Distribute fessctl via PyPI (Trusted Publishing)

[marevol]

Summary

Distributes fessctl via PyPI instead of Homebrew. On every v* tag push, a release workflow builds the sdist + wheel with uv build and publishes them to PyPI using Trusted Publishing (OIDC) — no long-lived API token.

fessctl is a pure-Python CLI, so PyPI (pip / pipx / uv tool) is the natural distribution channel. The OIDC Trusted Publishing flow mirrors how recotem already publishes under the CodeLibs PyPI account.

What's in this branch

• Release workflow (.github/workflows/publish.yml)
  • Tag-triggered on v* (plus a guarded workflow_dispatch that requires a v* tag ref).
  • Validates the pushed tag matches the pyproject.toml version before building.
  • build job: uv build → uploads dist/ (sdist + wheel) as a workflow artifact.
  • publish-pypi job: downloads the artifact and publishes via pypa/gh-action-pypi-publish@release/v1 from a pypi GitHub environment with id-token: write (OIDC) and Sigstore attestations.
• README — adds Method 4 (install from PyPI via pip / pipx / uv tool) and updates the install-method count.
• Version bump to 0.2.0 (the first PyPI release); uv.lock updated to match.
• PyPI packaging metadata — adds readme = "README.md", license = "Apache-2.0" (SPDX) and license-files = ["LICENSE"] so the PyPI page renders the README and shows the license; bumps the setuptools build floor to >=77.0.0 (PEP 639). Without these, the published page had no description and no license.

Operator setup (one-time, before tagging)

Trusted Publishing stores no secrets, but it must be registered once:

1. On PyPI, add a pending publisher for project fessctl:
   • Owner codelibs, Repository fessctl
   • Workflow filename publish.yml
   • Environment name pypi
2. In the codelibs/fessctl repo settings, create a GitHub Environment named pypi (optionally with required reviewers / tag protection).

Test plan

• uv build produces fessctl-0.2.0.tar.gz + fessctl-0.2.0-py3-none-any.whl.
• Built wheel exposes the fessctl = fessctl.cli:main console script (entry_points.txt).
• Wheel metadata carries License-Expression: Apache-2.0, Description-Content-Type: text/markdown and the rendered README; LICENSE bundled under dist-info/licenses/ (no setuptools deprecation warnings).
• uv lock updates only the project version (0.2.0.dev0 → 0.2.0); no dependency drift.
• pytest tests/unit — 104 passed.
• Operator: register the PyPI pending publisher and create the pypi GitHub environment.
• Operator: tag v0.2.0 and confirm the workflow publishes to PyPI.
• Operator: pip install fessctl && fessctl --help on a clean machine.