From e9dcf775d9ff213aa28019fbed180c348a778dd7 Mon Sep 17 00:00:00 2001
From: Ratul Maharaj <56479869+RatulMaharaj@users.noreply.github.com>
Date: Thu, 25 Jun 2026 17:25:28 +0200
Subject: [PATCH] ci: publish to PyPI on release (trusted publishing)

Add back a pypi-publish job using PyPI trusted publishing (OIDC, no token).
PyPI is the source of truth consumers resolve from (`datamaker-py>=x.y`), which
is what lets the DataMaker desktop runner install the SDK fully offline from its
bundled wheelhouse: uv satisfies a registry/name-versioned dependency from
--find-links, but NOT a direct-URL pin. Keep attaching the wheel + sdist to the
GitHub release as a no-auth fallback.

Requires a one-time PyPI "pending publisher" config (documented in the workflow
header) before the first publish succeeds.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TMwtcrQZ2WSMZB7wZYM6za
---
 .github/workflows/python-publish.yml | 56 ++++++++++++++++++++++++----
 1 file changed, 48 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/python-publish.yml b/.github/workflows/python-publish.yml
index c1d37e3..12c82d9 100644
--- a/.github/workflows/python-publish.yml
+++ b/.github/workflows/python-publish.yml
@@ -1,5 +1,21 @@
-# On a published GitHub release, build the package and attach the wheel + sdist
-# as release assets so consumers can pin a direct `.whl` URL (no PyPI involved).
+# On a published GitHub release: build the package, publish it to PyPI (via
+# trusted publishing), and also attach the wheel + sdist to the GitHub release.
+#
+# PyPI is the source of truth consumers resolve from (`datamaker-py>=x.y`), which
+# is what lets the DataMaker desktop runner install it offline from its bundled
+# wheelhouse - a registry/name-versioned dep is satisfiable from --find-links,
+# whereas a direct-URL pin is not. The GitHub release assets are kept as a
+# convenient, no-auth fallback URL.
+#
+# ONE-TIME SETUP (PyPI side, required before the first publish succeeds):
+#   On pypi.org → Account → Publishing → add a "pending publisher":
+#     PyPI Project Name: datamaker-py
+#     Owner:             automators-com
+#     Repository:        datamaker-py
+#     Workflow name:     python-publish.yml
+#     Environment:       pypi
+#   The first successful run then creates the project. No API token/secret is
+#   stored - auth is OIDC via the `id-token: write` permission below.
 
 name: Upload Python Package
 
@@ -33,14 +49,38 @@ jobs:
         run: |
           uv build
 
-      # Attach the wheel (and sdist) to the GitHub release so consumers can pin a
-      # direct `.whl` URL, e.g.
-      #   datamaker-py @ https://github.com/automators-com/datamaker-py/releases/download/<tag>/datamaker_py-<ver>-py3-none-any.whl
-      # Because the URL ends in `.whl`, uv/pip install it as a wheel with NO build
-      # step (the DataMaker desktop runner needs this to provision its venv fully
-      # offline). The repo is public, so the asset URL needs no auth.
+      - name: Upload distributions
+        uses: actions/upload-artifact@v4
+        with:
+          name: release-dists
+          path: dist/
+
+      # Attach the wheel (and sdist) to the GitHub release as a no-auth fallback.
       - name: Attach distributions to the GitHub release
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
           gh release upload "${{ github.event.release.tag_name }}" dist/*.whl dist/*.tar.gz --clobber
+
+  pypi-publish:
+    runs-on: ubuntu-latest
+    needs:
+      - release-build
+    permissions:
+      # Mandatory for PyPI trusted publishing (OIDC) - no API token needed.
+      id-token: write
+    environment:
+      name: pypi
+      url: https://pypi.org/p/datamaker-py
+
+    steps:
+      - name: Retrieve release distributions
+        uses: actions/download-artifact@v4
+        with:
+          name: release-dists
+          path: dist/
+
+      - name: Publish release distributions to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          packages-dir: dist/