Greptile Summary

This PR successfully migrates the PyPI release workflow from API token authentication to OpenID Connect (OIDC) Trusted Publishing, significantly improving security by eliminating the need for long-lived API tokens. The workflow now operates in three isolated stages: build, comprehensive smoke testing across all supported Python versions (3.8-3.14), and publishing to PyPI.

Key improvements:

• Security enhancement: Replaced TWINE_PASSWORD secret with OIDC-based Trusted Publishing using id-token: write permission
• Better testing strategy: Added comprehensive smoke tests that verify the actual package importability and module accessibility rather than just running pytest in the build environment
• Multi-version validation: Tests both wheel and sdist distributions across all 7 supported Python versions (3.8-3.14) before publishing
• Proper job isolation: Separated build, test, and publish concerns with artifact passing between stages

The smoke test suite is thorough, covering package imports, version metadata, type markers (py.typed), client instantiation (both sync and async), all module accessibility, core type imports, exception classes, and dependency availability.

Confidence Score: 5/5

• This PR is safe to merge with no security or functional risks
• The changes follow industry best practices for PyPI publishing, improve security by eliminating API tokens, add comprehensive pre-release validation across all supported Python versions, and properly implement OIDC Trusted Publishing with correct permissions scoping
• No files require special attention

Important Files Changed

Sequence Diagram

sequenceDiagram
 participant GH as GitHub (Release Event)
 participant Build as Build Job
 participant Artifacts as GitHub Artifacts
 participant Smoke as Smoke Test Job (Matrix 3.8-3.14)
 participant Publish as Publish Job
 participant PyPI as PyPI (OIDC)
 GH->>Build: Trigger on release published
 Build->>Build: Checkout code
 Build->>Build: Install uv
 Build->>Build: uv build (wheel + sdist)
 Build->>Artifacts: Upload dist/ artifacts
 
 Artifacts->>Smoke: Download dist/ artifacts
 Note over Smoke: Runs in parallel for each Python version
 Smoke->>Smoke: Install uv
 Smoke->>Smoke: Test wheel: uv run --isolated --with dist/*.whl
 Smoke->>Smoke: Test sdist: uv run --isolated --with dist/*.tar.gz
 Smoke->>Smoke: Verify imports, types, clients, modules
 
 alt All smoke tests pass
 Artifacts->>Publish: Download dist/ artifacts
 Publish->>Publish: Install uv
 Publish->>PyPI: uv publish (Trusted Publishing OIDC)
 PyPI-->>Publish: Package published
 else Any smoke test fails
 Smoke-->>GH: Workflow fails, no publish
 end