Add PyPiLibrary Python sibling project

.github/dependabot.yml

@@ -1,23 +1,33 @@
-# https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
-version: 2
-updates:
-
- # main
-- package-ecosystem: "nuget"
- target-branch: "main"
- directory: "/"
- schedule:
- interval: "daily"
- groups:
- nuget-deps:
- patterns:
- - "*"
-- package-ecosystem: "github-actions"
- target-branch: "main"
- directory: "/"
- schedule:
- interval: "daily"
- groups:
- actions-deps:
- patterns:
- - "*"
+# https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
+version: 2
+updates:
+
+ - package-ecosystem: "nuget"
+ target-branch: "main"
+ directory: "/"
+ schedule:
+ interval: "daily"
+ groups:
+ nuget-deps:
+ patterns:
+ - "*"
+
+ - package-ecosystem: "github-actions"
+ target-branch: "main"
+ directory: "/"
+ schedule:
+ interval: "daily"
+ groups:
+ actions-deps:
+ patterns:
+ - "*"
+
+ - package-ecosystem: "uv"
+ target-branch: "main"
+ directory: "/PyPiLibrary"
+ schedule:
+ interval: "daily"
+ groups:
+ pypi-deps:
+ patterns:
+ - "*"

.github/workflows/build-pypilibrary-task.yml

@@ -0,0 +1,71 @@
+name: Build PyPI library task
+
+# This reusable workflow only builds the PyPI library and uploads the
+# wheel + sdist as a workflow-run artifact. It does NOT publish to PyPI.
+# Publishing happens directly in `publish-release.yml` so that the
+# `id-token: write` permission required by Trusted Publishing is granted
+# at the entry-point job, not propagated through a reusable-workflow
+# chain (which would require every caller — including `test-release-task.yml`
+# during PR validation — to also grant id-token write, even when no
+# publishing happens).
+
+on:
+ workflow_call:
+ outputs:
+ artifact-name:
+ value: ${{ jobs.build-pypilibrary.outputs.artifact-name }}
+ artifact-id:
+ value: ${{ jobs.build-pypilibrary.outputs.artifact-id }}
+
+jobs:
+
+ build-pypilibrary:
+ name: Build PyPI library project job
+ runs-on: ubuntu-latest
+ defaults:
+ run:
+ working-directory: ./PyPiLibrary
+ outputs:
+ artifact-name: pypilibrary-build
+ artifact-id: ${{ steps.artifact-upload-step.outputs.artifact-id }}
+
+ steps:
+
+ - name: Checkout code step
+ uses: actions/checkout@v6
+
+ - name: Setup uv step
+ uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+ with:
+ # Pin uv to the same version as `.devcontainer/post-create.sh`
+ # (UV_VERSION) so CI and local devcontainer behavior cannot drift
+ # — same uv resolves the same lockfile the same way. Bump in lock-
+ # step with the devcontainer pin.
+ version: "0.11.8"
+ enable-cache: true
+ cache-dependency-glob: "PyPiLibrary/uv.lock"
+
+ - name: Sync dependencies step
+ run: uv sync --all-groups --frozen
+
+ - name: Lint with ruff step
+ run: uv run ruff check
+
+ - name: Verify formatting with ruff step
+ run: uv run ruff format --check
+
+ - name: Type check with pyright step
+ run: uv run pyright
+
+ - name: Run pytest step
+ run: uv run pytest
+
+ - name: Build sdist and wheel step
+ run: uv build
+
+ - name: Upload build artifacts step
+ id: artifact-upload-step
+ uses: actions/upload-artifact@v6
+ with:
+ name: pypilibrary-build
+ path: PyPiLibrary/dist/*

.github/workflows/build-release-task.yml

@@ -34,6 +34,15 @@ jobs:
  # Conditional push to NuGet.org
  push: ${{ inputs.nuget }}
 
+ # PyPI publishing happens in `publish-release.yml`, not here, so that
+ # `id-token: write` only needs to be granted at the entry-point job.
+ # This reusable workflow just builds and uploads the artifact; the
+ # publish-release workflow downloads it by name in a sibling job.
+ build-pypilibrary:
+ name: Build PyPI library job
+ uses: ./.github/workflows/build-pypilibrary-task.yml
+ secrets: inherit
+
  build-executable:
  name: Build executable job
  uses: ./.github/workflows/build-executable-task.yml
@@ -51,7 +60,7 @@ jobs:
  name: Publish GitHub release job
  if: ${{ inputs.github }}
  runs-on: ubuntu-latest
- needs: [get-version, build-nugetlibrary, build-executable, build-docker]
+ needs: [get-version, build-nugetlibrary, build-pypilibrary, build-executable, build-docker]
 
  steps:
 

.github/workflows/publish-release.yml

@@ -23,6 +23,47 @@ jobs:
  nuget: true
  dockerhub: true
 
+ publish-pypi:
+ name: Publish PyPI library job
+ needs: [create-release]
+ runs-on: ubuntu-latest
+ environment:
+ name: pypi
+ url: https://pypi.org/project/ptr727-projecttemplate-library/
+ # When a `permissions:` block is present, every scope not listed
+ # collapses to `none`. The job needs three things explicitly:
+ # - `id-token: write` for Trusted Publishing's OIDC exchange
+ # (pypa/gh-action-pypi-publish swaps the token for a short-lived
+ # PyPI upload token; no PYPI_API_TOKEN secret involved).
+ # - `contents: read` so `actions/checkout`-style operations and any
+ # repo metadata reads continue to work.
+ # - `actions: read` so `actions/download-artifact` can list and
+ # fetch the artifact uploaded by the build workflow earlier in
+ # the same run.
+ permissions:
+ id-token: write
+ contents: read
+ actions: read
+
+ steps:
+
+ - name: Download PyPI library build artifacts step
+ uses: actions/download-artifact@v7
+ with:
+ name: pypilibrary-build
+ path: ./dist
+
+ - name: Publish to PyPI step
+ uses: pypa/gh-action-pypi-publish@6733eb7d741f0b11ec6a39b58540dab7590f9b7d # v1.14.0
+ with:
+ packages-dir: ./dist
+ # Skip rather than fail when the version already exists on PyPI.
+ # The template ships with `__version__ = "0.0.0"` as a placeholder
+ # — the release-on-every-push model would otherwise re-upload the
+ # same version and fail the workflow until the adopter wires a
+ # real version scheme (see PyPiLibrary/README.md).
+ skip-existing: true
+
  date-badge:
  name: Create BYOB date badge job
  needs: [create-release]

.github/workflows/test-pull-request.yml

@@ -25,7 +25,7 @@ jobs:
  [ test-release ]
  if: always()
  steps:
- - name: Check workflow results
+ - name: Check workflow results step
  run: |
  exit_on_result() {
  if [[ "$2" == "failure" || "$2" == "cancelled" ]]; then

.gitignore

@@ -8,3 +8,13 @@
 .artifacts
 .DS_Store
 *.user
+
+# Python / uv
+__pycache__/
+*.py[cod]
+*.egg-info/
+.venv/
+dist/
+.pytest_cache/
+.ruff_cache/
+.pyright/

.husky/task-runner.json

@@ -27,6 +27,32 @@
  "include": [
  "**/*.cs"
  ]
+ },
+ {
+ "name": "Ruff Format",
+ "command": "bash",
+ "args": [
+ "-c",
+ "command -v uv >/dev/null 2>&1 || { echo 'uv not on PATH; skipping ruff format' >&2; exit 0; }; exec uv run --project PyPiLibrary ruff format \"$@\"",
+ "--",
+ "${staged}"
+ ],
+ "include": [
+ "PyPiLibrary/**/*.py"
+ ]
+ },
+ {
+ "name": "Ruff Check",
+ "command": "bash",
+ "args": [
+ "-c",
+ "command -v uv >/dev/null 2>&1 || { echo 'uv not on PATH; skipping ruff check' >&2; exit 0; }; exec uv run --project PyPiLibrary ruff check \"$@\"",
+ "--",
+ "${staged}"
+ ],
+ "include": [
+ "PyPiLibrary/**/*.py"
+ ]
  }
  ]
 }