Add PyPiLibrary Python sibling project

.github/dependabot.yml

@@ -1,23 +1,33 @@
-# https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
-version: 2
-updates:
-
-  # main
-- package-ecosystem: "nuget"
-  target-branch: "main"
-  directory: "/"
-  schedule:
-    interval: "daily"
-  groups:
-    nuget-deps:
-      patterns:
-        - "*"
-- package-ecosystem: "github-actions"
-  target-branch: "main"
-  directory: "/"
-  schedule:
-    interval: "daily"
-  groups:
-    actions-deps:
-      patterns:
-        - "*"
+# https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
+version: 2
+updates:
+
+  - package-ecosystem: "nuget"
+    target-branch: "main"
+    directory: "/"
+    schedule:
+      interval: "daily"
+    groups:
+      nuget-deps:
+        patterns:
+          - "*"
+
+  - package-ecosystem: "github-actions"
+    target-branch: "main"
+    directory: "/"
+    schedule:
+      interval: "daily"
+    groups:
+      actions-deps:
+        patterns:
+          - "*"
+
+  - package-ecosystem: "uv"
+    target-branch: "main"
+    directory: "/PyPiLibrary"
+    schedule:
+      interval: "daily"
+    groups:
+      pypi-deps:
+        patterns:
+          - "*"

.github/workflows/build-pypilibrary-task.yml

@@ -0,0 +1,71 @@
+name: Build PyPI library task
+
+# This reusable workflow only builds the PyPI library and uploads the
+# wheel + sdist as a workflow-run artifact. It does NOT publish to PyPI.
+# Publishing happens directly in `publish-release.yml` so that the
+# `id-token: write` permission required by Trusted Publishing is granted
+# at the entry-point job, not propagated through a reusable-workflow
+# chain (which would require every caller — including `test-release-task.yml`
+# during PR validation — to also grant id-token write, even when no
+# publishing happens).
+
+on:
+  workflow_call:
+    outputs:
+      artifact-name:
+        value: ${{ jobs.build-pypilibrary.outputs.artifact-name }}
+      artifact-id:
+        value: ${{ jobs.build-pypilibrary.outputs.artifact-id }}
+
+jobs:
+
+  build-pypilibrary:
+    name: Build PyPI library project job
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: ./PyPiLibrary
+    outputs:
+      artifact-name: pypilibrary-build
+      artifact-id: ${{ steps.artifact-upload-step.outputs.artifact-id }}
+
+    steps:
+
+      - name: Checkout code step
+        uses: actions/checkout@v6
+
+      - name: Setup uv step
+        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        with:
+          # Pin uv to the same version as `.devcontainer/post-create.sh`
+          # (UV_VERSION) so CI and local devcontainer behavior cannot drift
+          # — same uv resolves the same lockfile the same way. Bump in lock-
+          # step with the devcontainer pin.
+          version: "0.11.8"
+          enable-cache: true
+          cache-dependency-glob: "PyPiLibrary/uv.lock"
+
+      - name: Sync dependencies step
+        run: uv sync --all-groups --frozen
+
+      - name: Lint with ruff step
+        run: uv run ruff check
+
+      - name: Verify formatting with ruff step
+        run: uv run ruff format --check
+
+      - name: Type check with pyright step
+        run: uv run pyright
+
+      - name: Run pytest step
+        run: uv run pytest
+
+      - name: Build sdist and wheel step
+        run: uv build
+
+      - name: Upload build artifacts step
+        id: artifact-upload-step
+        uses: actions/upload-artifact@v6
+        with:
+          name: pypilibrary-build
+          path: PyPiLibrary/dist/*

.github/workflows/build-release-task.yml

@@ -34,6 +34,15 @@ jobs:
       # Conditional push to NuGet.org
       push: ${{ inputs.nuget }}
 
+  # PyPI publishing happens in `publish-release.yml`, not here, so that
+  # `id-token: write` only needs to be granted at the entry-point job.
+  # This reusable workflow just builds and uploads the artifact; the
+  # publish-release workflow downloads it by name in a sibling job.
+  build-pypilibrary:
+    name: Build PyPI library job
+    uses: ./.github/workflows/build-pypilibrary-task.yml
+    secrets: inherit
+
   build-executable:
     name: Build executable job
     uses: ./.github/workflows/build-executable-task.yml
@@ -51,7 +60,7 @@ jobs:
     name: Publish GitHub release job
     if: ${{ inputs.github }}
     runs-on: ubuntu-latest
-    needs: [get-version, build-nugetlibrary, build-executable, build-docker]
+    needs: [get-version, build-nugetlibrary, build-pypilibrary, build-executable, build-docker]
 
     steps:
 

.github/workflows/publish-release.yml

@@ -23,6 +23,47 @@ jobs:
       nuget: true
       dockerhub: true
 
+  publish-pypi:
+    name: Publish PyPI library job
+    needs: [create-release]
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/project/ptr727-projecttemplate-library/
+    # When a `permissions:` block is present, every scope not listed
+    # collapses to `none`. The job needs three things explicitly:
+    #   - `id-token: write` for Trusted Publishing's OIDC exchange
+    #     (pypa/gh-action-pypi-publish swaps the token for a short-lived
+    #     PyPI upload token; no PYPI_API_TOKEN secret involved).
+    #   - `contents: read` so `actions/checkout`-style operations and any
+    #     repo metadata reads continue to work.
+    #   - `actions: read` so `actions/download-artifact` can list and
+    #     fetch the artifact uploaded by the build workflow earlier in
+    #     the same run.
+    permissions:
+      id-token: write
+      contents: read
+      actions: read
+
+    steps:
+
+      - name: Download PyPI library build artifacts step
+        uses: actions/download-artifact@v7
+        with:
+          name: pypilibrary-build
+          path: ./dist
+
+      - name: Publish to PyPI step
+        uses: pypa/gh-action-pypi-publish@6733eb7d741f0b11ec6a39b58540dab7590f9b7d # v1.14.0
+        with:
+          packages-dir: ./dist
+          # Skip rather than fail when the version already exists on PyPI.
+          # The template ships with `__version__ = "0.0.0"` as a placeholder
+          # — the release-on-every-push model would otherwise re-upload the
+          # same version and fail the workflow until the adopter wires a
+          # real version scheme (see PyPiLibrary/README.md).
+          skip-existing: true
+
   date-badge:
     name: Create BYOB date badge job
     needs: [create-release]

.github/workflows/test-pull-request.yml

@@ -25,7 +25,7 @@ jobs:
       [ test-release ]
     if: always()
     steps:
-      - name: Check workflow results
+      - name: Check workflow results step
         run: |
           exit_on_result() {
             if [[ "$2" == "failure" || "$2" == "cancelled" ]]; then

.gitignore

@@ -8,3 +8,13 @@
 .artifacts
 .DS_Store
 *.user
+
+# Python / uv
+__pycache__/
+*.py[cod]
+*.egg-info/
+.venv/
+dist/
+.pytest_cache/
+.ruff_cache/
+.pyright/

.husky/task-runner.json

@@ -27,6 +27,32 @@
             "include": [
                 "**/*.cs"
             ]
+        },
+        {
+            "name": "Ruff Format",
+            "command": "bash",
+            "args": [
+                "-c",
+                "command -v uv >/dev/null 2>&1 || { echo 'uv not on PATH; skipping ruff format' >&2; exit 0; }; exec uv run --project PyPiLibrary ruff format \"$@\"",
+                "--",
+                "${staged}"
+            ],
+            "include": [
+                "PyPiLibrary/**/*.py"
+            ]
+        },
+        {
+            "name": "Ruff Check",
+            "command": "bash",
+            "args": [
+                "-c",
+                "command -v uv >/dev/null 2>&1 || { echo 'uv not on PATH; skipping ruff check' >&2; exit 0; }; exec uv run --project PyPiLibrary ruff check \"$@\"",
+                "--",
+                "${staged}"
+            ],
+            "include": [
+                "PyPiLibrary/**/*.py"
+            ]
         }
     ]
 }