ci: publish agent-learning-kit to PyPI via Trusted Publishing - #93
Merged
Conversation
Adds publish-pypi.yml: on an `sdk-vX.Y.Z` tag, build with `uv build`, smoke-import the wheel (fi.simulate.hosted.child_entrypoint, fi.alk.harness), then publish through OIDC Trusted Publishing under the `pypi` environment — no long-lived PyPI token. A guard refuses any tag whose version does not equal the pyproject version, so a tag can never publish the wrong release. The publish action is SHA-pinned (release/v1 is a moving branch). README: the Install section now leads with `pip install agent-learning-kit` (it becomes the PyPI project page); source install is kept for contributors. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
- drop workflow_dispatch: it bypassed the tag guard and let any push-capable account publish an arbitrary ref - guard is now unconditional and ref-aware (refuses non-sdk-v* refs) - SHA-pin every action to its current release; download-artifact ran unpinned inside the id-token job - checkout persist-credentials:false; explicit attestations:true - timeout-minutes + per-tag concurrency - bound the build backend: hatchling>=1.25,<2 Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
- header now documents the account-level PENDING publisher flow (the project does not exist on PyPI yet), the org-account ownership rule, and that a pending publisher does not reserve the name - skip-existing: a re-run after a partial upload must not 400 - smoke venv pinned to Python 3.12 (matches sdk-smoke.yml); also exercises the `alk` console script; setup-uv pinned to 0.12.x - README: all 29 relative links/images made absolute — README.md is the PyPI long description and relative paths 404 on pypi.org - hatchling bound raised to >=1.27,<2 Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
KarthikAvinashFI
previously approved these changes
Sep 12, 2026
…dy on PyPI Replaces the tag trigger with `push: branches: [main]`. A `check` job looks the pyproject version up on PyPI: 404 → build + publish (reviewer-gated), 200 → skip cleanly so ordinary merges stay green and never page the reviewer, anything else → fail rather than guess. Refuses any ref other than main. No workflow_dispatch, no tag trigger; concurrency serializes publishes and never cancels one mid-flight. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
- publish job verifies dist/ is exactly the approved version's wheel+sdist - check uses the project-level PyPI index (purged on release), treats a partial upload as unpublished, retries transient errors - re-check after the reviewer gate so a late approval is a no-op - run summary shows version + commit for approvers - setup-uv pinned exact; comments reduced to the operator essentials Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
atharva-bhange
self-requested a review
September 12, 2026 07:36
jedigalt
approved these changes
Sep 12, 2026
hadarishav
approved these changes
Sep 12, 2026
atharva-bhange
approved these changes
Sep 12, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Publishes
agent-learning-kitto PyPI via Trusted Publishing (OIDC) — no long-lived token — on merge tomain, and updates the README Install section (which becomes the PyPI project page)..github/workflows/publish-pypi.ymlmain(i.e. every merged PR). Noworkflow_dispatch, no tag trigger.checkjob: reads thepyprojectversion (uv version --short) and looks it up on PyPI. 404 → release; 200 → skip cleanly (ordinary merges stay green and never page the reviewer); anything else → fail rather than guess. Refuses any ref other thanmain.buildjob (only when releasing, holds no secrets):uv build, then a smoke install of the wheel that importsfi.simulate.hosted.child_entrypointandfi.alk.harnessand runsalk --help.persist-credentials: false.publishjob: runs under thepypienvironment → pauses for a required reviewer (self-review prevented) → publishes withid-token: writeonly; downloads + publishes, runs no repo code.attestations: true(PEP 740),skip-existing: true.setup-uvheld to 0.12.x; timeouts;concurrencyserializes publishes and never cancels one mid-flight.pyproject.toml[build-system] requires = ["hatchling>=1.27,<2"]— the build backend is the one artifact inputuv.lockdoesn't cover.README.mdInstall leads with
pip install agent-learning-kit; source install kept for contributors; all relative links/images made absolute (they'd 404 on pypi.org).How to release
Bump
versioninpyproject.toml(+uv lock) → merge tomain→ approve thepypideployment when it pauses. Each version publishes exactly once (PyPI is immutable); a mistake needs a new version.0.1.0is not on PyPI, so the merge itself triggerscheck → build → publish (waiting on reviewer). The reviewer's approval click is the0.1.0publish. The pending Trusted Publisher is registered (future-agi/agent-learning-kit/publish-pypi.yml/ envpypi); it does not reserve the name, so approve promptly.Why
The hosted simulation-runner image bundles this SDK and installs it from PyPI (
Dockerfile.simulation-runner); nothing has published it until now, which left the sim-runner release pipeline inert. Publishing (immutable) was chosen over shipping hand-built wheels (mutable, unverifiable).