Add PyPI release process

[rgarcia]

summary

• publish version tags to PyPI through GitHub OIDC trusted publishing
• create matching GitHub releases after successful publication
• document the repeatable release procedure in a repository-local agent skill
• add the initial changelog and package links

validation

• uv run ruff format --check .
• uv run ruff check .
• uv run ty check
• uv run pytest (13 passed)
• uv build
• built wheel import smoke test
• uv publish --dry-run dist/*
• actionlint .github/workflows/*.yml

---

Note

Medium Risk
Touches production publishing and release governance; mistakes could publish wrong versions, though tag/version/main checks and trusted publishing reduce exposure.

Overview
Adds an automated release pipeline triggered by v* tags on main, publishing harbor-hypeman to PyPI via GitHub OIDC (no API tokens) and creating a matching GitHub release with built artifacts.

The new Release workflow validates semver tags, ensures the tag matches pyproject.toml and points at origin/main, runs the same quality gates as CI, then uv publish with trusted publishing and gh release create.

Also introduces a release agent skill documenting version bumps, PR prep, tagging, and post-publish verification; an initial CHANGELOG (including 0.1.0); and Repository / Changelog URLs in pyproject.toml.

^{Reviewed by Cursor Bugbot for commit 8d75f78. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

Autofix Details

Bugbot Autofix prepared a fix for the issue found in the latest run.

• ✅ Fixed: Stale tagged commits can publish
  • The release workflow now requires the tagged commit SHA to exactly match origin/main HEAD, preventing older ancestor commits from being published under the same version.

Or push these changes by commenting:

@cursor push 40bc495372

Preview (40bc495372)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -37,7 +37,7 @@
           version=$(uv run --no-project --python 3.12 python -c 'import tomllib; print(tomllib.load(open("pyproject.toml", "rb"))["project"]["version"])')
           test "$GITHUB_REF_NAME" = "v$version"
           git fetch origin main
-          git merge-base --is-ancestor "$GITHUB_SHA" origin/main
+          test "$GITHUB_SHA" = "$(git rev-parse origin/main)"
       - run: uv sync --locked --dev
       - run: uv run ruff format --check .
       - run: uv run ruff check .

_{You can send follow-ups to the cloud agent here.}

[rgarcia]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

1 issue from previous review remains unresolved.

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit db5729d. Configure here.}

[rgarcia]

Fixed the BugBot finding in 8d75f78: release tags must now point exactly at the current origin/main head, matching the repository release skill.