Skip to main content

​
Python — PyPI

apowerb is published to PyPI from GitHub Actions using trusted publishing (OIDC): the workflow authenticates as the repository itself, so no long-lived API token is stored in the project. The workflow lives in .github/workflows/pypi-publish.yml and runs on a release.

​
npm — the TypeScript SDK

The SDK is published from GitHub Actions with npm trusted publishing, and the resulting package carries a provenance attestation naming the repository, the workflow, the tag and the runner.
Two things are easy to get wrong here:
  • npm refuses to declare a trusted publisher for a package that does not exist yet. The very first publish has to happen another way; only then can trusted publishing be configured. PyPI does not have this constraint.
  • --provenance does not work from a local machine. Provenance requires a hosted CI runner.

​
Versioning

Versions follow semantic versioning. The changelog is the GitHub releases page of each repository.

Related topics

DatabaseArchitectureUpdate AgentCreate AgentGet Eval