From 53fa49403979d6b70deb2982f3b0cd61dc9fb2b7 Mon Sep 17 00:00:00 2001
From: Sushant Gautam <susant.gautam@gmail.com>
Date: Tue, 3 Nov 2026 23:27:03 +0100
Subject: [PATCH 1/2] ci: publish to PyPI on GitHub release only

New pypi.yml runs on release: published. It fails if the tag differs from
the package version, runs ruff and tests, builds, twine check --strict, then
uploads via PyPI trusted publishing (OIDC, environment "pypi", no stored token).
---
 .github/workflows/pypi.yml | 59 ++++++++++++++++++++++++++++++++++++++
 README.md                  | 10 +++++++
 2 files changed, 69 insertions(+)
 create mode 100644 .github/workflows/pypi.yml

diff --git a/.github/workflows/pypi.yml b/.github/workflows/pypi.yml
new file mode 100644
index 0000000..79cc18b
--- /dev/null
+++ b/.github/workflows/pypi.yml
@@ -0,0 +1,59 @@
+name: Publish to PyPI
+
+# Runs only when a GitHub Release is published (not on push or PR).
+# Release flow: bump `version` in pyproject.toml and src/verdi/__init__.py,
+# merge, then publish a release tagged v<version> (e.g. v0.1.1).
+on:
+  release:
+    types: [published]
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+      - name: Install
+        run: pip install -e ".[dev]" build twine
+      - name: Tag must match package version
+        run: |
+          tag="${GITHUB_REF_NAME#v}"
+          pkg=$(python -c "import tomllib; print(tomllib.load(open('pyproject.toml','rb'))['project']['version'])")
+          mod=$(python -c "import verdi; print(verdi.__version__)")
+          echo "tag=$tag pyproject=$pkg verdi.__version__=$mod"
+          if [ "$tag" != "$pkg" ] || [ "$tag" != "$mod" ]; then
+            echo "::error::Release tag v$tag does not match pyproject ($pkg) / __version__ ($mod)"
+            exit 1
+          fi
+      - name: Ruff
+        run: ruff check .
+      - name: Tests
+        run: python -m pytest
+      - name: Build
+        run: python -m build
+      - name: Check distributions
+        run: twine check --strict dist/*
+      - uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
+  publish:
+    needs: build
+    runs-on: ubuntu-latest
+    # Trusted publishing (OIDC): no API token stored in GitHub. Requires a
+    # trusted publisher on PyPI for SimulaMet/Verdi, workflow pypi.yml,
+    # environment "pypi".
+    environment:
+      name: pypi
+      url: https://pypi.org/project/verdi-agents/
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+      - uses: pypa/gh-action-pypi-publish@release/v1
diff --git a/README.md b/README.md
index 8092faa..be604a6 100644
--- a/README.md
+++ b/README.md
@@ -179,6 +179,16 @@ alongside the individual run reports. See the [researcher guide](docs/RESEARCHER
 
 ---
 
+## Releasing
+
+1. Bump `version` in `pyproject.toml` and `__version__` in `src/verdi/__init__.py`, and merge.
+2. Publish a GitHub Release tagged `v<version>` (for example `v0.1.1`).
+
+The [Publish to PyPI](.github/workflows/pypi.yml) workflow runs only on a
+published release. It checks the tag matches the version, runs lint and tests,
+builds, and uploads `verdi-agents` through PyPI trusted publishing (no token
+stored in GitHub).
+
 ## Research principles
 
 We distinguish **declared** values, **private** behavioral preferences, and

From 4664c9605ba2e3ab5b50de657f3aec87275e1b3a Mon Sep 17 00:00:00 2001
From: Sushant Gautam <susant.gautam@gmail.com>
Date: Tue, 3 Nov 2026 23:27:57 +0100
Subject: [PATCH 2/2] ci: run CI for main only

dev/institutional-recovery was merged in #4 and deleted; all work lands on main.
---
 .github/workflows/ci.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 572b0d7..9c3be31 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -2,9 +2,9 @@ name: CI
 
 on:
   pull_request:
-    branches: [main, dev/institutional-recovery]
+    branches: [main]
   push:
-    branches: [main, dev/institutional-recovery]
+    branches: [main]
 
 jobs:
   checks: