Add optional pip testing to wheel smoketest (#13834)

Adds test-pip input to wheel smoketest action and enables it for
CPython linux builders. The pip testing is split into four steps
(venv creation, build requirements installation, wheel installation,
verification) to match the uv approach.

Resolves #13456

Co-authored-by: Claude <[email protected]>

Author: alex

.github/actions/wheel-smoketest/action.yml

@@ -9,6 +9,10 @@ inputs:
   build-requirements-path:
     description: 'Path to the build requirements file'
     required: true
+  test-pip:
+    description: 'Optional flag to also test installation with pip'
+    required: false
+    default: 'false'
 
 runs:
   using: "composite"
@@ -45,3 +49,33 @@ runs:
         print(f"Linked Against: {backend._ffi.string(backend._lib.OPENSSL_VERSION_TEXT).decode('ascii')}")
         EOF
       shell: bash
+
+    - name: Create virtual environment for pip testing
+      if: inputs.test-pip == 'true'
+      run: |
+        if [ -n "${{ inputs.python-path }}" ]; then
+          "${{ inputs.python-path }}" -m venv .venv-pip-test
+        else
+          python3 -m venv .venv-pip-test
+        fi
+      shell: bash
+
+    - name: Install build requirements with pip
+      if: inputs.test-pip == 'true'
+      run: .venv-pip-test/bin/pip install --require-hashes -r "${{ inputs.build-requirements-path }}"
+      shell: bash
+
+    - name: Install cryptography wheel with pip
+      if: inputs.test-pip == 'true'
+      run: .venv-pip-test/bin/pip install cryptography --no-index -f wheelhouse/
+      shell: bash
+
+    - name: Verify pip installation and OpenSSL version
+      if: inputs.test-pip == 'true'
+      run: |
+        .venv-pip-test/bin/python - <<'EOF'
+        from cryptography.hazmat.backends.openssl.backend import backend
+        print(f"pip install - Loaded: {backend.openssl_version_text()}")
+        print(f"pip install - Linked Against: {backend._ffi.string(backend._lib.OPENSSL_VERSION_TEXT).decode('ascii')}")
+        EOF
+      shell: bash

.github/workflows/wheel-builder.yml

@@ -168,6 +168,7 @@ jobs:
         with:
           python-path: /opt/python/${{ matrix.PYTHON.VERSION }}/bin/python
           build-requirements-path: ${{ env.BUILD_REQUIREMENTS_PATH }}
+          test-pip: ${{ startsWith(matrix.PYTHON.VERSION, 'cp') }}
 
       - uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with: