[drkjc]

Changes

• publish.yml: on a v* tag, checks the tag matches pyproject.toml and SDK_VERSION, the commit is on main, and CHANGELOG.md has a released section for the version
• Build job (no id-token): builds the sdist and wheel, runs the tests, audits runtime dependencies with pip-audit (fails on any known advisory), writes a CycloneDX SBOM and SHA-256 checksums, and scans the distributions with gitleaks
• Publish job (release environment, id-token: write and contents: read only): verifies checksums, fails if the version is already on PyPI, and publishes with PyPI trusted publishing via pypa/gh-action-pypi-publish, pinned by commit SHA, with PEP 740 attestations
• Release job: creates the GitHub Release with the CHANGELOG notes, distributions, SHA256SUMS and SBOM

[Samy-O7]

Approving. Checked:

• The structure matches the node SDK's publish workflow: no id-token in the build job, a release environment gate, checksums, an SBOM, a gitleaks scan of the sdist and wheel, and a GitHub Release with the CHANGELOG notes.
• pypa/gh-action-pypi-publish is pinned to the v1.14.3 commit (the fix for GHSA-5xjx-3w67-w9x9). For this repository it builds its container from its own Dockerfile with hash-pinned requirements; the python:3.13-slim base image is the one input the pin doesn't freeze.
• Locally, python -m build gives a wheel with only the composer package and its license files, and an sdist that adds the tests and setup files. gitleaks 8.30.1 with the workflow's flags finds no leaks, pip-audit on the wheel's runtime environment exits 0, and cyclonedx-py 7.5.0 accepts the workflow's flags.

Before tagging, CHANGELOG.md needs a released ## 1.0.0 heading, and the PyPI pending publisher should be bound to this repository, publish.yml and the release environment.

Optional: setuptools>=77.0 in build-system.requires floats (84.2.1 today). Pinning it would make release builds reproducible.