From bd7a5ab4c2795c066e1be87c235ef835b4f7f070 Mon Sep 17 00:00:00 2001
From: zeevdr <zeevdr@users.noreply.github.com>
Date: Wed, 3 Jun 2026 09:52:59 +0300
Subject: [PATCH] feat: backfill GitHub releases and emit release on publish

Add scripts/backfill-releases.sh to create GitHub releases for the
already-published PyPI versions (0.1.0, 0.2.0), downloading wheel and
sdist artifacts from PyPI and attaching them to the corresponding tags.

Update .github/workflows/publish.yml to create a GitHub release on
every future tag push: upgrades the job's `contents` permission from
read to write and adds a `gh release create` step after the PyPI
publish step, attaching the built artifacts from sdk/dist/.

Closes #6
---
 .github/workflows/publish.yml |  5 ++++-
 scripts/backfill-releases.sh  | 38 +++++++++++++++++++++++++++++++++++
 2 files changed, 42 insertions(+), 1 deletion(-)
 create mode 100755 scripts/backfill-releases.sh

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 3e8e9d7..04af195 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -15,7 +15,7 @@ jobs:
     environment: pypi
     permissions:
       id-token: write
-      contents: read
+      contents: write
     steps:
       - uses: actions/checkout@v6
       - uses: actions/setup-python@v6
@@ -27,3 +27,6 @@ jobs:
         with:
           packages-dir: sdk/dist/
           print-hash: true
+      - run: gh release create "${{ github.ref_name }}" --generate-notes sdk/dist/*.whl sdk/dist/*.tar.gz
+        env:
+          GH_TOKEN: ${{ github.token }}
diff --git a/scripts/backfill-releases.sh b/scripts/backfill-releases.sh
new file mode 100755
index 0000000..545aad8
--- /dev/null
+++ b/scripts/backfill-releases.sh
@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+PYPI_PACKAGE="decree"
+VERSIONS=("0.1.0" "0.2.0")
+
+for version in "${VERSIONS[@]}"; do
+  tag="v${version}"
+  tmpdir=$(mktemp -d)
+  trap 'rm -rf "$tmpdir"' EXIT
+
+  echo "Fetching PyPI metadata for ${PYPI_PACKAGE} ${version}..."
+  metadata=$(curl -fsSL "https://pypi.org/pypi/${PYPI_PACKAGE}/${version}/json")
+
+  mapfile -t urls < <(echo "$metadata" | python3 -c "
+import json, sys
+data = json.load(sys.stdin)
+for f in data['urls']:
+    if f['packagetype'] in ('bdist_wheel', 'sdist'):
+        print(f['url'])
+")
+
+  for url in "${urls[@]}"; do
+    filename=$(basename "$url")
+    echo "Downloading ${filename}..."
+    curl -fsSL -o "${tmpdir}/${filename}" "$url"
+  done
+
+  echo "Creating GitHub release for ${tag}..."
+  gh release create "$tag" \
+    --repo opendecree/decree-python \
+    --generate-notes \
+    "${tmpdir}"/*.whl \
+    "${tmpdir}"/*.tar.gz
+
+  trap - EXIT
+  rm -rf "$tmpdir"
+done