feat(python): publish sealg to PyPI so `uvx sealg` resolves

Merged
MI
2mo ago
+165-1

Summary

Wires a PyPI release path for the Python sealg client (python/) so it is installable by name (uvx sealg) instead of only from a checkout or git subdirectory. The package name sealg is currently free on PyPI. Auth is PyPI Trusted Publishing (OIDC) — no API token is stored.

Changes

  • .github/workflows/publish-python.yaml (new) — builds the sdist + wheel and publishes via pypa/gh-action-pypi-publish using OIDC Trusted Publishing. Triggered on a dedicated sealg-py-vX.Y.Z tag namespace so it never collides with the Rust binary's vX.Y.Z release (release.yml). A tag/version match guard fails the run before publishing if the tag disagrees with python/pyproject.toml. workflow_dispatch runs a build-only validation without publishing.
  • python/pyproject.toml — adds README long-description, license = "MIT" + bundled LICENSE, author, [project.urls], keywords, and classifiers so the PyPI page is complete. Verified the wheel metadata and that uvx --from ./dist/*.whl sealg --help runs.
  • python/LICENSE (new) — copy of the repo MIT license so the wheel bundles it.
  • RELEASING.md — documents the one-time Trusted Publishing setup (maintainer action; CI cannot do it) and the sealg-py-vX.Y.Z release steps.
  • README.md / python/README.md — lead install with uvx sealg; keep the checkout and git-subdirectory fallbacks.

Testing

  • Tests pass (make test) — wire-contract check passes (16 constants agree); package builds sdist + wheel; entrypoint runs from the built wheel.
  • Linting passes (make ci)

[!IMPORTANT]
Before the first tag can publish, a maintainer must complete the one-time PyPI setup in RELEASING.md: add the trusted publisher (owner Edison-Watch, repo cli, workflow publish-python.yaml, environment pypi) as a pending publisher on PyPI, and create a pypi GitHub Environment. CI cannot do this step.

Related Issues

Closes #

🤖 Generated with Claude Code

https://claude.ai/code/session_01EpwFmgQPfugKFF9zugay6Y

Generated by Claude Code

Summary by cubic

Publishes the Python sealg client to PyPI so uvx sealg resolves without a checkout or git subdirectory.

  • Adds a workflow that builds an sdist and wheel and publishes via PyPI Trusted Publishing (OIDC), with no stored API token.
  • Uses the sealg-py-vX.Y.Z tag namespace so Python releases don't collide with Rust binary vX.Y.Z releases; a tag/version mismatch fails before publishing, and workflow_dispatch does a build-only validation.
  • Fills out pyproject.toml metadata, bundles the MIT license, and updates the READMEs and RELEASING.md.

Migration

  • A maintainer must add the trusted publisher on PyPI and create the pypi GitHub Environment before the first tag can publish; steps are in RELEASING.md.