qurl-python 0.2.1__tar.gz

qurl_python-0.2.1/.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,90 @@
+name: Bug Report
+description: Report a bug to help us improve. Do NOT use this for security vulnerabilities — see SECURITY.md.
+title: "[BUG] "
+labels: ["bug"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        > **Security vulnerabilities: stop.** Report privately via [GitHub Security Advisory](https://github.com/layervai/qurl-python/security/advisories/new) or email `security@layerv.ai`. Do NOT open a public issue. See `SECURITY.md`.
+  - type: dropdown
+    id: priority
+    attributes:
+      label: Priority
+      description: |
+        - **critical** — production outage potential, data loss risk, live-customer breakage
+        - **high** — significant user impact, blocker for other work, correctness bug in shipped feature
+        - **medium** — standard bug, non-urgent
+        - **low** — polish, minor fix, tech debt
+      options:
+        - critical
+        - high
+        - medium
+        - low
+    validations:
+      required: true
+  - type: textarea
+    id: description
+    attributes:
+      label: Description
+      description: A clear description of the bug.
+    validations:
+      required: true
+  - type: textarea
+    id: reproduction
+    attributes:
+      label: Steps to Reproduce
+      description: Include a minimal code snippet if you can.
+      placeholder: |
+        1.
+        2.
+        3.
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected Behavior
+    validations:
+      required: true
+  - type: textarea
+    id: actual
+    attributes:
+      label: Actual Behavior
+    validations:
+      required: true
+  - type: input
+    id: version
+    attributes:
+      label: Package version
+      description: The installed `qurl-python` version. Run `pip show qurl-python` or check `requirements.txt` / `pyproject.toml`.
+      placeholder: e.g. 0.3.x
+    validations:
+      required: true
+  - type: input
+    id: python_version
+    attributes:
+      label: Python version
+      description: Runtime version where the bug occurred.
+      placeholder: e.g. 3.12.x (paste from `python --version`)
+    validations:
+      required: true
+  - type: input
+    id: os
+    attributes:
+      label: OS
+      placeholder: e.g. macOS 15, Ubuntu 24.04, Windows 11
+  - type: textarea
+    id: logs
+    attributes:
+      label: Logs / Error output
+      description: |
+        Paste the exception traceback and relevant surrounding context.
+        **Redact before pasting:** bearer tokens, API keys (`lv_live_…`), and customer identifiers.
+      # No `render:` — `render: shell` shell-highlights content, which
+      # miscolors Python tracebacks and JSON-structured log lines.
+  - type: textarea
+    id: context
+    attributes:
+      label: Additional Context
+      description: Screenshots, related issues, prior discussion, anything else worth knowing.

qurl_python-0.2.1/.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,11 @@
+# `blank_issues_enabled: false` forces reporters through the bug-report
+# or feature-request forms, which carry a required Priority dropdown.
+# GitHub blocks blank-issue creation at the UI before any workflow
+# runs — the enforcement fail path is for issues that DO materialize
+# (e.g. API-filed) without a priority label. Better to prevent the
+# blank-issue state than to rely on surfacing it after creation.
+blank_issues_enabled: false
+contact_links:
+  - name: Report a security vulnerability
+    url: https://github.com/layervai/qurl-python/security/advisories/new
+    about: Do NOT open a public bug report for security issues. Private disclosure via GitHub Security Advisory. See SECURITY.md.

qurl_python-0.2.1/.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,48 @@
+name: Feature Request
+description: Suggest an idea for this SDK
+title: "[FEATURE] "
+labels: ["enhancement"]
+body:
+  - type: dropdown
+    id: priority
+    attributes:
+      label: Priority
+      # Rubric wording is feature-shaped (describes ABSENCE, not
+      # failure) — distinct from bug_report.yml where critical
+      # describes harm from an existing defect. Keeping the four
+      # level names in lockstep across both forms; only the
+      # descriptions differ.
+      description: |
+        - **critical** — unblocks a committed delivery, closes a compliance/security gap, required for a live customer
+        - **high** — significant user value, blocks meaningful follow-on work
+        - **medium** — standard improvement, non-urgent
+        - **low** — polish, speculative, future
+      options:
+        - critical
+        - high
+        - medium
+        - low
+    validations:
+      required: true
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem Statement
+      description: What problem would this feature solve?
+    validations:
+      required: true
+  - type: textarea
+    id: solution
+    attributes:
+      label: Proposed Solution
+    validations:
+      required: true
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives Considered
+  - type: textarea
+    id: context
+    attributes:
+      label: Additional Context
+      description: Mockups, related issues, links to prior discussion.

qurl_python-0.2.1/.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,11 @@
+## Summary
+
+<!-- Brief description of what this PR does -->
+
+## Test plan
+
+<!-- How was this tested? -->
+
+- [ ] `ruff check` passes
+- [ ] `mypy src/` passes
+- [ ] `pytest tests/ -v` passes

qurl_python-0.2.1/.github/dependabot.yml

@@ -0,0 +1,10 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+  - package-ecosystem: pip
+    directory: /
+    schedule:
+      interval: weekly

qurl_python-0.2.1/.github/workflows/ci.yml

@@ -0,0 +1,72 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      # Don't cancel sibling matrix legs if one fails — we want full
+      # visibility into which Python versions broke.
+      fail-fast: false
+      matrix:
+        python-version: ["3.10", "3.12", "3.13"]
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version: ${{ matrix.python-version }}
+      - name: Install dependencies
+        run: pip install -e ".[dev,langchain]"
+      - name: Lint
+        run: ruff check
+      - name: Test
+        run: pytest tests/ -v
+
+  # ============================================================================
+  # TYPE CHECK - Dedicated mypy job
+  # ============================================================================
+  # Runs in its own job so the gate can't silently vanish if the test
+  # matrix is restructured. Pins to the minimum supported Python version
+  # (matching `python_version` in pyproject.toml) so the strictness stays
+  # aligned with what the SDK promises to consumers.
+  type-check:
+    name: Type check (mypy)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - name: Set up Python 3.10
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version: "3.10"
+      - name: Install dependencies
+        # Use the full dev+langchain extras so mypy sees the optional
+        # langchain integration's real types. Without langchain-core
+        # installed, mypy reports spurious errors about missing modules
+        # and unused type-ignore comments in src/layerv_qurl/langchain.py.
+        run: pip install -e ".[dev,langchain]"
+      - name: Run mypy
+        run: mypy src/
+
+  # Slack build-completion card. Thin shim over the fleet-shared reusable
+  # in layervai/ops-routines-workflows (public mirror of private
+  # layervai/ops-routines); the curl/jq Block Kit payload builder and the
+  # gate-result aggregation live there now. Adding/removing a gate is a
+  # one-line edit to `needs:` + `gates:` here — no aggregation if-chain.
+  notify:
+    name: Notify
+    needs: [test, type-check]
+    if: always() && github.event_name != 'pull_request'
+    permissions: {}
+    uses: layervai/ops-routines-workflows/.github/workflows/notify.yml@1536c698add5777aa08c781bc674d1eba469b32d # v0.9.0
+    with:
+      header: "qURL Python SDK Build"
+      gates: '{"Tests": "${{ needs.test.result }}", "Type check": "${{ needs.type-check.result }}"}'
+      extra_fields: '{"Python": "3.10, 3.12, 3.13"}'
+    secrets:
+      SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}

qurl_python-0.2.1/.github/workflows/claude-code-review.yml

@@ -0,0 +1,43 @@
+name: Claude Code Review
+
+on:
+  pull_request:
+    types: [opened, synchronize]
+
+jobs:
+  claude-review:
+    if: github.actor != 'dependabot[bot]'
+    runs-on: ubuntu-latest
+    timeout-minutes: 14
+    permissions:
+      contents: read
+      pull-requests: read
+      issues: read
+      id-token: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          fetch-depth: 1
+
+      - name: Run Claude Code Review
+        uses: anthropics/claude-code-action@9dd8b95a392eb34b6f5fb56cf5a64cb735912d4b # v1.0.150
+        with:
+          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
+          prompt: |
+            REPO: ${{ github.repository }}
+            PR NUMBER: ${{ github.event.pull_request.number }}
+
+            Please review this pull request and provide feedback on:
+            - Code quality and best practices
+            - Potential bugs or issues
+            - Performance considerations
+            - Security concerns
+            - Test coverage
+
+            Use the repository's CLAUDE.md for guidance on style and conventions. Be constructive and helpful in your feedback.
+
+            Use `gh pr comment` with your Bash tool to leave your review as a comment on the PR.
+
+          claude_args: '--model claude-opus-4-8 --allowed-tools "Bash(gh issue view:*),Bash(gh search:*),Bash(gh issue list:*),Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*),Bash(gh pr list:*)"'

qurl_python-0.2.1/.github/workflows/claude.yml

@@ -0,0 +1,39 @@
+name: Claude Code
+
+on:
+  issue_comment:
+    types: [created]
+  pull_request_review_comment:
+    types: [created]
+  issues:
+    types: [opened, assigned]
+  pull_request_review:
+    types: [submitted]
+
+jobs:
+  claude:
+    if: |
+      (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
+      (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
+      (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||
+      (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read
+      issues: read
+      id-token: write
+      actions: read
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        with:
+          fetch-depth: 1
+
+      - name: Run Claude Code
+        id: claude
+        uses: anthropics/claude-code-action@9dd8b95a392eb34b6f5fb56cf5a64cb735912d4b # v1
+        with:
+          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
+          claude_args: '--model claude-opus-4-8'

qurl_python-0.2.1/.github/workflows/codeql.yml

@@ -0,0 +1,45 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: '0 6 * * 1' # Weekly on Monday at 6 AM UTC
+
+permissions:
+  actions: read
+  contents: read
+  security-events: write
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - language: python
+            build-mode: none
+          - language: actions
+            build-mode: none
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: ${{ matrix.build-mode }}
+          queries: security-and-quality
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4
+        with:
+          category: "/language:${{ matrix.language }}"

qurl_python-0.2.1/.github/workflows/dependency-age-check-actions.yml

@@ -0,0 +1,54 @@
+# Dependency Age Check (GitHub Actions pins)
+# Thin shim calling shared reusable workflow.
+# Source: https://github.com/layervai/ops-routines/blob/main/.github/workflows/age-check-actions.yml
+# Implementation: https://github.com/layervai/ops-routines/blob/main/lib/age-check-actions.sh
+name: Dependency Age Check (Actions)
+
+# Fires on every PR (no path filter) so the status check always reports.
+# This lets branch protection require it without the path-filtered-
+# required-check footgun. The reusable's script exits 0 quickly when
+# no workflow/composite-action changes are in the diff.
+on:
+  pull_request:
+  workflow_dispatch:
+
+# Cancel superseded runs on the same PR branch — the reusable workflow
+# makes sequential registry calls; no reason to let two race for an
+# outdated diff.
+concurrency:
+  group: dep-age-actions-${{ github.head_ref || github.ref_name }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  age-check:
+    # No outer `if:` for `age-check-bypass`. The required status check
+    # is `age-check / Check GitHub Actions pin ages` (caller-job /
+    # reusable-inner-job). Skipping here means the reusable never runs
+    # and the inner job never reports → required check stuck at
+    # "Expected — Waiting" forever. The reusable's inner `if:` handles
+    # bypass and reports SKIPPED, which satisfies the required check.
+    # Note: `timeout-minutes` is intentionally NOT set here. Per GH
+    # docs (https://docs.github.com/en/actions/using-workflows/reusing-workflows#supported-keywords-for-jobs-that-call-a-reusable-workflow)
+    # only if/name/needs/permissions/secrets/strategy/uses/with/concurrency
+    # are valid on a job that calls a reusable workflow. The reusable
+    # workflow itself sets `timeout-minutes: 5` internally.
+    uses: layervai/ops-routines-workflows/.github/workflows/age-check-actions.yml@9b72a931d25f18a3a713006963072296a0b28134 # v0.8.0
+    with:
+      min_age_days: 7
+      # Post a sticky PR comment when an age-check fails, listing each
+      # pin with its eligible-after date and days remaining. The PR
+      # author / reviewer sees the retry-after date inline on the PR
+      # instead of having to click into the run log to find it. Sticky
+      # comment is updated in place on re-runs and deleted on a clean
+      # pass; soft-fails to a `::notice` if the token can't write.
+      comment_on_failure: true
+    permissions:
+      contents: read
+      # Required for `comment_on_failure: true` to actually post.
+      # Dependabot PRs default to read-only and need this grant
+      # explicitly. Without it, the workflow still fails the age check
+      # correctly — only the inline comment is suppressed.
+      pull-requests: write

qurl_python-0.2.1/.github/workflows/dependency-age-check-pip.yml

@@ -0,0 +1,53 @@
+# Dependency Age Check (pip / Python)
+# Thin shim calling shared reusable workflow.
+# Source: https://github.com/layervai/ops-routines/blob/main/.github/workflows/age-check-pip.yml
+# Implementation: https://github.com/layervai/ops-routines/blob/main/lib/age-check-pip.sh
+name: Dependency Age Check (pip)
+
+# Fires on every PR (no path filter) so the status check always reports.
+# This lets branch protection require it without the path-filtered-
+# required-check footgun. The reusable's script exits 0 quickly when
+# no requirements/poetry.lock/pyproject.toml changes are in the diff.
+on:
+  pull_request:
+  workflow_dispatch:
+
+# Cancel superseded runs on the same PR branch — pypi.org calls are
+# rate-limited and we throttle ourselves; no reason to let two race.
+concurrency:
+  group: dep-age-pip-${{ github.head_ref || github.ref_name }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  age-check:
+    # No outer `if:` for `age-check-bypass`. The required status check
+    # is `age-check / check-pip-age` (caller-job / reusable-inner-job).
+    # Skipping here means the reusable never runs and the inner job
+    # never reports → required check stuck at "Expected — Waiting"
+    # forever. The reusable's inner `if:` handles bypass and reports
+    # SKIPPED, which satisfies the required check.
+    # Note: `timeout-minutes` is intentionally NOT set here. Per GH
+    # docs (https://docs.github.com/en/actions/using-workflows/reusing-workflows#supported-keywords-for-jobs-that-call-a-reusable-workflow)
+    # only if/name/needs/permissions/secrets/strategy/uses/with/concurrency
+    # are valid on a job that calls a reusable workflow. The reusable
+    # workflow itself sets `timeout-minutes: 5` internally.
+    uses: layervai/ops-routines-workflows/.github/workflows/age-check-pip.yml@9b72a931d25f18a3a713006963072296a0b28134 # v0.8.0
+    with:
+      min_age_days: 7
+      # Post a sticky PR comment when an age-check fails, listing each
+      # pin with its eligible-after date and days remaining. The PR
+      # author / reviewer sees the retry-after date inline on the PR
+      # instead of having to click into the run log to find it. Sticky
+      # comment is updated in place on re-runs and deleted on a clean
+      # pass; soft-fails to a `::notice` if the token can't write.
+      comment_on_failure: true
+    permissions:
+      contents: read
+      # Required for `comment_on_failure: true` to actually post.
+      # Dependabot PRs default to read-only and need this grant
+      # explicitly. Without it, the workflow still fails the age check
+      # correctly — only the inline comment is suppressed.
+      pull-requests: write

qurl_python-0.2.1/.github/workflows/dependency-review.yml

@@ -0,0 +1,19 @@
+name: Dependency Review
+
+on:
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  review:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
+        with:
+          fail-on-severity: high
+          comment-summary-in-pr: always

qurl_python-0.2.1/.github/workflows/issue-priority.yml

@@ -0,0 +1,53 @@
+# Issue Priority Enforcement
+# Thin shim calling shared reusable workflow.
+# Source: https://github.com/layervai/ops-routines-workflows/blob/main/.github/workflows/issue-priority.yml
+#
+# Matching form templates live in .github/ISSUE_TEMPLATE/ alongside this
+# file — GitHub does not allow cross-repo issue-template inheritance.
+name: Issue priority enforcement
+
+on:
+  issues:
+    types: [opened, reopened, edited, labeled, unlabeled]
+
+# Coalesce bursts on the same issue. Redundant with the reusable's own
+# concurrency group (same key shape), but mirrors the dep-age-check
+# shim convention so a future ref bump that accidentally drops the
+# reusable's concurrency doesn't silently remove all deduplication.
+#
+# `cancel-in-progress: false` — serialize rather than cancel. The
+# reusable uses `setLabels` (atomic PUT), so mid-flight cancellation
+# is safe today, but a future reusable that swaps labels non-
+# atomically (remove old → add new) would be vulnerable to a
+# cancelled run leaving an issue with no priority label, which would
+# then trip the enforcement fail path. Runs are bounded at 2 minutes;
+# queueing is cheap compared to the silent-drop failure mode.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.issue.number }}
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+
+jobs:
+  enforce-priority:
+    # Shim-level defense-in-depth against label-event recursion. The
+    # reusable applies priority labels, which emits `labeled` events
+    # that would re-trigger this workflow. GitHub's GITHUB_TOKEN-based
+    # identity suppression handles the common case, AND the reusable
+    # guards with `if: sender.type != 'Bot'`. This outer `if:` mirrors
+    # that guard at the caller so a future ref bump that silently
+    # drops the reusable's guard (or switches it to a PAT/App token,
+    # which bypasses GITHUB_TOKEN suppression) can't fully defeat
+    # loop prevention.
+    #
+    # Side effect: issues OPENED by `github-actions[bot]` are exempt
+    # from priority enforcement at creation time. Subsequent human
+    # `edited` / `labeled` events re-engage enforcement (not sticky).
+    # Other bots (dependabot, renovate, etc.) pass this guard but the
+    # reusable's own `sender.type != 'Bot'` check short-circuits them
+    # before setFailed — net effect is a near-instant no-op run.
+    if: ${{ github.actor != 'github-actions[bot]' }}
+    uses: layervai/ops-routines-workflows/.github/workflows/issue-priority.yml@9b72a931d25f18a3a713006963072296a0b28134 # v0.8.0
+    permissions:
+      issues: write

qurl_python-0.2.1/.github/workflows/pr-title.yml

@@ -0,0 +1,40 @@
+name: PR Title
+
+on:
+  pull_request:
+    types: [opened, edited, synchronize, reopened]
+
+permissions:
+  pull-requests: read
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: amannn/action-semantic-pull-request@e32d7e603df1aa1ba07e981f2a23455dee596825 # v5.5.3
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          types: |
+            feat
+            fix
+            docs
+            style
+            refactor
+            perf
+            test
+            build
+            ci
+            chore
+            revert
+          scopes: |
+            client
+            api
+            ci
+            deps
+            docs
+          requireScope: false
+          subjectPattern: ^[a-z].*$
+          subjectPatternError: |
+            Subject must start with a lowercase letter.
+            Example: "feat(client): add batch resolve helper"

qurl_python-0.2.1/.github/workflows/release-please.yml

@@ -0,0 +1,73 @@
+name: Release Please
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+    inputs:
+      ref:
+        description: Git ref to build and publish
+        required: true
+        default: v0.2.0
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  release-please:
+    if: github.event_name == 'push'
+    runs-on: ubuntu-latest
+    outputs:
+      release_created: ${{ steps.release.outputs.release_created }}
+      tag_name: ${{ steps.release.outputs.tag_name }}
+    steps:
+      - uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0
+        id: release
+        with:
+          config-file: release-please-config.json
+          manifest-file: .release-please-manifest.json
+
+  test:
+    needs: release-please
+    if: always() && (github.event_name == 'workflow_dispatch' || needs.release-please.outputs.release_created == 'true')
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: true
+      matrix:
+        python-version: ["3.10", "3.11", "3.12", "3.13"]
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          ref: ${{ github.event_name == 'workflow_dispatch' && inputs.ref || github.sha }}
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version: ${{ matrix.python-version }}
+      - name: Install dependencies
+        run: pip install -e ".[dev,langchain]"
+      - name: Test
+        run: pytest tests/ -v
+
+  publish:
+    needs: [release-please, test]
+    if: always() && needs.test.result == 'success' && (github.event_name == 'workflow_dispatch' || needs.release-please.outputs.release_created == 'true')
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          ref: ${{ github.event_name == 'workflow_dispatch' && inputs.ref || github.sha }}
+      - name: Set up Python
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version: "3.12"
+      - name: Install build tools
+        run: pip install build
+      - name: Build
+        run: python -m build
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0