[robertodr]

🤖 AI text below 🤖

Stacked on #26 (test/leak-checks); review only the last commit. GitHub retargets this PR to main once that one is merged; then rebase it onto main.

Summary

A publish workflow for packages on the organisation's private index on AWS CodeArtifact: examples/stubs/deploy-codeartifact.yml, shown in docs/adopting.md. Same structure as the PyPI example; the upload job attests the files with GitHub build provenance, assumes an IAM role with GitHub's OIDC token and runs uv publish. uv gets the index as a configuration file (--index), so it reads it with the same credentials and skips files already uploaded: a failed run can be re-run, and no repository's pyproject.toml changes. PEP 740 attestations are left out (--no-attestations): CodeArtifact has no Trusted Publishing to verify them against. The domain, account, region, repository and roles are organisation variables (CODEARTIFACT_*, new step 5 of the one-time organisation setup), so nothing is configured per repository.

Checklist

• Bug fix for the current release: add the backport label (or ask a maintainer to)
• just lint and just test pass
• docs/adopting.md, docs/organisation-setup.md, and docs/repository-setup.md updated if the stubs, inputs or setup changed
• Breaking change or deprecation: the Migration section says what consumers must change

[robertodr]

🤖 AI text below 🤖

New commit 0dd0df2: the CodeArtifact upload now uses uv publish instead of pipx run twine, and the upload job attests the distributions with actions/attest-build-provenance.

• Re-runnable uploads. uv publish --check-url alone reads the check URL without credentials, so against a private index it can't see existing files and a re-run fails with "already exists". The step therefore writes a small uv configuration ([[index]] with url and publish-url) to $RUNNER_TEMP and publishes with --index codeartifact, with UV_INDEX_CODEARTIFACT_USERNAME/_PASSWORD: uv then reads the index with those credentials and skips the files already there. Checked with the step itself and the real uv against a local index that requires authentication to read: the first run uploads, the second skips both files and succeeds.
• No changes to pyproject.toml in adopting repositories; the URL comes from the organisation variables, the token stays in the environment.
• --trusted-publishing never avoids a pointless OIDC exchange with CodeArtifact; --no-attestations because PEP 740 attestations need an index with Trusted Publishing.
• tests/test_codeartifact_stub.py runs the step with stand-ins for aws and uv: arguments, the generated index configuration, credentials only in the environment, the token masked, build provenance, shellcheck.

#28 and #29 are rebased on it; #29 also updates the skill's description of the upload.