SDK Updates: v1.0.0

.github/workflows/release.yml

@@ -0,0 +1,75 @@
+name: Release
+on:
+  push:
+    branches: ['main']
+    paths:
+      - '.github/workflows/release.yml'
+      - 'pyproject.toml'
+  workflow_dispatch:
+
+env:
+  # Package identity is baked in at generation time so the workflow never has to
+  # read package metadata at runtime.
+  SDK_VERSION: '1.0.0'
+  SDK_PACKAGE_NAME: 'signplus-python'
+  RELEASE_TAG: 'v1.0.0'
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v4
+      - name: Create tag if it does not exist
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          if gh api "repos/${{ github.repository }}/git/refs/tags/$RELEASE_TAG" >/dev/null 2>&1; then
+            echo "::notice::Tag $RELEASE_TAG already exists, nothing to do"
+            exit 0
+          fi
+          gh api -X POST "repos/${{ github.repository }}/git/refs" \
+            -f ref="refs/tags/$RELEASE_TAG" \
+            -f sha="${{ github.sha }}"
+          echo "::notice::Created tag $RELEASE_TAG at ${{ github.sha }}"
+      - name: Check required publishing secrets
+        id: secrets
+        # Publishing is enabled by default. Secrets cannot be referenced in a
+        # step-level `if:`, so read them into env here and skip the publish steps
+        # (succeeding, not failing) when a required secret is unset or empty.
+        env:
+          PYPI_API_TOKEN: ${{ secrets.PYPI_API_TOKEN }}
+        run: |
+          if [ -n "$PYPI_API_TOKEN" ]; then
+            echo "ok=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "ok=false" >> "$GITHUB_OUTPUT"
+            echo "::notice::PYPI_API_TOKEN is not set; skipping PyPI publishing."
+          fi
+      - uses: actions/setup-python@v5
+        if: steps.secrets.outputs.ok == 'true'
+        with:
+          python-version: '3.x'
+      - name: Build distribution
+        if: steps.secrets.outputs.ok == 'true'
+        run: |
+          python -m pip install --upgrade build
+          python -m build
+      - name: Publish to PyPI
+        if: steps.secrets.outputs.ok == 'true'
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          password: ${{ secrets.PYPI_API_TOKEN }}
+          # Re-running on an already-published version is a no-op instead of a failure.
+          skip-existing: true
+      - name: Create GitHub release
+        if: steps.secrets.outputs.ok == 'true'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          if gh release view "$RELEASE_TAG" >/dev/null 2>&1; then
+            echo "::notice::Release $RELEASE_TAG already exists"
+          else
+            gh release create "$RELEASE_TAG" --title "$RELEASE_TAG" --generate-notes
+          fi