Publish ARM Linux wheels (#3909)

* `python-packaging`: rm `continue-on-error: true` from Test PyPI publish

That was masking failures to upload to test.pypi.org (due to 10GB space quota being full), e.g. https://github.com/single-cell-data/TileDB-SOMA/actions/runs/13913129586/job/38931629454

* Publish manylinux aarch64 wheels

* Audit/Factor `cibuildwheel` env vars

* rm unused `cc`/`cxx` smoke-test matrix vars

* add 3.9 smoke-test jobs

* rm unused `CIBW_BEFORE_BUILD` hook

Author: ryan-williams

.github/workflows/python-packaging.yml

@@ -51,11 +51,17 @@ jobs:
     strategy:
       matrix:
         python-version: [ '39', '310', '311', '312', '313' ]
-        cibw_build: [ manylinux_x86_64, macosx_x86_64, macosx_arm64 ]
+        cibw_build: [ manylinux_x86_64, manylinux_aarch64, macosx_x86_64, macosx_arm64 ]
         include:
           - cibw_build: manylinux_x86_64
             os: ubuntu-24.04
-            wheel-name: manylinux_2_28
+            wheel-name: manylinux_2_28-x86_64
+          - cibw_build: manylinux_aarch64
+            os: ubuntu-24.04-arm
+            wheel-name: manylinux_2_28-aarch64
+            CIBW_BEFORE_BUILD_LINUX: dnf install -y ninja-build perl-IPC-Cmd zip
+            # vcpkg source build requires this on ARM, for some reason; cf. https://github.com/NixOS/nixpkgs/issues/335868
+            CIBW_ENVIRONMENT_LINUX: VCPKG_FORCE_SYSTEM_BINARIES=1
           - cibw_build: macosx_x86_64
             os: macos-latest
             cibw_archs_macos: x86_64
@@ -90,27 +96,18 @@ jobs:
         with:
           xcode-version: '15.4'
       - name: Build wheels
-        uses: pypa/cibuildwheel@v2.22.0
+        uses: pypa/cibuildwheel@v2.23.2
         with:
           package-dir: tiledbsoma.tar.gz
           only: cp${{ matrix.python-version }}-${{ matrix.cibw_build }}
         env:
-          CIBW_BUILD: ${{ matrix.cibw_build }}
           CIBW_BUILD_VERBOSITY: 1
-          CIBW_MANYLINUX_X86_64_IMAGE: manylinux_2_28
-          CIBW_BEFORE_BUILD_LINUX: yum -y remove gcc-toolset-12\*; yum -y install gcc-toolset-13; bash -x -c 'rm -rf tiledbsoma*/dist_links/dist/lib*'
-          # ^ Delete lib folder that apis/python/setup.py:find_or_build() looks for in deciding to
-          #   run CMake build or not. Otherwise it'll keep reusing the library file built in the
-          #   first iteration of cibuildwheel's outer loop, resulting in wheels with the library
-          #   built for the wrong python version.
-          CIBW_BEFORE_BUILD: bash -x -c 'rm -rf tiledbsoma*/dist_links/dist/lib*'
-          # ^ Delete lib folder that apis/python/setup.py:find_or_build() looks for in deciding to
-          #   run CMake build or not. Otherwise it'll keep reusing the library file built in the
-          #   first iteration of cibuildwheel's outer loop, resulting in wheels with the library
-          #   built for the wrong python version.
+          CIBW_BEFORE_BUILD_LINUX: ${{ matrix.CIBW_BEFORE_BUILD_LINUX || '' }}
+          CIBW_ENVIRONMENT_LINUX: ${{ matrix.CIBW_ENVIRONMENT_LINUX || '' }}
+          # Most recent tags with no listed security issues at https://quay.io/repository/pypa/manylinux_2_28_aarch64?tab=tags, ca. 2025-04-03
+          CIBW_MANYLINUX_X86_64_IMAGE: quay.io/pypa/manylinux_2_28_x86_64:2025.03.22-2
+          CIBW_MANYLINUX_AARCH64_IMAGE: quay.io/pypa/manylinux_2_28_aarch64:2025.03.22-2
           CIBW_ARCHS_MACOS: ${{ matrix.cibw_archs_macos }}
-          CIBW_ENVIRONMENT_LINUX : CC=/opt/rh/gcc-toolset-13/root/usr/bin/gcc CXX=/opt/rh/gcc-toolset-13/root/usr/bin/g++
-          CIBW_TEST_SKIP: "*_arm64"
           CMAKE_OSX_ARCHITECTURES: ${{ matrix.cibw_archs_macos }}
           MACOSX_DEPLOYMENT_TARGET: "13.3"
 
@@ -128,6 +125,8 @@ jobs:
     strategy:
       matrix:
         python:
+          - undotted-version: '39'
+            dotted-version: '3.9'
           - undotted-version: '310'
             dotted-version: '3.10'
           - undotted-version: '311'
@@ -137,25 +136,23 @@ jobs:
           - undotted-version: '313'
             dotted-version: '3.13'
         wheel-name:
-          - manylinux_2_28
+          - manylinux_2_28-x86_64
+          - manylinux_2_28-aarch64
           - macos-x86_64
           - macos-arm64
         include:
-          - wheel-name: manylinux_2_28
+          - wheel-name: manylinux_2_28-x86_64
             os: ubuntu-24.04
             arch: x86_64
-            cc: gcc-13
-            cxx: g++-13
+          - wheel-name: manylinux_2_28-aarch64
+            os: ubuntu-24.04-arm
+            arch: aarch64
           - wheel-name: macos-x86_64
             os: macos-13
             arch: x86_64
-            cc: clang
-            cxx: clang++
           - wheel-name: macos-arm64
             os: macos-14
             arch: arm64
-            cc: clang
-            cxx: clang++
       fail-fast: false
     steps:
       - name: Set up Python ${{ matrix.python.dotted-version }}
@@ -211,7 +208,6 @@ jobs:
           ls -l dist
       - name: Publish packages to TestPyPI
         uses: pypa/gh-action-pypi-publish@release/v1
-        continue-on-error: true
         with:
           repository-url: https://test.pypi.org/legacy/
           packages_dir: dist