ci: publish python dev packages to PyPI on main pushes

[kmilodenisglez]

@pfi79 Yes. I compared the Python workflow against the Node.js one.

The Python workflow already generates a unique PEP 440 dev version for non-release builds; the only missing piece is the publish condition, which currently requires publish_release == 'true' (release tags only). I've aligned it with Node.js:

github.ref == 'refs/heads/main' || needs.ci_checks.outputs.publish_release == 'true'

Result:

• PR: build + upload GitHub artifact
• push to main: publish the .dev<run_id> snapshot to PyPI
• release tag: publish the stable version to PyPI

The artifact step now also covers manual workflow_dispatch runs from non-main branches, mirroring Node's dry-run behavior.

One operational detail before this merges:

Since this is a brand-new project name on PyPI, the first OIDC publish requires a "pending publisher" registration at pypi.org/manage/account/publishing/ — it can't be created from the repo via CI/CD for security reasons. Whoever registers it becomes the project Owner on PyPI, so it should probably be someone from the Hyperledger/LF side rather than me. Either the owner or the maintainer (if one exists) of the PyPI account or organization.

PyPI Trusted Publishing Setup Guide (For Maintainers)

Steps to Configure Trusted Publishing

1. Log in to PyPI and navigate to pypi.org/manage/account/publishing/.
2. Under Add a new pending publisher, select GitHub.
3. Fill out the form using the exact details below and click Add.

Required Form Values

• PyPI Project Name: hyperledger-fabric-protos
• Owner: hyperledger
• Repository name: fabric-protos
• Workflow name: python-bindings.yml (exact filename in .github/workflows/)
• Environment name: (leave completely blank)

Once this is saved on PyPI, the first merged PR or release push will authenticate seamlessly via GitHub OIDC without needing long-lived PyPI API tokens.

[pfi79]

@ryjones @tock-ibm @denyeart @bestbeforetoday
Can you tell me who can create the appropriate account and link it to this repository? I can do it myself, but then it will be tied to me, but it is not my property.

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request

[ryjones]

@pfi79 I've added a pending secure publishing workflow.

I've also added a commit to sha-pin the uses clauses.

The publisher will be registered from the Foundation's shared PyPI user
hyperledger (https://pypi.org/user/hyperledger/), so the project is owned
by the Foundation rather than by any contributor. Whoever holds that account
adds the pending publisher with the values in the PR description
(hyperledger-fabric-protos, owner hyperledger, repo fabric-protos,
workflow python-bindings.yml, no environment). Once that is in place we
can merge; the first push to main creates the project. Nothing else in the
repo needs changing for the first publish.

[ryjones]

https://pypi.org/project/hyperledger-fabric-protos/