ci: publish the SDK to PyPI on release (trusted publishing) - #66
Merged
Conversation
Installing the SDK from source needs the clunky `pip install "git+https://...#subdirectory=sdks/python"`, because the package lives in a monorepo subdirectory and pip can't find a pyproject.toml at the repo root. Publishing to PyPI makes it the ordinary `pip install riskkernel`. Adds a workflow that builds and publishes the SDK to PyPI on every version tag, authenticating with PyPI Trusted Publishing (OIDC) — no API token or password stored anywhere. It runs the (stdlib-only) tests and builds an sdist + wheel before uploading; skip-existing guards re-runs. One-time setup on PyPI: add a pending trusted publisher for `riskkernel` pointing at this repo and python-publish.yml (the name is free; PyPI claims it on the first publish). After that, a version tag publishes the SDK next to the binaries and image, and the install docs become `pip install riskkernel`.
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The from-source install is clunky:
pip install "git+https://github.com/prashar32/riskkernel.git#subdirectory=sdks/python"…only because the SDK lives in a monorepo subdirectory, so pip finds no
pyproject.tomlat the repo root. Publishing to PyPI makes it the ordinarypip install riskkernel— no git URL, no#subdirectory, like any other package.What
A workflow that builds and publishes the
riskkernelSDK to PyPI on every version tag, via PyPI Trusted Publishing (OIDC) — no API token or password is stored anywhere. It runs the (stdlib-only) tests, builds an sdist + wheel, and uploads;skip-existingguards re-runs.One-time setup (PyPI side, mine to do)
The name
riskkernelis free on PyPI. Add a pending trusted publisher for it (PyPI → your account → Publishing):riskkernel· Owner:prashar32· Repository:riskkernelpython-publish.yml· Environment: (blank)PyPI claims the name on the first publish. After that, tagging a release publishes the SDK alongside the binaries + image, and the install docs move to
pip install riskkernel.Verified
ignore-vcs).