fix: prevent SIGSEGV crash on Homebrew

.github/workflows/distribution-test.yml

@@ -21,20 +21,17 @@ jobs:
             -e TN_ENDPOINT="https://gateway.mainnet.truf.network" \
             sdk-py-dist-test
 
-  test-native-build:
-    name: Test Native Build on ${{ matrix.os }}
-    runs-on: ${{ matrix.os }}
-    strategy:
-      fail-fast: false
-      matrix:
-        os: [ubuntu-latest, macos-latest]
-
+  # Linux dev-install path: builds via setup.py + setup-python, mirrors
+  # what a contributor would run locally with `uv pip install -e .`.
+  test-native-build-linux:
+    name: Test Native Build (Linux)
+    runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
 
       - name: Set up Go
-        uses: actions/setup-go@v4
+        uses: actions/setup-go@v5
         with:
           go-version: '1.24.1'
 
@@ -43,28 +40,67 @@ jobs:
           go install github.com/go-python/gopy@v0.4.10
           go install golang.org/x/tools/cmd/goimports@latest
           echo "$HOME/go/bin" >> $GITHUB_PATH
-        shell: bash
 
-      - name: Install system dependencies (Linux)
-        if: runner.os == 'Linux'
+      - name: Install system dependencies
         run: |
           sudo apt-get update
           sudo apt-get install -y build-essential patchelf
 
       - name: Set up Python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v5
         with:
           python-version: '3.12'
-      
+
       - name: Install uv
         run: curl -LsSf https://astral.sh/uv/install.sh | sh
 
-      - name: Build and Test Natively
+      - name: Build and test natively
         run: |
           export PATH="$HOME/.local/bin:$PATH"
           uv pip install setuptools wheel pybindgen build --system
           make gopy_build
           python -m build --wheel --outdir /tmp/wheelhouse
           uv pip install /tmp/wheelhouse/*.whl --system
           python tests/distribution/get_account_test.py
-        shell: bash
+
+  # macOS PR check uses the same cibuildwheel pipeline as the release
+  # workflow so the wheel under test is structurally identical to what
+  # ships, then loads it under a Homebrew Python to assert
+  # cross-interpreter portability — the property the v0.6.6 SIGSEGV
+  # report showed was missing.
+  test-native-build-macos:
+    name: Test Native Build (macOS arm64)
+    runs-on: macos-14
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: '1.24.1'
+
+      - name: Build wheels with cibuildwheel
+        uses: pypa/cibuildwheel@v2.21.3
+        env:
+          CIBW_BUILD: cp312-macosx_arm64
+          CIBW_ARCHS_MACOS: arm64
+          CIBW_ENVIRONMENT: >
+            CGO_ENABLED=1
+            GOARCH=arm64
+            PATH=$PATH:/usr/local/go/bin:$HOME/go/bin
+            MACOSX_DEPLOYMENT_TARGET=11.0
+          CIBW_BEFORE_ALL_MACOS: |
+            go install github.com/go-python/gopy@v0.4.10
+            go install golang.org/x/tools/cmd/goimports@latest
+          CIBW_BEFORE_BUILD_MACOS: |
+            pip install pybindgen setuptools wheel setuptools-scm
+
+      - name: Verify wheel under Homebrew Python
+        run: |
+          brew install python@3.12
+          BREW_PY=$(brew --prefix python@3.12)/bin/python3.12
+          "$BREW_PY" --version
+          "$BREW_PY" -m venv /tmp/brew-venv
+          /tmp/brew-venv/bin/pip install wheelhouse/*.whl
+          /tmp/brew-venv/bin/python tests/distribution/get_account_test.py

.github/workflows/release-build.yml

@@ -1,88 +1,146 @@
-name: Release · Build & Package Python SDK
-
-on:
-  # Run whenever you push a tag like v1.2.3
-  push:
-    tags:
-      - 'v*.*.*'
-  # Also allow manual re-runs
-  workflow_dispatch:
-
-permissions: write-all
-
-jobs:
-  build:
-    name: Build wheels on ${{ matrix.os }}
-    runs-on: ${{ matrix.os }}
-    strategy:
-      fail-fast: false
-      matrix:
-        os: [ubuntu-latest, macos-latest]
-        python-version: ['3.12']
-
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0  # Fetch all history for setuptools_scm to detect version from git tags
-
-      - name: Set up Go
-        uses: actions/setup-go@v4
-        with:
-          go-version: '1.24.1'
-
-      - name: Install gopy & goimports
-        run: |
-          go install github.com/go-python/gopy@v0.4.10
-          go install golang.org/x/tools/cmd/goimports@latest
-          echo "$HOME/go/bin" >> $GITHUB_PATH
-        shell: bash
-
-      - name: Install system dependencies (Linux)
-        if: runner.os == 'Linux'
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y build-essential
-          export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:.
-
-      - name: Set up Python
-        uses: actions/setup-python@v4
-        with:
-          python-version: ${{ matrix.python-version }}
-
-      - name: Install build tools
-        run: |
-          python3 -m pip install --upgrade pip setuptools wheel pybindgen build setuptools-scm
-
-      - name: Build gopy bindings
-        run: make gopy_build
-        shell: bash
-
-      - name: Build wheels
-        run: python -m build --wheel --outdir wheelhouse
-
-      - name: Upload wheels as artifacts
-        uses: actions/upload-artifact@v4
-        with:
-          name: wheels-${{ matrix.os }}
-          path: wheelhouse/*.whl
-
-  publish:
-    name: Publish Wheels to Release
-    needs: build
-    if: startsWith(github.ref, 'refs/tags/v')
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Download all built wheels
-        uses: actions/download-artifact@v4
-        with:
-          pattern: wheels-*
-          merge-multiple: true
-          path: dist/
-
-      - name: Publish GitHub Release with Wheels
-        uses: softprops/action-gh-release@v2
-        with:
-          files: dist/*.whl
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+name: Release · Build & Package Python SDK
+
+on:
+  # Run whenever you push a tag like v1.2.3
+  push:
+    tags:
+      - 'v*.*.*'
+  # Also allow manual re-runs
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+jobs:
+  build-linux:
+    name: Build Linux wheels
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: '1.24.1'
+
+      - name: Install gopy & goimports
+        run: |
+          go install github.com/go-python/gopy@v0.4.10
+          go install golang.org/x/tools/cmd/goimports@latest
+          echo "$HOME/go/bin" >> $GITHUB_PATH
+        shell: bash
+
+      - name: Install system dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y build-essential patchelf
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+
+      - name: Install build tools
+        run: python3 -m pip install --upgrade pip setuptools wheel pybindgen build setuptools-scm
+
+      - name: Build gopy bindings
+        run: make gopy_build
+
+      - name: Build wheels
+        run: python -m build --wheel --outdir wheelhouse
+
+      - name: Upload wheels
+        uses: actions/upload-artifact@v4
+        with:
+          name: wheels-linux
+          path: wheelhouse/*.whl
+
+  build-macos:
+    name: Build macOS wheels (${{ matrix.arch }})
+    runs-on: ${{ matrix.runs-on }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - arch: arm64
+            runs-on: macos-14
+            goarch: arm64
+          # Uncomment to also publish x86_64 wheels:
+          # - arch: x86_64
+          #   runs-on: macos-13
+          #   goarch: amd64
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: '1.24.1'
+
+      # cibuildwheel uses the python.org installer for the in-wheel Python,
+      # which bakes @rpath-relative libpython install names into the .so —
+      # the property that makes the wheel loadable by Homebrew/conda/uv
+      # interpreters.
+      - name: Build wheels with cibuildwheel
+        uses: pypa/cibuildwheel@v2.21.3
+        env:
+          CIBW_BUILD: cp312-macosx_${{ matrix.arch }}
+          CIBW_ARCHS_MACOS: ${{ matrix.arch }}
+          # CGO must be on for arm64; gopy + goimports must be reachable
+          # inside the build's hermetic env, so we install them in
+          # BEFORE_ALL and forward PATH via CIBW_ENVIRONMENT.
+          CIBW_ENVIRONMENT: >
+            CGO_ENABLED=1
+            GOARCH=${{ matrix.goarch }}
+            PATH=$PATH:/usr/local/go/bin:$HOME/go/bin
+            MACOSX_DEPLOYMENT_TARGET=11.0
+          CIBW_BEFORE_ALL_MACOS: |
+            go install github.com/go-python/gopy@v0.4.10
+            go install golang.org/x/tools/cmd/goimports@latest
+          CIBW_BEFORE_BUILD_MACOS: |
+            pip install pybindgen setuptools wheel setuptools-scm
+
+      # Smoke-test the wheel before publishing: install it into a fresh
+      # interpreter and load the C bindings. Catches packaging breakage
+      # and the SIGSEGV-class regression the PR fixes (the import alone
+      # triggers loading both gopy .so files).
+      - name: Set up Python for wheel smoke test
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+
+      - name: Smoke-test built wheel
+        run: |
+          python -m venv /tmp/smoke-venv
+          /tmp/smoke-venv/bin/pip install wheelhouse/*.whl
+          /tmp/smoke-venv/bin/python -c "from trufnetwork_sdk_py.client import TNClient; print('wheel import ok')"
+
+      - name: Upload wheels
+        uses: actions/upload-artifact@v4
+        with:
+          name: wheels-macos-${{ matrix.arch }}
+          path: wheelhouse/*.whl
+
+  publish:
+    name: Publish wheels to release
+    needs: [build-linux, build-macos]
+    if: startsWith(github.ref, 'refs/tags/v')
+    runs-on: ubuntu-latest
+    steps:
+      - name: Download all built wheels
+        uses: actions/download-artifact@v4
+        with:
+          pattern: wheels-*
+          merge-multiple: true
+          path: dist/
+
+      - name: Publish GitHub release with wheels
+        uses: softprops/action-gh-release@v2
+        with:
+          files: dist/*.whl
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}