ci: add and harden SDK release workflows

[calvin-archastro]

What changed

This updates the Python SDK CI, release, publish, and regeneration workflows so they use locked dependency inputs instead of floating installs:

• Pins GitHub Actions by commit SHA and gives CI read-only repository permissions.
• Expands CI to Python 3.11, 3.12, and 3.13.
• Uses npm ci --ignore-scripts plus npm audit --audit-level=moderate for Node tooling.
• Locks @archastro/sdk-generator in package-lock.json and removes the manual @latest generator input.
• Runs SDK regeneration from the local locked generator binary instead of npx.
• Runs contract tests against the local locked Prism binary instead of npx.
• Pins uv to 0.11.3 with the release checksum in every workflow.
• Uses uv sync --locked --all-extras and builds with uv build --no-build-isolation.
• Adds locked build-backend dependencies to uv.lock and smoke-tests the built wheel with hash-enforced runtime requirements.
• Updates README publish/regeneration instructions to match the locked workflow path.

Diagrams

sequenceDiagram
  participant Dev as Developer
  participant GH as GitHub Actions
  participant NPM as npm registry
  participant UV as uv resolver
  participant Tests as SDK tests
  participant PyPI as PyPI
  Dev->>GH: push PR branch
  GH->>NPM: npm ci with scripts disabled
  GH->>NPM: npm audit moderate gate
  GH->>UV: install pinned uv with checksum
  GH->>UV: uv sync locked
  GH->>Tests: run lint unit harness contract
  GH->>UV: build with no isolation
  GH->>UV: export locked runtime requirements
  GH->>Tests: install hashes then local wheel no deps
  alt release tag
    GH->>PyPI: publish prebuilt dist by trusted publisher
  else regenerate SDK
    GH->>Tests: run locked local sdk generator
  end

Loading

classDiagram
  class CIWorkflow {
    String python_matrix_3_11_3_12_3_13
    String permissions_contents_read
    String npm_ci_ignore_scripts
    String npm_audit_moderate
    String uv_sync_locked
    String wheel_smoke_hashes
  }
  class ReleaseWorkflow {
    String npm_ci_ignore_scripts
    String npm_audit_moderate
    String uv_sync_locked
    String wheel_smoke_hashes
  }
  class RegenerateWorkflow {
    String npm_ci_ignore_scripts
    String local_sdk_generator
    String package_lock_version
  }
  class PublishWorkflow {
    String uv_sync_locked
    String build_no_isolation
    String trusted_publisher
  }
  class PackageLocks {
    String package_lock_json
    String uv_lock
    String hatchling_locked
    String sdk_generator_locked
  }
  CIWorkflow --> PackageLocks : uses
  ReleaseWorkflow --> PackageLocks : uses
  RegenerateWorkflow --> PackageLocks : uses
  PublishWorkflow --> PackageLocks : uses

Loading

Scope indicator

CI/tooling-only for the Python SDK repository. There are no intended runtime SDK API changes; the only test-code change is how the contract harness locates its locked local Prism binary.

Risk assessment

Low to medium. The production SDK runtime is not intentionally changed, but release, publish, and regeneration paths are stricter now. The main risk is a workflow environment mismatch or a future generated overwrite of the local Prism launcher change. Local verification covered the workflow commands, lockfile behavior, contract tests, and wheel install path.

User impact

SDK users should see no API or behavior change. Maintainers get reproducible CI, safer release and regeneration jobs, and less exposure to supply-chain drift from floating Node or Python build inputs.

Testing

• npm ci --ignore-scripts
• npm audit --audit-level=moderate
• uv sync --locked --all-extras
• uv run ruff check
• uv run ruff format --check
• uv run pytest tests/test_http_client.py src/archastro/phx_channel/tests/test_unit.py
• uv run pytest tests/harness
• ARCHASTRO_RUN_CHANNEL_CONTRACT_TESTS=1 uv run pytest tests/contract
• Python 3.11 focused unit run with UV_PROJECT_ENVIRONMENT=/tmp/archastro-python-venv-311-supplychain
• Python 3.12 focused unit run with UV_PROJECT_ENVIRONMENT=/tmp/archastro-python-venv-312-supplychain
• uv build --no-build-isolation
• uv export --locked --no-dev --no-emit-project --format requirements.txt --output-file dist/runtime-requirements.txt
• uv pip install --python .wheel-smoke --require-hashes -r dist/runtime-requirements.txt
• uv pip install --python .wheel-smoke --no-deps dist/*.whl
• .wheel-smoke/bin/python -c "import archastro.platform; import archastro.phx_channel"
• Negative hash test confirmed uv pip install --require-hashes rejects a tampered requirement hash.
• Workflow YAML parse check for all modified workflows.
• git diff --check --cached

Follow-ups and known issues

• tests/contract/conftest.py is generated. The local Prism binary behavior should be upstreamed into @archastro/sdk-generator so future SDK regeneration preserves it.
• GitHub Actions should still validate this on the hosted Ubuntu runners after push.

[archastro]

Reviewed b4c5335. No findings.

---

_{Reply @archastro <verb>: review · do <pattern> · don't <pattern> · forget <slug> · list}