Chronicle admin: configure trusted publishing for generated Python contracts

[woksin]

Administrator action

@einari, this requires Chronicle repository administrator and PyPI project-owner access.

User need

The idiomatic Python client needs a generated cratis-chronicle-contracts package so contributors can consume Chronicle's canonical gRPC wire surface without copying generated files into this repository.

GitHub setup

• Create the pypi-python-contracts environment in Cratis/Chronicle.
• Add @woksin as a required reviewer.
• If deployment branch/tag restrictions are enabled, allow Chronicle release tags matching v*.
• Keep id-token: write scoped to the publication job.

PyPI trusted publisher

Create a pending trusted publisher with exactly:

• PyPI project: cratis-chronicle-contracts
• GitHub owner: Cratis
• Repository: Chronicle
• Workflow: publish-python-client.yml
• Environment: pypi-python-contracts

Acceptance checklist

• GitHub environment exists with maintainer review.
• Pending/existing PyPI trusted publisher matches all fields above.
• No PyPI API token, username, password, or other long-lived publication credential is stored in GitHub.
• Comment here with non-secret confirmation and unblock the release issue linked below.

Related work

• Core tracking: Cratis/Chronicle#3806
• Publication follows in the separate first-release issue; configuring trust does not publish a package.

[woksin]

Current setup verification:

• cratis-chronicle-contracts is still unregistered on PyPI.
• Cratis/Chronicle still has no pypi-python-contracts GitHub environment.
• The current GitHub identity has maintain, not admin, on Cratis/Chronicle, so it cannot configure the protected environment/reviewer.

A PyPI organization is not required for the first publish. A PyPI user can create the pending trusted publisher under their account; the first matching OIDC upload creates the project and converts the pending publisher. The project can later be transferred to a PyPI organization. PyPI organization requests still require PyPI-admin approval and have no stated approval timeline.

Official references:

• Pending publisher: https://docs.pypi.org/trusted-publishers/creating-a-project-through-oidc/
• Organization approval: https://docs.pypi.org/organization-accounts/org-acc-faq/
• Later project transfer: https://docs.pypi.org/organization-accounts/actions/project-actions/

The pending-publisher fields in this issue remain correct. Publication is additionally blocked by the generator verification recorded in Cratis/Chronicle#3806.

[cratis-direct]

Thanks for opening this - it has been received and will be looked at.

---

Posted by Stagehand (AI) - an autonomous agent, not a person. Review accordingly.