Split macos-13 into a separate Build Legacy Wheels workflow

[Copilot]

macos-13 GitHub-hosted runners are intermittently unavailable ("runner not found"), causing the main Build Wheels workflow to fail unpredictably. Splitting it into an independent workflow isolates that flakiness.

Changes

• .github/workflows/build-wheels.yml — remove macos-13 from the OS matrix (now ubuntu-latest, windows-latest, macos-14 only); add comment referencing the legacy workflow
• .github/workflows/build-legacy-wheels.yml (new) — standalone Build Legacy Wheels (macos-13) workflow with:
  • Same triggers: pull_request, workflow_dispatch
  • Same steps: checkout → setup-python 3.11 → gh release download v0.1.1 → cibuildwheel@v2.22.0 → verify weights → upload artifact
  • Distinct artifact name: wheels-${{ runner.os }}-legacy-macos-13 (avoids collision with main workflow's wheels-${{ runner.os }})
  • permissions: contents: read at workflow level (least-privilege, CodeQL flagged its absence)

Original prompt

Create a PR in olinickalls/PyFaceWipe to split the macos-13 build out of the existing GitHub Actions workflow into a separate workflow, because macos-13 runner allocation is intermittently unavailable ("runner not found").

Repo currently has .github/workflows/build-wheels.yml with matrix os: [ubuntu-latest, windows-latest, macos-13, macos-14].

Requirements:

1. Update .github/workflows/build-wheels.yml to remove macos-13 from the matrix so the main workflow remains stable.
2. Add a new workflow file .github/workflows/build-legacy-wheels.yml named Build Legacy Wheels (or similar) that runs the same steps as the wheel build for macos-13 only.
   • Triggering: keep same triggers as main workflow (pull_request, workflow_dispatch).
   • Ensure the legacy workflow uploads an artifact with a distinct name (avoid clashing with the main workflow artifacts). Prefer something like wheels-${{ runner.os }}-legacy-macos-13.
3. Keep the build_sdist job in the main workflow unchanged.
4. Keep all other steps (checkout, setup-python 3.11, download release assets v0.1.1 using gh release download, build with pypa/cibuildwheel@v2.22.0, verify wheels include model weights, upload artifact) functionally equivalent.
5. Ensure YAML is valid and workflows are minimal changes.

Acceptance criteria:

• The main Build Wheels workflow no longer attempts macos-13.
• A new Build Legacy Wheels (macos-13) workflow exists and builds macos-13 wheels independently.
• PR includes both the edit and the new file.

The following is the prior conversation context from the user's chat exploration (may be truncated):

User: My 'Build Wheels' flow is OK, but building for macos13 usually fails as a runner is not found.
Please split this off into a separate 'Build Legacy Wheels' workflow

Assistant: I’m waiting for your confirmation in the GitHub dialog to proceed with creating the separate “Build Legacy Wheels” workflow and updating “Build Wheels” to remove macos-13.

User: @copilot Accepted Confirmation: Are you sure?

Assistant: You’ll need to make this change in the repo (I don’t have permission to update .github/workflows/build-wheels.yml in olinickalls/PyFaceWipe from here).

What to do

1. Edit .github/workflows/build-wheels.yml and remove macos-13 from the matrix.
2. Add a new workflow file .github/workflows/build-legacy-wheels.yml that runs the same steps but only on macos-13.

Here are the exact files.

name: Build Wheels

on:
  pull_request:
  workflow_dispatch:

jobs:
  build_wheels:
    name: ${{ matrix.os }}
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        # macos-13 is split into a separate workflow because GitHub-hosted
        # runners for that image can intermittently be unavailable.
        os: [ubuntu-latest, windows-latest, macos-14]

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.11"

      - name: Download model weights from release v0.1.1
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euxo pipefail
          mkdir -p src/pyfacewipe/models
          gh release download v0.1.1 \
            -R "${GITHUB_REPOSITORY}" \
            -p "synthstrip.1.pt" \
            -p "synthstrip.nocsf.1.pt" \
            -D src/pyfacewipe/models
          ls -lah src/pyfacewipe/models

      - name: Build wheels
        uses: pypa/cibuildwheel@v2.22.0
        env:
          CIBW_BUILD: "cp38-* cp39-* cp310-* cp311-* cp312-*"
          CIBW_SKIP: "pp* *-musllinux_* *-win32"
          CIBW_ARCHS_LINUX: "x86_64"
          CIBW_ARCHS_WINDOWS: "AMD64"
          CIBW_ARCHS_MACOS: "x86_64 arm64"
          CIBW_BUILD_VERBOSITY: "1"

      - name: Verify wheels contain model weights
        shell: bash
        run: |
          set -euxo pipefail
          python - <<'PY'
          import glob
          import sys
          import zipfile

          whls = glob.glob("wheelhouse/*.whl")
          if not whls:
              print("No wheels found in wheelhouse/*.whl", file=sys.stderr)
              sys.exit(1)

          required = {
              "pyfacewipe/models/synthstrip.1.pt",
              "pyfacewipe/models/synthstrip.nocsf.1.pt",
          }

          missing_any = False
          for whl in whls:
              with zipfile.ZipFile(whl) as z:
                  names = set(z.namelist())
              missing = sorted(required - names)
              if missing:
                  missing_any = True
                  print(f"ERROR: {whl} is missing: {missing}", file=sys.stderr)
              else:
                  print(f"OK: {whl} contains model weights")

          sys.exit(1 ...

</details>



<!-- START COPILOT CODING AGENT SUFFIX -->

*This pull request was created from Copilot chat.*
>