feat(ci): unify PyPI/npm release workflow with dry-run support

[cdoern]

What does this PR do?

Consolidate all llama-stack package publishing into a single workflow with support for manual testing and dry-run modes.

Currently pypi.yml just builds, validates, and publishes llama-stack and llama-stack-api on schedule and release. If we truly want to move away from llama-stack-ops, we need to add client building+publishing as well

Key changes:

• Add workflow_dispatch trigger with configurable inputs:

  • dry_run: test-pypi (default), build-only, or off (production)
  • version: optional version override for RC builds
  • packages: all, llama-stack-only, or clients-only
  • client_ref: git ref for external client repos

• Extend build matrix to include external client packages:

  • llama-stack-client-python (from llamastack/llama-stack-client-python)
  • llama-stack-client-typescript (from llamastack/llama-stack-client-typescript)

• Merge publish-test-pypi and publish-pypi into single publish-packages job

  • Dynamically selects target registry based on dry_run and event type
  • Maintains max-parallel: 1 for correct dependency ordering
  • npm packages use npm pack for dry-run, npm publish for production

• Add graceful degradation for missing secrets (NPM_TOKEN)

  • Errors on npm production publish if NPM_TOKEN not configured

• Add comprehensive header documentation explaining:

  • Required secrets and how to create them
  • All workflow inputs and their purposes
  • Publish flow and dependencies

Publish behavior by trigger:

• push/PR: build + test only
• schedule: build + test + test.pypi.org
• release: published: build + test + pypi.org + npm
• workflow_dispatch: configurable via dry_run input

Test Plan

once merged, test dry-run workflow dispatch.

[franciscojavierarceo]

nice

[cdoern]

found some weird issues with our version tagging, I will fix it by properly tagging upon the next release using this action. We then can use setup tools auto versioning but until then we need the workflow in the most recent commit on this PR.

[cdoern]

@Mergifyio backport release-0.4.x

[mergify]

backport release-0.4.x

✅ Backports have been created

Details

• #4785 feat(ci): unify PyPI/npm release workflow with dry-run support (backport #4774) has been created for branch release-0.4.x but encountered conflicts

Cherry-pick of a840629 has failed:

On branch mergify/bp/release-0.4.x/pr-4774
Your branch is up to date with 'origin/release-0.4.x'.

You are currently cherry-picking commit a8406295.
  (fix conflicts and run "git cherry-pick --continue")
  (use "git cherry-pick --skip" to skip this patch)
  (use "git cherry-pick --abort" to cancel the cherry-pick operation)

Changes to be committed:
	modified:   .github/workflows/pypi.yml

Unmerged paths:
  (use "git add <file>..." to mark resolution)
	both modified:   .github/workflows/README.md
	both modified:   pyproject.toml
	both modified:   src/llama_stack_api/pyproject.toml
	both modified:   uv.lock

To fix up this pull request, you can check it out locally. See documentation: https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/checking-out-pull-requests-locally