feat: PyPI publish for engine + python wrapper, foundation version floor#78
Open
bkrabach wants to merge 1 commit into
Open
feat: PyPI publish for engine + python wrapper, foundation version floor#78bkrabach wants to merge 1 commit into
bkrabach wants to merge 1 commit into
Conversation
…tion
Adds OIDC trusted publishing for both Python packages (amplifier-agent
engine and amplifier-agent-py wrapper) and tightens the foundation dep.
Changes:
- pyproject.toml: amplifier-foundation → amplifier-foundation>=1.0.0
(version floor so future breaking releases are not silently pulled)
- .github/workflows/publish-python.yml: two-job workflow sharing one file.
publish-engine: fires on v* tags, builds root package, publishes via OIDC
publish-wrapper: fires on py-v* tags, builds wrappers/python-py/, publishes via OIDC
Both jobs use environment: pypi, permissions: id-token: write.
Does not touch publish-wrapper.yml (npm) or release-notes.yml (GH Releases).
- RELEASING.md: release steps for all three artifacts (engine v*, wrapper
py-v*, TS wrapper-v*), one-time PyPI trusted publisher setup for both
amplifier-agent and amplifier-agent-py, GitHub pypi environment setup.
- AGENTS.md: update tag namespace table to reflect new PyPI publish paths
(v* → PyPI + GH Release; py-v* → PyPI); note pre-PyPI git-based tags
(engine-v*, wrapper-py-v*) are superseded; fix wrappers/python/ → python-py;
add RELEASING.md to workflows table and 'When in doubt' section.
One-time actions required before first publish:
Configure two PyPI pending trusted publishers:
amplifier-agent: workflow publish-python.yml, env pypi
amplifier-agent-py: same workflow, same env
Create pypi GitHub Actions environment in repo settings.
OIDC handshake is only provable via a real tag-triggered CI run.
🤖 Generated with [Amplifier](https://github.com/microsoft/amplifier)
Co-Authored-By: Amplifier <240397093+microsoft-amplifier@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds PyPI publishing automation for both the engine and Python wrapper, introduces a version floor for the foundation dependency (hygiene), and updates repository documentation.
What this does
1. Version floor on foundation dependency
amplifier-foundation>=1.0.0(was unversioned git override)>=allows compatible patch/minor bumps; semver breaking change would need engine re-release2. New workflow: publish-python.yml
v*tags (semver:v0.9.0,v1.0.0, etc.)amplifier-agent-py) to PyPI onpy-v*tags (semver:py-v0.3.0, etc.)wrapper-v*untouched3. Documentation
v*for engine,py-v*for wrapper,wrapper-v*for npm)Before this can publish
PyPI side setup (one-time):
Configure TWO PyPI pending trusted publishers:
Project
amplifier-agent(the engine):microsoftamplifier-agentpublish-python.ymlpypiProject
amplifier-agent-py(the wrapper):microsoftamplifier-agentpublish-python.ymlpypiThen create a
pypienvironment in the GitHub repo (Settings → Environments).Tagging and publishing:
git tag vX.Y.Z && git push --tagsgit tag py-vX.Y.Z && git push --tagsValidation
Locally validated via
uv build:wrappers/python-py/Note: The OIDC handshake itself can only be validated by the first real tagged run after the trusted publisher is set up at PyPI.
Tag unification for the engine:
Previous AGENTS.md implied the engine should publish on
engine-v*tags (separate from release notes).This PR unifies on
v*tags — same tag fires both the release notes AND the PyPI engine publish. This aligns with amplifier-core's single-tag-per-release convention and keeps tag hygiene simpler.Is this unification desired? Or should the engine remain on a distinct
engine-v*tag to decouple engine releases from release notes?If
engine-v*is preferred, the unification is a one-line fix in the workflow and AGENTS.md docs. Want input before this merges.