ci: publish Python SDK with trusted publishing

Merged
FE
3mo ago
+159-12

What changed

  • add tag-driven PyPI Trusted Publishing via OIDC with no stored API token
  • separate unprivileged test/build work from the OIDC-enabled publish job
  • require the v* tag to exactly match project.version
  • build, check, and smoke-test wheel/sdist artifacts before publication
  • add package validation to normal CI and test Python 3.14
  • update official Actions and document the release process
  • add PyPI source and issue metadata links

Release behavior

.github/workflows/publish.yml only runs on v* tag pushes. The publish job has job-scoped id-token: write, no GitHub environment, and no username/password/token input. PyPI digital attestations remain enabled by default. Duplicate versions fail instead of being skipped.

Validation

  • Python 3.11: 85 unit tests, compileall, wheel + sdist build, twine check, isolated wheel import/version check
  • Python 3.14: 85 unit tests
  • actionlint for both workflows
  • matching and mismatching tag/version cases

PyPI setup after merge

Configure the existing insforge project Trusted Publisher with organization InsForge, repository insforge-python, workflow filename publish.yml, and no environment name.

Summary by cubic

Enables PyPI Trusted Publishing via OIDC for the Python SDK on v* tags. Adds build/validation/smoke tests, Python 3.14 in CI, auto GitHub Releases for stable versions, and pins the PyPI publish action.

  • New Features

    • Tag-driven release workflow .github/workflows/publish.yml using OIDC; no stored PyPI token; attestations enabled; auto GitHub Release for stable X.Y.Z tags (prereleases skip).
    • Enforce tag equals project.version (e.g., vX.Y.Z; PEP 440 prereleases supported); duplicate versions fail.
    • Pre-publish build (wheel/sdist), unit tests, twine check, and wheel smoke import/version; CI adds Python 3.14, a package job, and updates to actions/checkout@v7 / actions/setup-python@v6.
    • Pin pypa/gh-action-pypi-publish to v1.14.0 (commit SHA); add project.urls (Source, Issues); update README with tag-based release steps.

  • Migration

    • In PyPI, configure Trusted Publisher for project insforge to organization InsForge, repository insforge-python, workflow publish.yml, with no environment name.