feat(ci): add Test PyPI release workflow for splunk-ao-a2a

.github/workflows/release-splunk-ao-a2a-test.yaml

@@ -0,0 +1,126 @@
+name: Release splunk-ao-a2a to Test PyPI
+
+on:
+  pull_request:  # Publishes a .dev pre-release on every PR push
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Version to publish (e.g., 0.1.0, 1.2.3rc1, 1.2.3.post1). Must be an explicit version. Leave empty to use the version in pyproject.toml as-is.'
+        required: false
+        type: string
+
+jobs:
+  test:
+    name: Run tests
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    permissions:
+      contents: read
+    defaults:
+      run:
+        working-directory: splunk-ao-a2a
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Set up Python
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
+        with:
+          python-version: '3.11'
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@681c641aba71e4a1c380be3ab5e12ad51f415867 # v7.1.6
+        with:
+          enable-cache: true
+          cache-dependency-glob: "**/splunk-ao-a2a/pyproject.toml"
+
+      - name: Install dependencies
+        run: uv sync --dev
+
+      - name: Run type check
+        run: uv run mypy src/
+
+      - name: Run tests
+        run: uv run pytest --cov=splunk_ao_a2a --cov-report=xml
+
+  build:
+    name: Build package
+    needs: test  # Only build if tests pass
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    defaults:
+      run:
+        working-directory: splunk-ao-a2a
+    outputs:
+      version: ${{ steps.get-version.outputs.version }}
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Set up Python
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
+        with:
+          python-version: '3.11'
+
+      # PR builds: append .dev<run_number> so the clean version is never
+      # consumed on Test PyPI and can still be used for the real release.
+      - name: Set pre-release version
+        if: github.event_name == 'pull_request'
+        run: |
+          VERSION_BASE=$(grep '^version = ' pyproject.toml | sed 's/version = "\(.*\)"/\1/')
+          PRE_VERSION="${VERSION_BASE}.dev${{ github.run_number }}"
+          sed -i "s/^version = \".*\"/version = \"${PRE_VERSION}\"/" pyproject.toml
+          sed -i "s/__version__ = \".*\"/__version__ = \"${PRE_VERSION}\"/" src/splunk_ao_a2a/_version.py
+
+      # Manual dispatch: validate and use the supplied version if provided.
+      - name: Override version
+        if: github.event_name == 'workflow_dispatch' && inputs.version != ''
+        env:
+          INPUT_VERSION: ${{ inputs.version }}
+        run: |
+          if ! printf '%s' "$INPUT_VERSION" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+((a|b|rc)[0-9]+)?(\.post[0-9]+)?(\.dev[0-9]+)?$'; then
+            echo "::error::Invalid version '${INPUT_VERSION}'. Expected an explicit version like 0.1.0, 1.2.3rc1, or 1.2.3.post1. Bump keywords like 'patch' or 'major' are not accepted."
+            exit 1
+          fi
+          sed -i "s/^version = \".*\"/version = \"${INPUT_VERSION}\"/" pyproject.toml
+          sed -i "s/__version__ = \".*\"/__version__ = \"${INPUT_VERSION}\"/" src/splunk_ao_a2a/_version.py
+
+      - name: Get current version
+        id: get-version
+        run: |
+          VERSION=$(grep '^version = ' pyproject.toml | sed 's/version = "\(.*\)"/\1/')
+          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
+
+      - name: Build package
+        run: |
+          pip install build
+          python -m build
+
+      - name: Upload distributables
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: splunk-ao-a2a-${{ steps.get-version.outputs.version }}
+          path: splunk-ao-a2a/dist/
+
+  publish:
+    name: Publish to Test PyPI
+    needs: build  # Only publish if build succeeds (which requires tests passing)
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write  # Required for OIDC trusted publishing
+    environment:
+      name: testpypi
+      url: https://test.pypi.org/project/splunk-ao-a2a/
+
+    steps:
+      - name: Download distributables
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          name: splunk-ao-a2a-${{ needs.build.outputs.version }}
+          path: dist/
+
+      - name: Publish to Test PyPI
+        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # release/v1
+        with:
+          repository-url: https://test.pypi.org/legacy/
+          verbose: true
+          print-hash: true