apache-beam: add build-apache-beam.yml for riscv64 wheels

.github/workflows/build-apache-beam.yml

@@ -0,0 +1,151 @@
+# SPDX-FileCopyrightText: 2026 The RISE Project
+# SPDX-License-Identifier: MIT
+---
+name: Build apache-beam wheels (riscv64)
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'apache-beam version to build (e.g. 2.75.0)'
+        required: true
+        default: '2.75.0'
+  pull_request:
+    paths:
+      - '.github/workflows/build-apache-beam.yml'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ inputs.version || '2.75.0' }}-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read  # to fetch code (actions/checkout)
+
+env:
+  APACHE_BEAM_VERSION: ${{ inputs.version || '2.75.0' }}
+  MANYLINUX_RISCV64_IMAGE: quay.io/pypa/manylinux_2_39_riscv64
+
+jobs:
+  setup:
+    uses: $/.github/workflows/_setup.yml
+
+  python_sdist:
+    needs: [setup]
+    # Mirrors upstream's build_wheels.yml build_source job: build the sdist from
+    # the checkout on x86_64 (grpcio-tools' build-system.requires pin resolves
+    # fine there), then build the riscv64 bdist from that sdist in `linux` below.
+    runs-on: ubuntu-latest
+    outputs:
+      sdist_artifact_name: ${{ steps.build_sdist.outputs.sdist_artifact_name }}
+      package_version: ${{ steps.build_sdist.outputs.package_version }}
+    steps:
+      - name: checkout apache/beam v${{ env.APACHE_BEAM_VERSION }}
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          repository: apache/beam
+          ref: v${{ env.APACHE_BEAM_VERSION }}
+          persist-credentials: false
+
+      - name: setup python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
+        with:
+          python-version: '3.11'
+
+      - name: build sdist
+        id: build_sdist
+        working-directory: sdks/python
+        run: |
+          set -eux
+
+          # MANIFEST.in already lists NOTICE/LICENSE/LICENSE.python, but they
+          # live at the repo root, not sdks/python - upstream's own released
+          # sdist on PyPI ships without them for the same reason.
+          cp ../../LICENSE ../../NOTICE ../../LICENSE.python .
+
+          pip install -U build
+          python -m build --sdist
+
+          sdist_name="$(basename dist/*.tar.gz)"
+          package_version="$(echo "${sdist_name}" | sed -En 's/apache[_-]beam-(.+)\.tar\.gz/\1/p')"
+          {
+            echo "sdist_artifact_name=${sdist_name}"
+            echo "package_version=${package_version}"
+          } >> "$GITHUB_OUTPUT"
+
+      - name: upload sdist artifact
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+        with:
+          name: ${{ steps.build_sdist.outputs.sdist_artifact_name }}
+          path: sdks/python/dist/${{ steps.build_sdist.outputs.sdist_artifact_name }}
+          if-no-files-found: error
+
+  linux:
+    # apache_beam/{coders,metrics,runners,transforms,utils}'s *.pyx/*.py get
+    # cythonized into ~17 small extension modules - no external native
+    # dependency, no CIBW_BEFORE_ALL needed.
+    needs: [setup, python_sdist]
+    name: Build apache-beam ${{ needs.python_sdist.outputs.package_version }} ${{ matrix.python }}-manylinux_riscv64
+    runs-on: ubuntu-24.04-riscv
+    strategy:
+      fail-fast: false
+      matrix:
+        # cp314t dropped: upstream's own build_wheels.yml matrix never builds
+        # it (no free-threading support declared for Beam's Cython extensions).
+        python: ["cp312", "cp313", "cp314"]
+
+    steps:
+    - name: fetch sdist artifact
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
+      with:
+        name: ${{ needs.python_sdist.outputs.sdist_artifact_name }}
+        path: sdist
+
+    - name: setup uv
+      uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d  # v10.0.1
+      with:
+        python-version: '3.12'
+        activate-environment: true
+        enable-cache: false
+
+    - name: build wheel
+      env:
+        CIBW_BUILD: ${{ matrix.python }}-manylinux_riscv64
+        CIBW_MANYLINUX_RISCV64_IMAGE: ${{ env.MANYLINUX_RISCV64_IMAGE }}
+        # pyproject.toml's build-system.requires pins grpcio-tools==1.62.1 (or
+        # 1.71.0 on 3.13+), which has no riscv64 wheel - but it's unused here:
+        # the sdist ships pre-generated apache_beam/portability/api/*_pb2.py
+        # with no .proto sources alongside them, so gen_protos.py's "no proto
+        # files, reuse the existing output" branch never imports grpc_tools.
+        # --no-build-isolation (CLAUDE.md gotcha 76) skips resolving that pin
+        # instead of patching it.
+        CIBW_BUILD_FRONTEND: "pip; args: --no-build-isolation"
+        CIBW_BEFORE_BUILD: >-
+          pip install "cython>=3.2.5,<4" "numpy>=1.14.3,<2.5.0"
+          --config-settings=setup-args="-Dallow-noblas=true" setuptools wheel
+        CIBW_ENVIRONMENT: >-
+          PIP_EXTRA_INDEX_URL=https://pypi.riseproject.dev/simple/
+          PIP_ONLY_BINARY=numpy
+      run: |
+        set -eux
+
+        mkdir apache-beam
+        tar zxf sdist/${{ needs.python_sdist.outputs.sdist_artifact_name }} --strip-components=1 -C apache-beam
+
+        uv pip install --upgrade cibuildwheel
+        python -m cibuildwheel --output-dir dist ./apache-beam
+
+    - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+      with:
+        name: apache-beam-${{ needs.python_sdist.outputs.package_version }}-${{ matrix.python }}-manylinux_riscv64
+        path: ./dist/*.whl
+        if-no-files-found: error
+
+  publish:
+    name: Publish apache-beam ${{ needs.python_sdist.outputs.package_version }}
+    needs: [setup, python_sdist, linux]
+    permissions:
+      contents: write
+      pull-requests: write
+    uses: $/.github/workflows/_publish-wheel.yml
+    with:
+      artifact-pattern: apache-beam-${{ needs.python_sdist.outputs.package_version }}-*-manylinux_riscv64