[glebedel]

ADK releases currently have no publishing workflow. This adds a manual release workflow that runs from reviewed main, builds an existing release tag, and uploads the tested wheel and source archive through PyPI Trusted Publishing without a stored token.

Publishing is restricted by both the workflow and the GitHub pypi environment to branch main. Tag pushes do not publish. Before package tooling runs, the workflow resolves the selected commit and the fully qualified remote main reference to commit IDs and verifies ancestry. Package metadata is then parsed with isolated Python and uv configuration discovery disabled. The separate publishing job alone receives the identity permission.

RELEASING.md documents the exact PyPI publisher fields and the manual first-release procedure for v0.3.0 at 47b20e6eb90aa7d36a87a0df6720ae37cf1feb44. The live GitHub environment has been tightened to allow branch main only; the v* tag rule was removed.

Validation: actionlint and whitespace checks pass. All 11 local behavioral probes pass, covering current/historical releases, unmerged source, an impersonating origin/main tag, wrong package names, version mismatches, malformed tags, missing main, checkout-local Python modules, local uv configuration, and combined attacks. On commit 40b88ae, CI passes lint, typing, and tests on Python 3.11, 3.12, and 3.13. The release build passes tests, builds both distributions, and installs/imports each in an isolated environment. Publishing is correctly skipped on the PR. Aikido’s PR security check passes.

The changes address findings from the StackOne review skill and independent built-in Codex review. Authenticated PyPI publisher configuration and the actual identity exchange/upload remain unverified. No release tag or package upload has been created.

Refs ENG-3325.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing. Review the Copilot code review billing settings.