Add PyPiLibrary Python sibling project

.devcontainer/devcontainer.json

@@ -0,0 +1,65 @@
+{
+    "name": "ProjectTemplate",
+    "image": "mcr.microsoft.com/devcontainers/dotnet:1-10.0",
+
+    "features": {
+        "ghcr.io/devcontainers/features/common-utils:2": {},
+        "ghcr.io/devcontainers/features/github-cli:1": {}
+    },
+
+    "mounts": [
+        {
+            "source": "${localEnv:HOME}${localEnv:USERPROFILE}/.ssh/id_ed25519.pub",
+            "target": "/home/vscode/.ssh/id_ed25519.pub",
+            "type": "bind",
+            "readonly": true
+        },
+        {
+            "source": "${localEnv:HOME}${localEnv:USERPROFILE}/.config/git/allowed_signers",
+            "target": "/home/vscode/.config/git/allowed_signers",
+            "type": "bind",
+            "readonly": true
+        },
+        {
+            "source": "${localEnv:HOME}${localEnv:USERPROFILE}/.config/gh",
+            "target": "/home/vscode/.config/gh",
+            "type": "bind",
+            "readonly": false
+        }
+    ],
+
+    "remoteUser": "vscode",
+    // workspaceFolder defaults to /workspaces/${localWorkspaceFolderBasename},
+    // which makes the devcontainer config portable: when this template is
+    // forked into a repo with a different folder name, the mount path tracks
+    // the host folder name automatically.
+
+    // The bind-mount on macOS hosts surfaces /home/vscode/.ssh as root-owned;
+    // chown it back so writes from inside the container (known_hosts updates
+    // by gh / git) land cleanly. Idempotent on Linux/WSL2.
+    "onCreateCommand": "sudo install -d -m 700 -o vscode -g vscode /home/vscode/.ssh",
+
+    // Install uv for the Python sibling project, restore .NET local tools,
+    // and install the husky git hooks. uv is installed under $HOME/.local/bin
+    // and added to PATH by uv's install script.
+    "postCreateCommand": ".devcontainer/post-create.sh",
+
+    "customizations": {
+        "vscode": {
+            "extensions": [
+                "csharpier.csharpier-vscode",
+                "davidanson.vscode-markdownlint",
+                "editorconfig.editorconfig",
+                "github.vscode-github-actions",
+                "gruntfuggly.todo-tree",
+                "ms-azuretools.vscode-docker",
+                "ms-dotnettools.csdevkit",
+                "streetsidesoftware.code-spell-checker",
+                "yzhang.markdown-all-in-one",
+                "ms-python.python",
+                "charliermarsh.ruff",
+                "ms-pyright.pyright"
+            ]
+        }
+    }
+}

.devcontainer/post-create.sh

@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Install uv (Astral) for the Python sibling project. Idempotent — re-running
+# overwrites in place. The installer drops the binary in $HOME/.local/bin and
+# updates user shell init to add it to PATH for new shells; we add it to the
+# current PATH explicitly so the rest of this script can invoke `uv` without a
+# hard-coded path.
+#
+# uv is pinned to a specific version (via the version-prefixed install URL,
+# https://astral.sh/uv/<version>/install.sh) so a compromised or broken
+# upstream `latest` script cannot silently change what runs on contributors'
+# machines and CI runners. Bump UV_VERSION when you've reviewed release notes.
+#
+# We re-install when uv is missing OR when the installed version doesn't
+# match the pin. The latter handles the case where a contributor (or a
+# previous run with a different pin) left a different uv version on PATH —
+# the pin is what's reproducible and what the lockfile is generated against.
+UV_VERSION="0.11.8"
+installed_uv_version=""
+if command -v uv >/dev/null 2>&1; then
+    installed_uv_version="$(uv --version | awk '{print $2}')"
+fi
+if [[ "$installed_uv_version" != "$UV_VERSION" ]]; then
+    curl -LsSf "https://astral.sh/uv/${UV_VERSION}/install.sh" | sh
+    export PATH="$HOME/.local/bin:$PATH"
+fi
+
+# Restore the .NET local-tool manifest (CSharpier, Husky.Net, dotnet-outdated).
+dotnet tool restore
+
+# Install Husky.Net git hooks so commits run pre-commit checks. Failures here
+# (e.g. missing .git directory, broken tool restore) should surface — the
+# devcontainer setup is not "successful" if hook installation fails silently.
+dotnet husky install
+
+# Pre-warm uv environment for PyPiLibrary if it exists. Guarded so this script
+# is safe before PyPiLibrary lands in the repo.
+if [[ -f PyPiLibrary/pyproject.toml ]]; then
+    (cd PyPiLibrary && uv sync)
+fi

.github/dependabot.yml

@@ -1,23 +1,33 @@
-# https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
-version: 2
-updates:
-
-  # main
-- package-ecosystem: "nuget"
-  target-branch: "main"
-  directory: "/"
-  schedule:
-    interval: "daily"
-  groups:
-    nuget-deps:
-      patterns:
-        - "*"
-- package-ecosystem: "github-actions"
-  target-branch: "main"
-  directory: "/"
-  schedule:
-    interval: "daily"
-  groups:
-    actions-deps:
-      patterns:
-        - "*"
+# https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
+version: 2
+updates:
+
+  - package-ecosystem: "nuget"
+    target-branch: "main"
+    directory: "/"
+    schedule:
+      interval: "daily"
+    groups:
+      nuget-deps:
+        patterns:
+          - "*"
+
+  - package-ecosystem: "github-actions"
+    target-branch: "main"
+    directory: "/"
+    schedule:
+      interval: "daily"
+    groups:
+      actions-deps:
+        patterns:
+          - "*"
+
+  - package-ecosystem: "uv"
+    target-branch: "main"
+    directory: "/PyPiLibrary"
+    schedule:
+      interval: "daily"
+    groups:
+      pypi-deps:
+        patterns:
+          - "*"

.github/workflows/build-pypilibrary-task.yml

@@ -0,0 +1,66 @@
+name: Build PyPi library task
+
+# This reusable workflow only builds the PyPi library and uploads the
+# wheel + sdist as a workflow-run artifact. It does NOT publish to PyPI.
+# Publishing happens directly in `publish-release.yml` so that the
+# `id-token: write` permission required by Trusted Publishing is granted
+# at the entry-point job, not propagated through a reusable-workflow
+# chain (which would require every caller — including `test-release-task.yml`
+# during PR validation — to also grant id-token write, even when no
+# publishing happens).
+
+on:
+  workflow_call:
+    outputs:
+      artifact-name:
+        value: ${{ jobs.build-pypilibrary.outputs.artifact-name }}
+      artifact-id:
+        value: ${{ jobs.build-pypilibrary.outputs.artifact-id }}
+
+jobs:
+
+  build-pypilibrary:
+    name: Build PyPi library project job
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: ./PyPiLibrary
+    outputs:
+      artifact-name: pypilibrary-build
+      artifact-id: ${{ steps.artifact-upload-step.outputs.artifact-id }}
+
+    steps:
+
+      - name: Checkout code step
+        uses: actions/checkout@v6
+
+      - name: Setup uv step
+        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        with:
+          enable-cache: true
+          cache-dependency-glob: "PyPiLibrary/uv.lock"
+
+      - name: Sync dependencies step
+        run: uv sync --all-groups --frozen
+
+      - name: Lint with ruff step
+        run: uv run ruff check
+
+      - name: Verify formatting with ruff step
+        run: uv run ruff format --check
+
+      - name: Type check with pyright step
+        run: uv run pyright
+
+      - name: Run pytest step
+        run: uv run pytest
+
+      - name: Build sdist and wheel step
+        run: uv build
+
+      - name: Upload build artifacts step
+        id: artifact-upload-step
+        uses: actions/upload-artifact@v6
+        with:
+          name: pypilibrary-build
+          path: PyPiLibrary/dist/*

.github/workflows/build-release-task.yml

@@ -34,6 +34,15 @@ jobs:
       # Conditional push to NuGet.org
       push: ${{ inputs.nuget }}
 
+  # PyPi publishing happens in `publish-release.yml`, not here, so that
+  # `id-token: write` only needs to be granted at the entry-point job.
+  # This reusable workflow just builds and uploads the artifact; the
+  # publish-release workflow downloads it by name in a sibling job.
+  build-pypilibrary:
+    name: Build PyPi library job
+    uses: ./.github/workflows/build-pypilibrary-task.yml
+    secrets: inherit
+
   build-executable:
     name: Build executable job
     uses: ./.github/workflows/build-executable-task.yml
@@ -51,7 +60,7 @@ jobs:
     name: Publish GitHub release job
     if: ${{ inputs.github }}
     runs-on: ubuntu-latest
-    needs: [get-version, build-nugetlibrary, build-executable, build-docker]
+    needs: [get-version, build-nugetlibrary, build-pypilibrary, build-executable, build-docker]
 
     steps:
 

.github/workflows/publish-release.yml

@@ -23,6 +23,41 @@ jobs:
       nuget: true
       dockerhub: true
 
+  publish-pypi:
+    name: Publish PyPi library job
+    needs: [create-release]
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/p/ptr727-projecttemplate-library
+    # When a `permissions:` block is present, every scope not listed
+    # collapses to `none`. The job needs three things explicitly:
+    #   - `id-token: write` for Trusted Publishing's OIDC exchange
+    #     (pypa/gh-action-pypi-publish swaps the token for a short-lived
+    #     PyPI upload token; no PYPI_API_TOKEN secret involved).
+    #   - `contents: read` so `actions/checkout`-style operations and any
+    #     repo metadata reads continue to work.
+    #   - `actions: read` so `actions/download-artifact` can list and
+    #     fetch the artifact uploaded by the build workflow earlier in
+    #     the same run.
+    permissions:
+      id-token: write
+      contents: read
+      actions: read
+
+    steps:
+
+      - name: Download PyPi library build artifacts step
+        uses: actions/download-artifact@v7
+        with:
+          name: pypilibrary-build
+          path: ./dist
+
+      - name: Publish to PyPI step
+        uses: pypa/gh-action-pypi-publish@6733eb7d741f0b11ec6a39b58540dab7590f9b7d # v1.14.0
+        with:
+          packages-dir: ./dist
+
   date-badge:
     name: Create BYOB date badge job
     needs: [create-release]

.gitignore

@@ -8,3 +8,13 @@
 .artifacts
 .DS_Store
 *.user
+
+# Python / uv
+__pycache__/
+*.py[cod]
+*.egg-info/
+.venv/
+dist/
+.pytest_cache/
+.ruff_cache/
+.pyright/

.husky/task-runner.json

@@ -27,6 +27,32 @@
             "include": [
                 "**/*.cs"
             ]
+        },
+        {
+            "name": "Ruff Format",
+            "command": "bash",
+            "args": [
+                "-c",
+                "command -v uv >/dev/null 2>&1 || { echo 'uv not on PATH; skipping ruff format' >&2; exit 0; }; exec uv run --project PyPiLibrary ruff format \"$@\"",
+                "--",
+                "${staged}"
+            ],
+            "include": [
+                "PyPiLibrary/**/*.py"
+            ]
+        },
+        {
+            "name": "Ruff Check",
+            "command": "bash",
+            "args": [
+                "-c",
+                "command -v uv >/dev/null 2>&1 || { echo 'uv not on PATH; skipping ruff check' >&2; exit 0; }; exec uv run --project PyPiLibrary ruff check \"$@\"",
+                "--",
+                "${staged}"
+            ],
+            "include": [
+                "PyPiLibrary/**/*.py"
+            ]
         }
     ]
 }