feat: add GHA workflow to build opencv wheels without ffmpeg (#4335)
## Summary
- Adds a `workflow_dispatch` GHA workflow that builds
`opencv-python-headless` from source with `WITH_FFMPEG=OFF` on amd64 and
arm64
- Wheels are uploaded as a GitHub release so Dockerfiles can download
them at build time
- Eliminates the 14 bundled ffmpeg CVEs present in the stock PyPI wheels
## Test plan
- [ ] Trigger the workflow manually with the default inputs
(`opencv-python-headless==4.12.0.88`)
- [ ] Verify wheels are produced for both architectures
- [ ] Verify the GitHub release is created with both wheels attached
- [ ] Confirm the built wheels have no `.libs` directory (no bundled
ffmpeg)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- CURSOR_SUMMARY -->
---
> [!NOTE]
> **Low Risk**
> Low risk: changes are confined to GitHub Actions workflows, with the
main impact being additional CI/release automation and a simple
tag-based guard on PyPI publishing.
>
> **Overview**
> Adds a new `workflow_dispatch` GitHub Actions workflow to build
`opencv-contrib-python-headless` wheels from source for `amd64` and
`arm64` with `WITH_FFMPEG=OFF`, validate the resulting `cv2` install has
*no* bundled `.libs` and includes key contrib modules, and publish the
wheels via a GitHub Release.
>
> Updates the existing release workflow to **skip** tags prefixed with
`opencv-`, preventing these wheel-only releases from triggering the
normal PyPI publish job.
>
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
f03df11f0e35e226737d9146f3ac2145999fcdbe. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>