Publishing

codexloop ships via Trusted Publishing (OIDC). No long-lived PyPI API tokens are stored in GitHub.

Environments

GitHub Environment	Index	Branch / workflow
testpypi	https://test.pypi.org	develop → .github/workflows/publish-testpypi.yml
pypi	https://pypi.org	main → .github/workflows/release-please.yml (publish-pypi)

Create them once (repo Settings → Environments), or via API as in the setup checklist below.

One-time Trusted Publisher setup

Do this before the first upload (pending publisher), signed in as the PyPI owner account.

TestPyPI

1. Open https://test.pypi.org/manage/account/publishing/
2. Add a pending publisher:
3. PyPI Project Name: codexloop
4. Owner: adammatthewsteinberger
5. Repository name: codexloop
6. Workflow name: publish-testpypi.yml
7. Environment name: testpypi

PyPI

1. Open https://pypi.org/manage/account/publishing/
2. Add a pending publisher:
3. PyPI Project Name: codexloop
4. Owner: adammatthewsteinberger
5. Repository name: codexloop
6. Workflow name: release-please.yml
7. Environment name: pypi

Release flow

feat/* ──PR──► develop ──auto TestPyPI──► main ──release-please──► PyPI

1. Land work on develop. Every push to develop runs Publish TestPyPI (publish-testpypi.yml). Do not publish TestPyPI from main.
2. Smoke-install from TestPyPI if needed: pip install -i https://test.pypi.org/simple/ --pre codexloop.
3. Merge develop → main when ready.
4. release-please opens a release PR against main only (target-branch: main in .github/workflows/release-please.yml).
5. Squash-merge the release PR → GitHub Release + tag → publish-pypi uploads to PyPI. Do not open or merge chore(develop): release … PRs.

Manual PyPI retry (Trusted Publishing, main / tagged release only):

gh workflow run release-please.yml -f publish_to_pypi=true

Manual TestPyPI from develop:

gh workflow run "Publish TestPyPI" --ref develop

Local dry-run (no upload)

python -m build
twine check --strict dist/*