ci: pypi and testpypi environments #10

Sub-issue of #8. This needs a repository admin. It works like the sdk-bot environment in #7, but these two environments hold no secrets.

Why

#8 publishes to PyPI with trusted publishing. PyPI issues an upload token only to a job that runs release.yml in the pypi environment (#9 configures that on the PyPI side). Limiting the environment to main means only reviewed, merged code can publish. A branch, a fork PR or a pushed tag can't. Core's pypi environment is set up the same way: it allows the branch main only, with no required reviewers. Merging the reviewed bump PR is the approval.

Steps

1. Create the pypi environment

In the UI: sdk-python → Settings → Environments → New environment, name it pypi.

• Deployment branches and tags: choose Selected branches and tags and add the branch rule main. Add no tag rules: publishing runs from main, not from tags.
• Required reviewers: none, as in core. Add the SDK maintainers only if we want a second approval after the merge. The job then waits for that approval.
• Secrets and variables: none.

Or with gh:

gh api -X PUT repos/ai-openshell/sdk-python/environments/pypi \
  -F 'deployment_branch_policy[protected_branches]=false' \
  -F 'deployment_branch_policy[custom_branch_policies]=true'
gh api -X POST repos/ai-openshell/sdk-python/environments/pypi/deployment-branch-policies \
  -f name=main -f type=branch

2. Create the testpypi environment

The same settings, with the name testpypi. #8 uses it for the first, manual dry run against test.pypi.org.

gh api -X PUT repos/ai-openshell/sdk-python/environments/testpypi \
  -F 'deployment_branch_policy[protected_branches]=false' \
  -F 'deployment_branch_policy[custom_branch_policies]=true'
gh api -X POST repos/ai-openshell/sdk-python/environments/testpypi/deployment-branch-policies \
  -f name=main -f type=branch

3. Check the setup

for env in pypi testpypi; do
  echo "$env: $(gh api repos/ai-openshell/sdk-python/environments/$env/deployment-branch-policies \
    --jq '[.branch_policies[] | "\(.type):\(.name)"] | join(",")')"
done
# pypi: branch:main
# testpypi: branch:main
gh secret list --repo ai-openshell/sdk-python --env pypi
# (empty)

The first real use is the TestPyPI dry run in #8.

Done when

• The pypi and testpypi environments exist, only the main branch can deploy to them, and they have no secrets.