feat!: rebuild the client as 2.0.0 against API 2.26.0

.github/workflows/ci.yml

@@ -0,0 +1,36 @@
+name: CI
+
+# Build and load checks. Everything that needs a credential runs elsewhere and reports
+# back as a commit status, so no secret is reachable from this workflow.
+
+on:
+  pull_request:
+  push:
+    branches: [master, main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  build:
+    name: build (python ${{ matrix.python }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python: ['3.11', '3.12', '3.13']
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v5
+      - name: Import the installed package
+        # `--with .` installs this package into a throwaway environment, so this exercises the
+        # path a user takes and proves the dependency list in pyproject.toml is complete. Run
+        # from RUNNER_TEMP, or the import would resolve to the source directory instead of what
+        # was installed.
+        run: cd "$RUNNER_TEMP" && uv run --no-project --python ${{ matrix.python }} --with "$GITHUB_WORKSPACE" python -c "import flat_api; print(flat_api.__version__)"
+      - name: Compile every module
+        run: uv run --no-project --python ${{ matrix.python }} python -m compileall -q flat_api

.github/workflows/release.yml

@@ -0,0 +1,50 @@
+name: Release
+
+# Publishing is triggered by a version tag and nothing else (FR-019a). The tag is created by
+# tag-on-merge.yml, so the approval -> merge -> tag -> publish ordering is enforced by the
+# platform rather than by convention (FR-007f).
+
+on:
+  push:
+    tags: ['[0-9]+.[0-9]+.[0-9]+']
+
+permissions:
+  contents: read
+  id-token: write # OIDC for PyPI trusted publishing and provenance (FR-021a, FR-021b)
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    environment: pypi
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v5
+        with:
+          python-version: '3.12'
+
+      - name: The tag must match the packaged version
+        run: |
+          TAG="${GITHUB_REF_NAME}"
+          PKG="$(cat VERSION)"
+          [ "$TAG" = "$PKG" ] || { echo "tag $TAG != VERSION $PKG"; exit 1; }
+
+      - run: uv build
+
+      # Assert the artifact, not just the file. setuptools derives the version from VERSION, but a
+      # broken pyproject.toml still builds: it silently produced flat_api-0.0.0 once. PyPI never
+      # lets a version be replaced, so this has to fail here rather than after the upload.
+      - name: The built artifact must carry the tagged version
+        run: |
+          TAG="${GITHUB_REF_NAME}"
+          test -f "dist/flat_api-${TAG}-py3-none-any.whl" || {
+            echo "no wheel for ${TAG}; dist/ holds:"; ls dist/; exit 1;
+          }
+          test -f "dist/flat_api-${TAG}.tar.gz" || {
+            echo "no sdist for ${TAG}; dist/ holds:"; ls dist/; exit 1;
+          }
+
+      # No long-lived token exists: PyPI trusts this repository and workflow by OIDC.
+      - name: Publish to PyPI (trusted publishing)
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          attestations: true

.github/workflows/tag-on-merge.yml

@@ -0,0 +1,38 @@
+name: Tag on merge
+
+# Merging is what creates the version tag, and the tag is what publishes (FR-007f, FR-019a).
+# A breaking release waits for a human to merge, which is how the FR-019 approval is expressed.
+
+on:
+  push:
+    branches: [master, main]
+
+permissions:
+  contents: write
+
+jobs:
+  tag:
+    runs-on: ubuntu-latest
+    steps:
+      # SDK_RELEASE_TOKEN, not the automatic GITHUB_TOKEN. GitHub does not start a workflow run for
+      # an event created with GITHUB_TOKEN, so a tag pushed with it would never trigger release.yml
+      # and nothing would ever publish. That failure is silent: the tag appears, the release
+      # workflow simply never runs. Needs contents:write on this repository.
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          token: ${{ secrets.SDK_RELEASE_TOKEN }}
+      - name: Tag the version if it is new
+        run: |
+          test -n "${{ secrets.SDK_RELEASE_TOKEN }}" || {
+            echo "SDK_RELEASE_TOKEN is not set: the tag would not trigger release.yml"; exit 1;
+          }
+          VERSION="$(cat VERSION)"
+          if git rev-parse "$VERSION" >/dev/null 2>&1; then
+            echo "Tag $VERSION already exists, nothing to do."
+            exit 0
+          fi
+          git config user.name  "Flat SDK bot"
+          git config user.email "developers@flat.io"
+          git tag -a "$VERSION" -m "Release $VERSION"
+          git push origin "$VERSION"

.gitignore

@@ -65,3 +65,12 @@ target/
 
 # Virtualenv
 .venv
+
+# generation scratch tree (tools/generate.sh)
+.sdkgen-scratch/
+.openapi-spec.yaml
+
+# build and tooling artifacts
+.venv/
+.pytest_cache/
+.coverage