build: add Emscripten exclusion markers and CI safety rails

Author: 1minds3t

.github/workflows/publish-wheels.yml

@@ -4,8 +4,9 @@ on:
   workflow_dispatch:
     inputs:
       tag:
-        description: 'Tag to publish (e.g. v3.3.1)'
-        required: true
+        description: 'Tag or branch (e.g. v3.3.1 or development)'
+        required: false
+        default: 'development'
 
 permissions:
   contents: write
@@ -15,7 +16,7 @@ jobs:
   # ── Linux x86_64 manylinux (cp37-abi3) ──────────────────────────────────
   build-linux-x86_64-glibc:
     name: "linux x86_64 glibc"
-    runs-on: self-hosted
+    runs-on: [self-hosted, Linux, X64]
     steps:
       - uses: actions/checkout@v4
         with:
@@ -42,7 +43,7 @@ jobs:
   # ── Linux aarch64 manylinux (cp37-abi3) ─────────────────────────────────
   build-linux-aarch64-glibc:
     name: "linux aarch64 glibc"
-    runs-on: self-hosted
+    runs-on: [self-hosted, Linux, X64]
     steps:
       - uses: actions/checkout@v4
         with:
@@ -69,7 +70,7 @@ jobs:
   # ── Linux x86_64 musllinux (cp37-abi3) ──────────────────────────────────
   build-linux-x86_64-musl:
     name: "linux x86_64 musl"
-    runs-on: self-hosted
+    runs-on: [self-hosted, Linux, X64]
     steps:
       - uses: actions/checkout@v4
         with:
@@ -96,7 +97,7 @@ jobs:
   # ── Linux aarch64 musllinux (cp37-abi3) ─────────────────────────────────
   build-linux-aarch64-musl:
     name: "linux aarch64 musl"
-    runs-on: self-hosted
+    runs-on: [self-hosted, Linux, X64]
     steps:
       - uses: actions/checkout@v4
         with:
@@ -123,7 +124,7 @@ jobs:
   # ── Windows AMD64 ────────────────────────────────────────────────────────
   build-win-amd64:
     name: "windows amd64"
-    runs-on: self-hosted
+    runs-on: [self-hosted, Windows, X64]
     steps:
       - uses: actions/checkout@v4
         with:
@@ -144,7 +145,7 @@ jobs:
   # ── Windows ARM64 ────────────────────────────────────────────────────────
   build-win-arm64:
     name: "windows arm64"
-    runs-on: self-hosted
+    runs-on: [self-hosted, Windows, X64]
     steps:
       - uses: actions/checkout@v4
         with:
@@ -242,13 +243,15 @@ jobs:
         run: ls -lh dist/
 
       - name: Upload to GitHub Release
+        if: startsWith(inputs.tag, 'v')
         uses: softprops/action-gh-release@v2
         with:
           tag_name: ${{ inputs.tag }}
           files: dist/*.whl
           fail_on_unmatched_files: false
 
       - name: Publish to PyPI
+        if: startsWith(inputs.tag, 'v')
         uses: pypa/gh-action-pypi-publish@release/v1
         with:
           packages-dir: dist/

pyproject.toml

@@ -1,6 +1,6 @@
 [build-system]
 # Python 3.7 compatible setuptools (newer versions require Python 3.8+)
-requires = ["setuptools>=50.0,<70.0", "wheel", "packaging>=21.3"]
+requires = ["setuptools>=50.0,<75.0", "wheel", "packaging>=21.3"]
 build-backend = "build_hooks"
 backend-path = ["."]
 
@@ -39,9 +39,9 @@ classifiers = [
 ]
 
 dependencies = [
-    "uv_ffi>=0.10.8.post7 ; python_version >= '3.8' and python_version <= '3.14'",
+    "uv_ffi>=0.10.8.post7 ; python_version >= '3.8' and python_version <= '3.14' and platform_system != 'Emscripten'",
     "requests>=2.20",
-    "psutil>=5.9.0",
+    "psutil>=5.9.0 ; platform_system != 'Emscripten'",
     "typer>=0.4.0",
     "rich>=10.0.0",
 
@@ -92,10 +92,11 @@ dependencies = [
     # cryptography - version split by Python
     # Python 3.7: stuck at 45.0.7 (upstream dropped 3.7 before 46.x)
     # CVEs unresolved: CVE-2026-26007 (HIGH), CVE-2026-34073 (LOW), CVE-2026-39892 (MODERATE)
-    # TODO: cryptography-lts needed for py37 to backport fixes landing in 46.0.5–46.0.7
-    "cryptography>=45.0.7,<46.0; python_version == '3.7'",  # UNSAFE: 3 open CVEs, best available
-    "cryptography>=46.0.7; python_version >= '3.8'",         # fully patched
-    
+    # TODO: cryptography-lts needed for py37 to backport fixes landing in 46.0.5–46.0.7     
+    "cryptography>=46.0.7 ; python_version >= '3.8' and platform_system != 'Emscripten'", # fully patched
+    "cryptography>=45.0.7,<46.0 ; python_version == '3.7' and platform_system != 'Emscripten'", # UNSAFE: 3 open CVEs, best available
+    "cryptography-wasm>=42.0.2 ; platform_system == 'Emscripten'",
+
     # Security scanning
     # safety moved to optional 'audit' extra due to CVE-2025-14009 in nltk dependency
     # pip-audit is now the primary default scanner for all versions