ci: auto-publish CLI to PyPI on GitHub release

[DavyMorgan]

Summary

Adds a GitHub Actions workflow that auto-publishes the CLI to PyPI when a GitHub Release is published. Uses PyPI trusted publishing (OIDC) — no stored tokens.

• Triggers on Release publication (not on every push)
• Builds sdist + wheel with python -m build
• Verifies release tag matches pyproject.toml version (e.g. tag v0.1.2 must match version = "0.1.2")
• Publishes via pypa/gh-action-pypi-publish using OIDC

Release workflow going forward

1. Bump version in pyproject.toml
2. Commit, merge to main
3. Create GitHub Release with tag v<version> → CI publishes automatically

Test plan

• Merge PR
• Create a patch release (e.g. v0.1.2) to verify end-to-end
• Confirm package appears on https://pypi.org/project/gp300/

🤖 Generated with Claude Code

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	gp300	c8a80c2	Commit Preview URL Branch Preview URL	Apr 12 2026, 05:29 PM

[Copilot]

Pull request overview

Adds a GitHub Actions release workflow to build and publish the gp300 Python CLI package to PyPI using Trusted Publishing (OIDC), with a guard that checks the GitHub Release tag version matches pyproject.toml.

Changes:

• Introduces a Publish to PyPI workflow triggered on release.published.
• Builds sdist + wheel via python -m build.
• Verifies the release tag version matches the project.version in pyproject.toml, then publishes using pypa/gh-action-pypi-publish.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[DavyMorgan]

@codex[agent] review this PR

[chatgpt-codex-connector]

To use Codex here, create a Codex account and connect to github.

[Codex]

@codex[agent] review this PR

Reviewed and added contents: read to the publish job permissions so checkout works (c8a80c2). Pytest still passes.

[chatgpt-codex-connector]

To use Codex here, create a Codex account and connect to github.

[DavyMorgan]

@copilot to review again.

[Copilot]

@copilot to review again.

The workflow looks good. The previously flagged issue (missing contents: read permission) was already addressed in commit 74efc6e — both contents: read and id-token: write are set at the job level. No further issues found.