feat: publish to PyPI and hand downstream bumps to Dependabot

.github/workflows/release.yml

@@ -4,12 +4,11 @@ on:
   push:
     tags: ["v*"]
 
-permissions:
-  contents: write
-
 jobs:
-  release:
+  build:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
@@ -37,67 +36,86 @@ jobs:
       - run: uv run pytest -q
       - run: uv build
 
-      - name: Publish GitHub Release
+      # A PyPI version number can never be reused, not even after deleting the
+      # release. Reject malformed metadata here rather than burning the version.
+      - name: Validate package metadata
+        run: uv run --with twine twine check dist/*
+
+      # The release contract requires the artifact to install and import in a
+      # clean environment. Checking it here matters more than usual because a
+      # PyPI version number cannot be reclaimed: a wheel that fails to import
+      # would burn the version rather than fail the release.
+      - name: Install and import the built wheel in a clean environment
         run: |
           set -euo pipefail
-          gh release create "$TAG" \
-            --title "AgentCore ${TAG#v}" \
-            --notes-file release-notes.md \
-            dist/*.whl dist/*.tar.gz
-        env:
-          TAG: ${{ github.ref_name }}
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          uv venv /tmp/wheel-smoke
+          uv pip install --python /tmp/wheel-smoke/bin/python dist/*.whl
+          /tmp/wheel-smoke/bin/python - <<'SMOKE'
+          import agent_core
+          from agent_core import user_msg
 
-      - name: Check downstream automation credentials
-        id: downstream-app
-        env:
-          APP_CLIENT_ID: ${{ vars.AGENT_CORE_AUTOMATION_APP_CLIENT_ID }}
-          APP_PRIVATE_KEY: ${{ secrets.AGENT_CORE_AUTOMATION_APP_PRIVATE_KEY }}
-        run: |
-          if [[ -n "$APP_CLIENT_ID" && -n "$APP_PRIVATE_KEY" ]]; then
-            echo "configured=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "configured=false" >> "$GITHUB_OUTPUT"
-            echo "::warning title=No downstream dispatch::GitHub App credentials are not configured; no bump PRs were requested. See docs/downstream-bump.md."
-          fi
+          assert user_msg("hi") == {"role": "user", "content": "hi"}
+          print("imported", agent_core.__name__, "with", len(agent_core.__all__), "exports")
+          SMOKE
 
-      - name: Create downstream dispatch token
-        id: downstream-token
-        if: steps.downstream-app.outputs.configured == 'true'
-        continue-on-error: true
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
-          client-id: ${{ vars.AGENT_CORE_AUTOMATION_APP_CLIENT_ID }}
-          private-key: ${{ secrets.AGENT_CORE_AUTOMATION_APP_PRIVATE_KEY }}
-          owner: ${{ github.repository_owner }}
-          repositories: |
-            ApodexHarness
-            FrontierAgentInternal
-          permission-contents: write
+          name: release-artifacts
+          path: |
+            dist/
+            release-notes.md
+          if-no-files-found: error
 
-      - name: Warn if dispatch authentication failed
-        if: >-
-          steps.downstream-app.outputs.configured == 'true' &&
-          steps.downstream-token.outcome != 'success'
-        run: echo "::warning title=Downstream authentication failed::Could not create a GitHub App token; no bump PRs were requested."
+  # Separate job so `id-token: write` — which mints the OIDC identity PyPI
+  # trusts — is scoped to publishing alone and never exposed to the build or to
+  # any third-party action running beside it.
+  publish-pypi:
+    needs: build
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: release-artifacts
+          path: release-artifacts/
+      # Trusted Publishing: no API token, no secret. PyPI verifies the OIDC
+      # claim naming this repository, this workflow file, and the environment
+      # above, then issues a short-lived upload token itself.
+      - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
+        with:
+          packages-dir: release-artifacts/dist/
 
-      # Notify both consumers so a release always produces a visible bump PR
-      # rather than waiting for someone to remember. This runs after the release
-      # exists, and authentication/dispatch failures degrade to warnings: the
-      # release itself is already published and must not be failed by downstream
-      # plumbing.
-      - name: Request downstream bump PRs
-        if: steps.downstream-token.outcome == 'success'
-        env:
-          TAG: ${{ github.ref_name }}
-          GH_TOKEN: ${{ steps.downstream-token.outputs.token }}
+  # Publish the GitHub Release last. A failed PyPI upload therefore cannot leave
+  # a GitHub Release claiming that a version was published when it was not.
+  publish-github:
+    needs: publish-pypi
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: release-artifacts
+          path: release-artifacts/
+      # `gh release create` is not retry-safe after a partial API failure. Use
+      # an upsert so rerunning this job always converges on the same release.
+      - name: Publish GitHub Release
         run: |
           set -euo pipefail
-          for repo in ApodexAI/ApodexHarness ApodexAI/FrontierAgentInternal; do
-            echo "Dispatching agent-core-release ${TAG} to ${repo}"
-            gh api "repos/${repo}/dispatches" \
-              --method POST \
-              -f event_type=agent-core-release \
-              -f "client_payload[version]=${TAG}" \
-              || echo "::warning title=Dispatch failed::Could not notify ${repo}; open its bump PR manually."
-          done
+          if gh release view "$TAG" >/dev/null 2>&1; then
+            gh release edit "$TAG" \
+              --title "AgentCore ${TAG#v}" \
+              --notes-file release-artifacts/release-notes.md
+            gh release upload "$TAG" --clobber \
+              release-artifacts/dist/*.whl release-artifacts/dist/*.tar.gz
+          else
+            gh release create "$TAG" \
+              --title "AgentCore ${TAG#v}" \
+              --notes-file release-artifacts/release-notes.md \
+              release-artifacts/dist/*.whl release-artifacts/dist/*.tar.gz
+          fi
+        env:
+          TAG: ${{ github.ref_name }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}