-specific setting is CIBW_MANYLINUX_RISCV64_IMAGE. AWS-LC enumerates riscv64 in its CMakeLists.txt (elseif(CMAKE_SYSTEM_PROCESSOR_LOWER STREQUAL "riscv64") set(ARCH "riscv64")) and defines no CRYPTO_ARCH_SOURCES for it, so it falls back to portable C — the only two files in the tree that mention OPENSSL_RISCV64 are include/openssl/target.h and crypto/rand_extra/getrandom_fillin.h. crt/CMakeLists.txt already passes -DDISABLE_GO=ON -DDISABLE_PERL=ON -DBUILD_TESTING=OFF to AWS-LC, so none of the usual manylinux host-tooling gaps apply.

Upstream's release script (continuous-delivery/build-wheels-manylinux2014-aarch64.sh) stamps the version first: awscrt/__init__.py carries a 1.0.0.dev0 placeholder in git and setup.py's _load_version() reads it, so without continuous-delivery/update-version.py every wheel is named awscrt-1.0.0.dev0. The workflow runs that same script and greps the result against the requested tag, so a bad git describe fails in seconds instead of after the build.

Matrix

setup.py picks the wheel tag from the interpreter it runs on (a bdist_wheel subclass plus py_limited_api computed in awscrt_ext()), so the matrix is over build interpreters and the tag is what falls out. Each abi3 wheel is built on the oldest interpreter its tag claims and only re-tested on the next one via find_compatible_wheel — awscrt defines PY_SSIZE_T_CLEAN and parses "s#"/"z#" in about forty places, which is precisely the shape that makes the build interpreter load-bearing for an abi3 wheel, so cp311 is in the matrix despite our cp312 floor. That is also exactly what upstream builds (cp311 and cp313, not cp312 and cp313); cp39/cp310 are dropped as below our floor.

job	CIBW_BUILD	wheel tag	why
1	cp311-… cp312-…	cp311-abi3	3.11 is the first stable ABI with everything awscrt needs
2	cp313-… cp314-…	cp313-abi3	3.13 dropped PyWeakref_GetObject(), so upstream cuts a second stable-ABI wheel
3	cp314t-…	cp314-cp314t	free-threaded builds cannot use the limited API

The two abi3 tags have to live in separate jobs: put cp313 in job 1 and find_compatible_wheel reuses the cp311-abi3 wheel for it, and no cp313-abi3 wheel is ever produced.

Tests

Upstream's .builder/actions/aws_crt_python.py runs python -m unittest discover --verbose with AWS_TEST_LOCALHOST=1, so that is what CIBW_TEST_COMMAND/CIBW_TEST_ENVIRONMENT do here. Test requirements are the two testing entries from upstream's dev extra (websockets>=13.1, h2==4.1.0); the rest of that extra is Sphinx/autopep8/build tooling. websockets publishes riscv64 wheels on PyPI for cp311 through cp314t and h2 is pure Python, so nothing has to compile from sdist.

CIBW_TEST_SOURCES stages test crt/aws-c-http/tests/mock_server crt/aws-c-http/tests/resources. The h2 mock-server tests in test_http_client.py/test_aiohttp_client.py spawn test/../crt/aws-c-http/tests/mock_server/h2tls_mock_server.py, which in turn loads ../resources/unittests.crt|key, and test-sources preserves each staged path relative to the project root so those __file__-relative lookups keep resolving. Staging test/ on its own is also what stops the checkout's awscrt/ package at the repo root from shadowing the installed wheel — note the sdist prunes crt/aws-c-http/tests, so this only works because we build from a checkout with submodules.

Dry-ran the test phase against the released 0.36.2 PyPI wheel on macOS/arm64 the way test-sources stages it: 499 tests, 250 skipped, no failures. Without the mock-server directories staged, 10 tests error in setUp with AttributeError: 'NoneType' object has no attribute 'decode' (the server never starts and _wait_for_server_ready mishandles the missing pipes) — that is how the staged path list was arrived at. The 250 skips are the tests gated on AWS credentials and IoT/proxy endpoints (AWS_TEST_S3, AWS_TEST_MQTT311_*, AWS_TEST_HTTP_PROXY_*, …), which upstream also only runs with its CI role assumed.

CIBW_AUDIT_COMMAND: ''

cibuildwheel's default audit, abi3audit --strict --report {abi3_wheel}, fails both abi3 wheels with "17 ABI violations". The 17 are awscrt's own helpers declared in source/module.h — PyErr_AwsLastError, PyObject_GetAttrAsBool, PyUnicode_FromAwsString, PyObject_GetAsOptionalUint64, … — which are Py-prefixed but are not CPython API; abi3audit matches on the name. They are defined in _awscrt.abi3.so (st_shndx points at a real section, not UND), not imported from libpython, and abi3audit reports is_abi3_baseline_compatible: true / baseline: 3.11 in the same breath. Running abi3audit on upstream's released awscrt-0.36.2-cp311-abi3-manylinux2014_aarch64.whl gives the identical 17 symbols and exits 1 both with and without --strict, so there is nothing riscv64-specific here and no exit code to relax. auditwheel repair still runs.

Licensing

The wheel ships LICENSE and NOTICE in dist-info/licenses/ already. Nothing else was needed: AWS-LC, s2n-tls and every aws-c-* library are Amazon-owned and Apache-2.0 (AWS-LC additionally ISC, for its BoringSSL/OpenSSL heritage, reproduced in full in crt/aws-lc/LICENSE), and awscrt's own NOTICE already carries the one non-Amazon attribution that is compiled in (xxHash, BSD-2-Clause).

Validation

• python -c "import yaml; yaml.safe_load(...)" and actionlint clean apart from the usual label "ubuntu-24.04-riscv" is unknown.
• CMake configure of crt/aws-lc under --platform linux/riscv64 in quay.io/pypa/manylinux_2_39_riscv64: configure and generate both succeed with the image's CMake 4.4.2 (well past every cmake_minimum_required in the vendored tree) and GCC 14.3.1, and arch detection lands on riscv64.
• First CI run: cp314t went green on the real runner with 499 tests, 248 skipped, no failures, 14 minutes end to end including the full AWS-LC/s2n/aws-c-* compile — so the C stack itself needed nothing. The two abi3 jobs failed only on the abi3audit and version issues described above.

CI (run 33036859139)

All three jobs green, and every wheel is exercised on both interpreters its tag covers — 499 tests, 248 skipped, no failures, five times over:

job	built on	wheel	also tested on
cp311-abi3	cp311, 13 min	awscrt-0.36.2-cp311-abi3-manylinux_2_38_riscv64.manylinux_2_39_riscv64.whl	cp312 (Found previously built wheel …, that's compatible with cp312-manylinux_riscv64)
cp313-abi3	cp313, 13 min	awscrt-0.36.2-cp313-abi3-manylinux_2_38_riscv64.manylinux_2_39_riscv64.whl	cp314
cp314-cp314t	cp314t, 14 min	awscrt-0.36.2-cp314-cp314t-manylinux_2_38_riscv64.manylinux_2_39_riscv64.whl	—

Each wheel carries a real _awscrt extension (9.7–10.0 MB .so, statically linked against -laws-c-s3 -laws-c-mqtt -laws-c-auth -laws-c-http -laws-c-event-stream -laws-c-compression -laws-checksums -laws-c-io -laws-c-cal -laws-c-sdkutils -laws-c-common -ls2n -lcrypto), asserted by the Check wheel contains the compiled extension step. The publish job dry-ran cleanly: Dry run (not on main branch — no upload will happen) / Would upload 3 file(s).