Restore PyPI attestations by making release.yml top-level

.github/workflows/release.yml

@@ -1,45 +1,36 @@
 name: Release gate & publish
 
 on:
-  workflow_call:
-    inputs:
-      package-dir:
-        description: Import package directory to lint/type-check (passed to ruff/pyright)
-        required: true
-        type: string
-      python-version:
-        description: Python version to build/test/publish with
-        required: false
-        type: string
-        default: "3.13"
-      pypi-project-url:
-        description: PyPI project URL shown on the environment deployment
-        required: true
-        type: string
-      environment-name:
-        description: Protected GitHub environment gating the publish step
-        required: false
-        type: string
-        default: pypi
+  push:
+    tags:
+      - "v*.*.*"
+
+env:
+  PACKAGE_DIR: tesla_fleet_api
+  PYTHON_VERSION: "3.13"
+  PYPI_PROJECT_URL: https://pypi.org/p/tesla_fleet_api
+  ENVIRONMENT_NAME: pypi
 
 jobs:
   gate:
     name: Full CI gate
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@v4
       - name: Install uv
         uses: astral-sh/setup-uv@v5
         with:
           enable-cache: true
-      - name: Set up Python ${{ inputs.python-version }}
-        run: uv python install ${{ inputs.python-version }}
+      - name: Set up Python ${{ env.PYTHON_VERSION }}
+        run: uv python install ${{ env.PYTHON_VERSION }}
       - name: Install dependencies
-        run: uv sync --python ${{ inputs.python-version }}
+        run: uv sync --python ${{ env.PYTHON_VERSION }}
       - name: Ruff
-        run: uv run ruff check ${{ inputs.package-dir }} tests
+        run: uv run ruff check ${{ env.PACKAGE_DIR }} tests
       - name: Pyright
-        run: uv run pyright ${{ inputs.package-dir }}
+        run: uv run pyright ${{ env.PACKAGE_DIR }}
       - name: Pytest
         run: uv run pytest tests -q
       - name: Build
@@ -57,8 +48,8 @@ jobs:
     needs: gate
     runs-on: ubuntu-latest
     environment:
-      name: ${{ inputs.environment-name }}
-      url: ${{ inputs.pypi-project-url }}
+      name: ${{ env.ENVIRONMENT_NAME }}
+      url: ${{ env.PYPI_PROJECT_URL }}
     permissions:
       id-token: write
     steps:
@@ -69,9 +60,6 @@ jobs:
           path: dist/
       - name: Publish distribution to PyPI
         uses: pypa/gh-action-pypi-publish@release/v1
-        with:
-          # Reusable-workflow identity mismatch breaks PyPI attestation verification (PEP 740).
-          attestations: false
 
   github-release:
     name: Upload distribution to GitHub Release

AGENTS.md

@@ -93,7 +93,7 @@ Scope flags on `TeslaFleetApi.__init__` control which submodules are instantiate
 
 ### Release Process
 
-No release-please or version-bump automation. To ship: bump `version` in `pyproject.toml` and `__version__` in `tesla_fleet_api/__init__.py` in a `Bump version to X.Y.Z` commit on `main`, then push a matching `vX.Y.Z` tag. `.github/workflows/python-publish.yml` only triggers on that tag push and calls the reusable `.github/workflows/release.yml` workflow, which reruns the full CI gate (ruff, pyright, pytest, `uv build` + `twine check`) on the exact tagged commit, then requires approval on the `pypi` GitHub environment (required reviewers configured via the Environments API - there's no repo Settings UI for it) before publishing via the existing PyPA OIDC trusted-publishing action and cutting the GitHub Release. `release.yml` is written as a `workflow_call` reusable workflow (parameterized by `package-dir`/`pypi-project-url`) specifically so sibling repos can call it with `uses: Teslemetry/python-tesla-fleet-api/.github/workflows/release.yml@main` instead of copying the job.
+No release-please or version-bump automation. To ship: bump `version` in `pyproject.toml` and `__version__` in `tesla_fleet_api/__init__.py` in a `Bump version to X.Y.Z` commit on `main`, then push a matching `vX.Y.Z` tag. `.github/workflows/release.yml` triggers directly on that tag push: it reruns the full CI gate (ruff, pyright, pytest, `uv build` + `twine check`) on the exact tagged commit, then requires approval on the `pypi` GitHub environment (required reviewers configured via the Environments API - there's no repo Settings UI for it) before publishing via the existing PyPA OIDC trusted-publishing action (with PEP 740 attestations) and cutting the GitHub Release. It is a plain top-level workflow, not a `workflow_call` reusable one - the PyPI trusted publisher for this project is configured as workflow `release.yml` + environment `pypi`, and a reusable-workflow caller's signing identity doesn't match that publisher/attestation identity. Sibling repos each carry their own local copy of this workflow rather than calling it cross-repo.
 
 ### Error Handling