@@ -0,0 +1,190 @@
+# pythonocc-core wheels for PyPI: Linux x86_64/aarch64, macOS x86_64/arm64,
+# Windows AMD64, for CPython 3.10 to 3.14, plus the sdist.
+#
+# For each platform, a first job builds the native dependencies (SWIG, OCCT
+# and its 3rd parties) with the scripts of ci/wheels/deps/ and saves them to
+# the GitHub cache, then one job per Python version restores them and runs
+# cibuildwheel (configured in pyproject.toml). Pushing a tag also uploads
+# the wheels and the sdist to PyPI, through trusted publishing.
+
+name: Wheels
+
+on:
+  push:
+    branches: ["master", "review/**"]
+    # the paths filter does not apply to the tags
+    tags: ["*"]
+    paths:
+      - pyproject.toml
+      - CMakeLists.txt
+      - ci/wheels/**
+      - .github/workflows/wheels.yml
+  pull_request:
+    paths:
+      - pyproject.toml
+      - CMakeLists.txt
+      - ci/wheels/**
+      - .github/workflows/wheels.yml
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  deps:
+    name: "${{ matrix.platform.name }}: dependencies"
+    runs-on: ${{ matrix.platform.os }}
+    timeout-minutes: 360
+    strategy:
+      fail-fast: false
+      matrix:
+        platform: &platforms
+          # deps_path: the Linux tarball directory (mounted at /host in the
+          # manylinux container), the macOS/Windows install prefix. The
+          # prefix must be the same in the deps and wheels jobs.
+          - name: linux-x86_64
+            os: ubuntu-24.04
+            manylinux: quay.io/pypa/manylinux_2_28_x86_64
+            deps_path: /home/runner/pyocc-deps-cache
+            deps_files: ci/wheels/deps/linux.sh
+          - name: linux-aarch64
+            os: ubuntu-24.04-arm
+            manylinux: quay.io/pypa/manylinux_2_28_aarch64
+            deps_path: /home/runner/pyocc-deps-cache
+            deps_files: ci/wheels/deps/linux.sh
+          - name: macos-x86_64
+            os: macos-15-intel
+            arch: x86_64
+            deps_path: /Users/runner/pyocc-deps
+            deps_files: ci/wheels/deps/macos.sh ci/wheels/triplets/x64-osx-pyocc.cmake
+          - name: macos-arm64
+            os: macos-15
+            arch: arm64
+            deps_path: /Users/runner/pyocc-deps
+            deps_files: ci/wheels/deps/macos.sh ci/wheels/triplets/arm64-osx-pyocc.cmake
+          - name: windows-AMD64
+            os: windows-2022
+            arch: AMD64
+            deps_path: C:/pyocc-deps
+            deps_files: ci/wheels/deps/windows.ps1 ci/wheels/triplets/x64-windows-pyocc.cmake
+    steps:
+      - uses: actions/checkout@v7
+
+      - id: key
+        name: Dependencies cache key
+        shell: bash
+        run: |
+          set -eu
+          # bump DEPS_CACHE_VERSION to invalidate the caches
+          DEPS_CACHE_VERSION=1
+          HASH=$(cat ${{ matrix.platform.deps_files }} | sha256sum | cut -c1-16)
+          echo "key=pyocc-deps-${{ matrix.platform.name }}-${DEPS_CACHE_VERSION}-${HASH}" >> "$GITHUB_OUTPUT"
+
+      - id: cache
+        uses: actions/cache@v6
+        with:
+          path: ${{ matrix.platform.deps_path }}
+          key: ${{ steps.key.outputs.key }}
+
+      - name: Build SWIG and OCCT (manylinux container)
+        if: steps.cache.outputs.cache-hit != 'true' && runner.os == 'Linux'
+        run: |
+          set -eux
+          mkdir -p "${{ matrix.platform.deps_path }}"
+          docker run --rm \
+            -v "$GITHUB_WORKSPACE:/project" \
+            -v "${{ matrix.platform.deps_path }}:/deps-cache" \
+            -e PYOCC_DEPS_CACHE=/deps-cache \
+            ${{ matrix.platform.manylinux }} \
+            bash /project/ci/wheels/deps/linux.sh
+
+      - name: Build SWIG and OCCT
+        if: steps.cache.outputs.cache-hit != 'true' && runner.os == 'macOS'
+        run: bash ci/wheels/deps/macos.sh
+        env:
+          ARCH: ${{ matrix.platform.arch }}
+          PYOCC_DEPS_PREFIX: ${{ matrix.platform.deps_path }}
+
+      - name: Build OCCT
+        if: steps.cache.outputs.cache-hit != 'true' && runner.os == 'Windows'
+        run: ./ci/wheels/deps/windows.ps1
+        shell: pwsh
+        env:
+          PYOCC_DEPS_PREFIX: ${{ matrix.platform.deps_path }}
+
+  wheels:
+    name: "${{ matrix.platform.name }}: ${{ matrix.python }}"
+    needs: deps
+    runs-on: ${{ matrix.platform.os }}
+    timeout-minutes: 360
+    strategy:
+      fail-fast: false
+      matrix:
+        platform: *platforms
+        python: [cp310, cp311, cp312, cp313, cp314]
+    steps:
+      - uses: actions/checkout@v7
+
+      - id: key
+        name: Dependencies cache key
+        shell: bash
+        run: |
+          set -eu
+          # must match the deps job
+          DEPS_CACHE_VERSION=1
+          HASH=$(cat ${{ matrix.platform.deps_files }} | sha256sum | cut -c1-16)
+          echo "key=pyocc-deps-${{ matrix.platform.name }}-${DEPS_CACHE_VERSION}-${HASH}" >> "$GITHUB_OUTPUT"
+
+      - uses: actions/cache/restore@v6
+        with:
+          path: ${{ matrix.platform.deps_path }}
+          key: ${{ steps.key.outputs.key }}
+          fail-on-cache-miss: true
+
+      - uses: pypa/cibuildwheel@v4.2.1
+        env:
+          CIBW_BUILD: ${{ matrix.python }}-*
+          CIBW_ARCHS_MACOS: ${{ matrix.platform.arch }}
+          # Linux: the host filesystem is mounted at /host in the container
+          PYOCC_DEPS_CACHE: /host${{ matrix.platform.deps_path }}
+          PYOCC_DEPS_PREFIX: ${{ matrix.platform.deps_path }}
+
+      - uses: actions/upload-artifact@v7
+        with:
+          name: wheels-${{ matrix.platform.name }}-${{ matrix.python }}
+          path: wheelhouse/*.whl
+
+  sdist:
+    name: Source distribution
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v7
+      - run: pipx run build --sdist
+      - uses: actions/upload-artifact@v7
+        with:
+          name: sdist
+          path: dist/*.tar.gz
+
+  publish:
+    name: Upload to PyPI
+    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/')
+    needs: [wheels, sdist]
+    runs-on: ubuntu-24.04
+    # the trusted publisher configured on PyPI for this repository, this
+    # workflow and this environment
+    environment:
+      name: pypi
+      url: https://pypi.org/p/pythonocc-core
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@v8
+        with:
+          path: dist
+          merge-multiple: true
+      - run: ls -l dist
+      - uses: pypa/gh-action-pypi-publish@v1.14.2
@@ -67,6 +67,13 @@ if(APPLE)
   set(CMAKE_INSTALL_RPATH_USE_LINK_PATH TRUE)
 endif(APPLE)
 
+if(SKBUILD AND UNIX AND NOT APPLE)
+  # wheel build: keep the OCCT library directory in the RPATH so that the
+  # unrepaired wheel is usable on the build machine. auditwheel replaces it
+  # with the vendored libraries location when repairing the wheel.
+  set(CMAKE_INSTALL_RPATH_USE_LINK_PATH TRUE)
+endif()
+
 #####################################################################
 # OpenGL. If available, enable compilation for Visualization module #
 #####################################################################
@@ -99,7 +106,7 @@ set(Python3_FIND_STRATEGY LOCATION)
 set(Python3_FIND_FRAMEWORK NEVER)
 # numpy is required: the Geom, Geom2d, Poly, TColStd, TColgp and TShort modules
 # use its C API. PYTHONOCC_MESHDS_NUMPY only enables the numpy arrays of MeshDS
-find_package(Python3 COMPONENTS Interpreter Development NumPy REQUIRED)
+find_package(Python3 COMPONENTS Interpreter Development.Module NumPy REQUIRED)
 include_directories(${Python3_NumPy_INCLUDE_DIRS})
 message(STATUS "Numpy include directory: ${Python3_NumPy_INCLUDE_DIRS}")
 if(PYTHONOCC_MESHDS_NUMPY)
@@ -165,7 +172,11 @@ endif()
 # by default, installed to site-packages/OCC #
 ##############################################
 if(NOT DEFINED PYTHONOCC_INSTALL_DIRECTORY)
-    if(DEFINED ENV{SP_DIR} AND WIN32)
+    if(SKBUILD)
+      # wheel build (pip/scikit-build-core): the install prefix is the
+      # wheel platlib directory, install relative to it
+      set(PYTHONOCC_INSTALL_DIRECTORY OCC CACHE PATH "pythonocc install directory")
+    elseif(DEFINED ENV{SP_DIR} AND WIN32)
       # TODO: following hack is azure specific, a recent update in azure
       # prevent cmake to find correct paths of python3 on windows
       # this should be removed as soon as possible
@@ -177,7 +188,7 @@ if(NOT DEFINED PYTHONOCC_INSTALL_DIRECTORY)
     OUTPUT_VARIABLE python_lib
     OUTPUT_STRIP_TRAILING_WHITESPACE)
       set(PYTHONOCC_INSTALL_DIRECTORY ${python_lib}/OCC CACHE PATH "pythonocc install directory")
-    endif(DEFINED ENV{SP_DIR} AND WIN32)
+    endif()
 endif(NOT DEFINED PYTHONOCC_INSTALL_DIRECTORY)
 
 message(STATUS "pythonocc modules will be installed to: ${PYTHONOCC_INSTALL_DIRECTORY}")
@@ -460,7 +471,8 @@ if(PYTHONOCC_WRAP_VISU)
 endif(PYTHONOCC_WRAP_VISU)
 
 # install Display
-install(DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}/src/Display DESTINATION ${PYTHONOCC_INSTALL_DIRECTORY})
+install(DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}/src/Display DESTINATION ${PYTHONOCC_INSTALL_DIRECTORY}
+        PATTERN "__pycache__" EXCLUDE PATTERN ".ruff_cache" EXCLUDE)
 
 # install LICENSE file
 install(FILES ${CMAKE_CURRENT_SOURCE_DIR}/LICENSE DESTINATION ${PYTHONOCC_INSTALL_DIRECTORY})
@@ -477,7 +489,9 @@ install(FILES ${CMAKE_CURRENT_SOURCE_DIR}/src/PkgBase/Exception.py DESTINATION $
 install(FILES ${CMAKE_CURRENT_SOURCE_DIR}/src/PkgBase/py.typed DESTINATION ${PYTHONOCC_INSTALL_DIRECTORY}/Core)
 
 # install Extend
-install(DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}/src/Extend DESTINATION ${PYTHONOCC_INSTALL_DIRECTORY})
+install(DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}/src/Extend DESTINATION ${PYTHONOCC_INSTALL_DIRECTORY}
+        PATTERN "__pycache__" EXCLUDE PATTERN ".ruff_cache" EXCLUDE)
 
 # install Wrapper utils
-install(DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}/src/Wrapper DESTINATION ${PYTHONOCC_INSTALL_DIRECTORY})
+install(DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}/src/Wrapper DESTINATION ${PYTHONOCC_INSTALL_DIRECTORY}
+        PATTERN "__pycache__" EXCLUDE PATTERN ".ruff_cache" EXCLUDE)
@@ -0,0 +1,102 @@
+#!/bin/bash
+# Build the native dependencies of the pythonocc-core Linux wheels (SWIG,
+# OCCT) and install them to $DEPS_PREFIX. Runs as the cibuildwheel
+# "before-all" step, inside the manylinux_2_28 container.
+#
+# If PYOCC_DEPS_CACHE points to a writable directory (on the host, through
+# the /host mount), the installed prefix is saved there as a tarball and
+# reused by the next runs.
+set -euo pipefail
+
+# lowest priority for the whole build (inherited by the child processes), so
+# that the CI runner agent still gets CPU time for its heartbeats: a starved
+# agent is reported as lost
+renice -n 19 $$ > /dev/null
+
+SWIG_VERSION=4.5.1
+OCCT_VERSION=8.0.1
+OCCT_TAG=V8_0_1
+RAPIDJSON_COMMIT=24b5e7a8b27f42fa16b96fc70aade9106cf7102f
+DEPS_PREFIX=${DEPS_PREFIX:-/opt/pyocc-deps}
+
+# bump the last component to invalidate caches when the build options change
+CACHE_KEY="swig-${SWIG_VERSION}_occt-${OCCT_VERSION}_$(uname -m)_2"
+
+# system packages, also needed when the cache is used: X11/OpenGL headers
+# for the visualization toolkits, freetype/fontconfig for text rendering,
+# FreeImage (EPEL) for image files I/O, pcre2 for SWIG
+dnf install -y epel-release
+dnf install -y freetype-devel fontconfig-devel freeimage-devel mesa-libGL-devel libX11-devel pcre2-devel
+
+CACHE_TARBALL=""
+if [ -n "${PYOCC_DEPS_CACHE:-}" ]; then
+  CACHE_TARBALL="${PYOCC_DEPS_CACHE}/pyocc-deps_${CACHE_KEY}.tar.gz"
+  if [ -f "${CACHE_TARBALL}" ]; then
+    echo "Using cached dependencies ${CACHE_TARBALL}"
+    mkdir -p "${DEPS_PREFIX}"
+    tar xzf "${CACHE_TARBALL}" -C "${DEPS_PREFIX}"
+    exit 0
+  fi
+fi
+
+# one compile job per core, but at most one per 3 GB of memory: some OCCT
+# sources need more than 1 GB to compile, the agent is lost when it runs out
+MEM_JOBS=$(awk '/MemTotal/ {print int($2 / (3 * 1024 * 1024))}' /proc/meminfo)
+NPROC=$(nproc)
+if [ "${MEM_JOBS}" -ge 1 ] && [ "${MEM_JOBS}" -lt "${NPROC}" ]; then NPROC=${MEM_JOBS}; fi
+echo "Building with ${NPROC} jobs"
+WORK=$(mktemp -d)
+cd "${WORK}"
+
+# SWIG
+curl -fsSL "https://downloads.sourceforge.net/project/swig/swig/swig-${SWIG_VERSION}/swig-${SWIG_VERSION}.tar.gz" | tar xz
+pushd "swig-${SWIG_VERSION}"
+./configure --prefix="${DEPS_PREFIX}" --without-alllang --with-python3
+make -j"${NPROC}"
+make install
+popd
+
+# RapidJSON (header only, required by the glTF reader/writer)
+curl -fsSL "https://github.com/Tencent/rapidjson/archive/${RAPIDJSON_COMMIT}.tar.gz" | tar xz
+mkdir -p "${DEPS_PREFIX}/include"
+cp -r "rapidjson-${RAPIDJSON_COMMIT}/include/rapidjson" "${DEPS_PREFIX}/include/"
+
+# OCCT
+mkdir occt-src
+curl -fsSL "https://github.com/Open-Cascade-SAS/OCCT/archive/refs/tags/${OCCT_TAG}.tar.gz" | tar xz --strip-components=1 -C occt-src
+cmake -S occt-src -B occt-build -G "Unix Makefiles" \
+  -DCMAKE_BUILD_TYPE=Release \
+  -DINSTALL_DIR="${DEPS_PREFIX}" \
+  -DINSTALL_DIR_LAYOUT=Unix \
+  -DBUILD_LIBRARY_TYPE=Shared \
+  -DBUILD_RELEASE_DISABLE_EXCEPTIONS=OFF \
+  -DBUILD_MODULE_Draw=OFF \
+  -DBUILD_DOC_Overview=OFF \
+  -DUSE_TCL=OFF \
+  -DUSE_TK=OFF \
+  -DUSE_FREETYPE=ON \
+  -DUSE_RAPIDJSON=ON \
+  -D3RDPARTY_RAPIDJSON_INCLUDE_DIR="${DEPS_PREFIX}/include" \
+  -DUSE_FREEIMAGE=ON \
+  -D3RDPARTY_FREEIMAGE_INCLUDE_DIR=/usr/include \
+  -D3RDPARTY_FREEIMAGE_LIBRARY_DIR=/usr/lib64 \
+  -DUSE_DRACO=OFF \
+  -DUSE_TBB=OFF \
+  -DUSE_VTK=OFF \
+  -DUSE_OPENVR=OFF \
+  -DUSE_FFMPEG=OFF
+cmake --build occt-build -j"${NPROC}"
+cmake --install occt-build
+
+# the wheels only need the libraries, headers and cmake config
+rm -rf "${DEPS_PREFIX}/share/doc" "${DEPS_PREFIX}/share/opencascade/samples"
+
+cd /
+rm -rf "${WORK}"
+
+if [ -n "${CACHE_TARBALL}" ]; then
+  mkdir -p "${PYOCC_DEPS_CACHE}"
+  tar czf "${CACHE_TARBALL}.tmp" -C "${DEPS_PREFIX}" .
+  mv "${CACHE_TARBALL}.tmp" "${CACHE_TARBALL}"
+  echo "Saved dependencies to ${CACHE_TARBALL}"
+fi