Releases are built and published from GitHub Actions with short-lived PyPI OIDC credentials. Do not add a PyPI token to the repository.
Before the first release, create a pending PyPI trusted publisher with these exact values:
- PyPI project:
brawsr - GitHub owner:
brawsr - Repository:
sdk-python - Workflow:
publish.yml - Environment:
pypi
The repository must be public before publishing so PyPI can attach public provenance to the release.
- Update
project.versionandsrc/brawsr/_version.pytogether. - Run the complete CI and package verification suite.
- Create a GitHub release whose tag is exactly
v<project.version>and whose target commit is onmain.
Publishing rejects prereleases, mismatched tags, commits outside main, wrong
repository metadata, and artifacts that fail reproducibility or installation
verification.