Add tag-triggered PyPI release workflow with OIDC trusted publishing
Claude
Unverified signature
2091813
Release on `v*.*.*` tag push:
build → publish-testpypi → smoke-test → publish-pypi → github-release
Uses PyPI Trusted Publishing (OIDC), so no long-lived API tokens in
secrets. The pyproject.toml version is validated against the tag in
the build step so a mismatched tag fails fast before we burn an
immutable TestPyPI version.
`workflow_dispatch` supports a `testpypi_only` dry-run path for
testing the pipeline without touching real PyPI; pairs with
scaffolded `pypi` and `testpypi` GitHub environments (both need
`id-token: write`). One-time setup required on pypi.org +
test.pypi.org to register the trusted publisher before first run —
documented inline in the workflow header.
- Sync workflow now fails fast with a human-readable error if
HF_TOKEN is missing, malformed, or rejected by HF's whoami, so
token-rotation regressions surface in 2 lines instead of 40.
- Add MIT LICENSE file (pyproject already declares MIT but the
file itself was missing, which bare-sdist consumers and some
lints flag).
- Ignore `build/` and `dist/` so release artifacts don't pollute
the working tree.
Opt sync workflow into Node 24
Claude
Unverified signature
5512277
Silences the Node 20 deprecation warning on actions/checkout@v4. No
behavior change — GitHub will flip this default in June 2026 and we can
drop the env var then.
https://claude.ai/code/session_01Cr4KXXgtGcnGFYqxCG3Uct
Add GitHub Action to sync repo to HF Space
Claude
Unverified signature
aecc92c
Force-pushes the active branch to athurlow/qcal main on every push, so the
Space stays in sync without manual uploads. Requires an HF write token at
the GitHub repo's secret named HF_TOKEN.
https://claude.ai/code/session_01Cr4KXXgtGcnGFYqxCG3Uct
