From 260e7442089f0830f91a380a2ef5d4d8c0a4ee19 Mon Sep 17 00:00:00 2001
From: Adarsh Prashar <adarsh.prashar32@gmail.com>
Date: Sat, 6 Jun 2026 03:07:14 +0530
Subject: [PATCH] ci: publish the SDK to PyPI on release (trusted publishing)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Installing the SDK from source needs the clunky
`pip install "git+https://...#subdirectory=sdks/python"`, because the package lives
in a monorepo subdirectory and pip can't find a pyproject.toml at the repo root.
Publishing to PyPI makes it the ordinary `pip install riskkernel`.

Adds a workflow that builds and publishes the SDK to PyPI on every version tag,
authenticating with PyPI Trusted Publishing (OIDC) — no API token or password
stored anywhere. It runs the (stdlib-only) tests and builds an sdist + wheel before
uploading; skip-existing guards re-runs.

One-time setup on PyPI: add a pending trusted publisher for `riskkernel` pointing at
this repo and python-publish.yml (the name is free; PyPI claims it on the first
publish). After that, a version tag publishes the SDK next to the binaries and
image, and the install docs become `pip install riskkernel`.
---
 .github/workflows/python-publish.yml | 48 ++++++++++++++++++++++++++++
 1 file changed, 48 insertions(+)
 create mode 100644 .github/workflows/python-publish.yml

diff --git a/.github/workflows/python-publish.yml b/.github/workflows/python-publish.yml
new file mode 100644
index 0000000..c755efc
--- /dev/null
+++ b/.github/workflows/python-publish.yml
@@ -0,0 +1,48 @@
+name: Publish Python SDK
+
+# Publishes the `riskkernel` SDK to PyPI on every version tag, so the install is the
+# clean, ordinary `pip install riskkernel` — no git URL, no #subdirectory.
+#
+# Auth is PyPI Trusted Publishing (OIDC): NO API token or password is stored
+# anywhere. One-time setup on PyPI (https://docs.pypi.org/trusted-publishers/):
+#   add a "pending publisher" for project `riskkernel` →
+#     Owner: prashar32   Repository: riskkernel
+#     Workflow: python-publish.yml   Environment: (leave blank)
+# PyPI claims the name on the first publish. The version in sdks/python/pyproject.toml
+# must match the tag (the release checklist bumps it).
+on:
+  push:
+    tags: ["v*"]
+
+permissions:
+  contents: read
+
+jobs:
+  publish:
+    name: Build & publish riskkernel to PyPI
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: sdks/python
+    permissions:
+      id-token: write # OIDC for PyPI trusted publishing — no stored secret
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      # Don't publish a broken SDK: the suite is stdlib-only, no install needed.
+      - name: Test
+        run: python -m unittest discover -s tests -t . -v
+
+      - name: Build sdist + wheel
+        run: |
+          python -m pip install --upgrade build
+          python -m build
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          packages-dir: sdks/python/dist/
+          skip-existing: true