ci: add CI and release workflows (trusted publishing)

Author: keyhankamyar

.github/workflows/ci.yml

@@ -0,0 +1,98 @@
+name: CI
+
+on:
+  push:
+    branches: [ main, master ]
+  pull_request:
+    branches: [ main, master ]
+
+# prevent overlapping runs on the same ref
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  lint-typecheck:
+    name: Lint & Type Check
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+            python-version: "3.12"
+            cache: pip
+
+      - name: Install dev tools
+        run: |
+          python -m pip install -U pip
+          python -m pip install -e ".[dev]"  # installs black, ruff, mypy, pytest, etc.
+
+      - name: Ruff (lint)
+        run: ruff check .
+
+      - name: Black (format check)
+        run: black --check .
+
+      - name: Mypy (type check)
+        run: mypy spax
+
+  tests:
+    name: Tests (py${{ matrix.python-version }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.11", "3.12", "3.13", "3.14"]
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+          cache: pip
+
+      - name: Install package (with test extras)
+        run: |
+          python -m pip install -U pip
+          # install project in editable mode + dev deps + YAML/TOML extras used in serialization tests
+          python -m pip install -e ".[dev,yaml,toml]"
+          # (intentionally NOT installing optuna; TrialSampler tests work without it)
+
+      - name: Pytest
+        run: |
+          pytest -q --cov=spax --cov-report=xml --cov-report=term-missing
+
+      - name: Upload coverage.xml artifact
+        uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: coverage-${{ matrix.python-version }}
+          path: coverage.xml
+
+  build:
+    name: Build dist & twine check
+    runs-on: ubuntu-latest
+    needs: [lint-typecheck, tests]
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+          cache: pip
+
+      - name: Build
+        run: |
+          python -m pip install -U pip build twine
+          python -m build
+          twine check dist/*
+
+      - name: Upload dist artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: spax-dist
+          path: dist/*

.github/workflows/release.yml

@@ -0,0 +1,64 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - "v*"
+  workflow_dispatch:
+
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  build-and-publish:
+    name: Build & Publish to PyPI
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write   # required for OIDC / Trusted Publishing
+      contents: read
+
+    environment:
+      name: pypi
+      url: https://pypi.org/project/spax/
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Verify tag matches project version
+        run: |
+          python - <<'PY'
+          import tomllib, pathlib, os, sys
+          tag = os.environ["GITHUB_REF_NAME"]
+          if not tag.startswith("v"):
+              sys.exit(f"Tag must start with 'v', got {tag}")
+          expected = tag[1:]
+          data = tomllib.loads(pathlib.Path("pyproject.toml").read_text())
+          proj_ver = data["project"]["version"]
+          if proj_ver != expected:
+              sys.exit(f"Version mismatch: pyproject {proj_ver} vs tag {expected}")
+          print(f"Version OK: {proj_ver}")
+          PY
+
+      - name: Build dists
+        run: |
+          python -m pip install -U pip build twine
+          python -m build
+          twine check dist/*
+
+      - name: Publish to PyPI (Trusted Publishing)
+        uses: pypa/gh-action-pypi-publish@v1.10.1
+        with:
+          verbose: true
+          print-hash: true
+
+      - name: Upload dist artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: spax-${{ github.ref_name }}-dist
+          path: dist/*