Publishing experiment-core

Public repository: FanHarvard/experiment-core. Initial version: 0.1.0. No production service is activated by publication.

One-time PyPI setup

A PyPI account owner creates a pending publisher at PyPI publishing settings with:

Use the repository's pypi environment to restrict release access. Authentication uses GitHub OIDC and PyPI Trusted Publishing; no long-lived PyPI API token belongs in this repository. See the official PyPI setup.

Release

Publish experiment-core before LDCon. LDCon pins the verified compatible core version. Update package metadata and the LDCon CI core tag together for a future version.

python -m build
python -m twine check --strict dist/*
python scripts/check_dist.py dist
python scripts/check_secrets.py
python -m pytest -q
git tag v0.1.0
git push origin v0.1.0

Create a GitHub Release for the tag to run release.yml, or dispatch that workflow at the tag. The workflow checks the tag against package metadata, builds and audits distributions, tests the wheel, and publishes through the dedicated environment. Do not reuse an uploaded PyPI version. The CI workflow also checks Python 3.10, 3.12 and 3.13.

Public/private boundary

Public: source, tests, documentation, MIT license and reviewed examples. Private: credentials, .env/.pypirc files, runtime databases, job logs, agent conversations, approval receipts, local deployment history and live service configuration. New public repositories start from a reviewed snapshot; the internal Git history is not uploaded.

The secret scanner compares findings against individually reviewed non-secret fixtures and code literals in .secrets.baseline. New findings fail CI. This complements artifact inspection; it is not a proof that arbitrary future data is safe to publish.