Distribute fessctl via PyPI (Trusted Publishing)

.github/workflows/publish.yml

@@ -0,0 +1,68 @@
+name: publish
+
+on:
+  push:
+    tags: ['v*']
+  workflow_dispatch:
+
+# Least-privilege: read-only by default; each job adds only what it needs.
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Assert tag trigger
+        if: github.event_name == 'workflow_dispatch'
+        run: |
+          case "${GITHUB_REF}" in
+            refs/tags/v*) ;;
+            *) echo "publish.yml workflow_dispatch requires a v* tag ref"; exit 1 ;;
+          esac
+
+      - uses: actions/checkout@v6
+
+      - uses: astral-sh/setup-uv@v8.2.0
+        with:
+          enable-cache: true
+
+      - name: Validate tag matches pyproject version
+        if: github.event_name == 'push'
+        run: |
+          set -euo pipefail
+          TAG="${GITHUB_REF#refs/tags/v}"
+          PROJECT_VERSION=$(uv run --no-project --python 3.13 python -c \
+            "import tomllib; print(tomllib.load(open('pyproject.toml','rb'))['project']['version'])")
+          if [ "$TAG" != "$PROJECT_VERSION" ]; then
+            echo "::error::Tag v$TAG does not match pyproject.toml version $PROJECT_VERSION"
+            exit 1
+          fi
+
+      - name: Build sdist + wheel
+        run: uv build
+
+      - uses: actions/upload-artifact@v7
+        with:
+          name: dist
+          path: dist/
+
+  publish-pypi:
+    needs: build
+    runs-on: ubuntu-24.04
+    environment:
+      name: pypi
+      url: https://pypi.org/p/fessctl
+    permissions:
+      id-token: write      # Required for OIDC trusted publishing
+      attestations: write  # Required for Sigstore attestations (pypa/gh-action-pypi-publish v1.10+)
+    steps:
+      - uses: actions/download-artifact@v8
+        with:
+          name: dist
+          path: dist/
+
+      - uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          packages-dir: dist/
+          generate-attestations: true

README.md

@@ -15,7 +15,7 @@ Fess is an open-source enterprise search server based on OpenSearch.
 
 ## Installation and Usage
 
-There are three ways to use fessctl:
+There are four ways to use fessctl:
 
 ### Method 1: Using Pre-built Docker Image
 
@@ -94,9 +94,34 @@ fessctl user list
 fessctl webconfig create --name TestConfig --url https://test.config.com/
 ```
 
+### Method 4: Install from PyPI
+
+`fessctl` is published to [PyPI](https://pypi.org/project/fessctl/). Install it with `pip`,
+or use [`pipx`](https://pipx.pypa.io/) / [`uv tool`](https://docs.astral.sh/uv/guides/tools/)
+for an isolated, globally available CLI:
+
+```bash
+pip install fessctl
+# or, for an isolated install:
+pipx install fessctl
+# or:
+uv tool install fessctl
+```
+
+#### Usage
+```bash
+export FESS_ACCESS_TOKEN=your_access_token_here
+export FESS_ENDPOINT=https://your-fess-server
+export FESS_VERSION=15.6.1
+
+fessctl --help
+fessctl ping
+fessctl user list
+```
+
 ## Environment Variables
 
-All three methods require the following environment variables:
+All four methods require the following environment variables:
 
 - `FESS_ENDPOINT`: The URL of your Fess server's API endpoint (default: `http://localhost:8080`)
 - `FESS_ACCESS_TOKEN`: Bearer token for API authentication (required)

pyproject.toml

@@ -1,7 +1,10 @@
 [project]
 name = "fessctl"
-version = "0.2.0.dev"
+version = "0.2.0"
 description = "CLI tool to manage Fess using the admin API"
+readme = "README.md"
+license = "Apache-2.0"
+license-files = ["LICENSE"]
 authors = [{ name = "CodeLibs, Inc.", email = "info@codelibs.co" }]
 requires-python = ">=3.13"
 dependencies = [
@@ -28,7 +31,7 @@ python_classes = ["Test*"]
 python_functions = ["test_*"]
 
 [build-system]
-requires = ["setuptools>=61.0.0", "wheel"]
+requires = ["setuptools>=77.0.0", "wheel"]
 build-backend = "setuptools.build_meta"
 
 [tool.setuptools.packages.find]