ci: shield-swap-sdk release job, macos-15-intel runners, PyPI trusted publishing

.github/workflows/sdk-wheels.yml

@@ -5,6 +5,7 @@ on:
     paths:
       - 'sdk/**'
       - 'sdk-abi/**'
+      - 'shield-swap-sdk/**'
       - '.github/workflows/sdk-wheels.yml'
       - '.github/workflows/sdk.yml'
     branches:
@@ -16,6 +17,7 @@ on:
     paths:
       - 'sdk/**'
       - 'sdk-abi/**'
+      - 'shield-swap-sdk/**'
       - '.github/workflows/sdk-wheels.yml'
       - '.github/workflows/sdk.yml'
   workflow_dispatch:
@@ -46,7 +48,7 @@ jobs:
             runner: ubuntu-24.04-arm
             target: aarch64
           - name: macos-x86_64
-            runner: macos-13
+            runner: macos-15-intel
             target: x86_64
           - name: macos-aarch64
             runner: macos-latest
@@ -155,7 +157,7 @@ jobs:
             runner: ubuntu-24.04-arm
             target: aarch64
           - name: macos-x86_64
-            runner: macos-13
+            runner: macos-15-intel
             target: x86_64
           - name: macos-aarch64
             runner: macos-latest
@@ -227,21 +229,104 @@ jobs:
           name: abi-wheels-sdist
           path: sdk-abi/dist
 
-  release:
-    name: Release
+  # shield-swap-sdk is pure Python (hatchling): one universal wheel + sdist.
+  # Depends on the built aleo-sdk wheel so its hermetic suite runs against
+  # the exact artifact shipping in this release, not a PyPI version.
+  build-shield-swap:
+    name: shield-swap-build
+    needs: [build]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+      - uses: actions/download-artifact@v4
+        with:
+          name: wheels-linux-x86_64
+          path: sdk-dist
+      - name: Build wheel + sdist
+        run: |
+          pip install build
+          python -m build shield-swap-sdk --outdir shield-swap-sdk/dist
+      - name: Test against the built aleo-sdk wheel
+        run: |
+          pip install --find-links sdk-dist aleo-sdk
+          pip install --find-links shield-swap-sdk/dist "shield-swap-sdk[async,mcp]" pytest pytest-asyncio
+          cd shield-swap-sdk && python -m pytest
+      # Prove the installed wheel imports on its own, away from the source tree.
+      - name: Smoke test wheel
+        run: |
+          cd "$RUNNER_TEMP"
+          python -c "import aleo_shield_swap; print('shield-swap-sdk', aleo_shield_swap.__version__)"
+      - name: Upload wheel
+        uses: actions/upload-artifact@v4
+        with:
+          name: shield-swap-wheels-universal
+          path: shield-swap-sdk/dist
+
+  # Publishing uses PyPI trusted publishing (OIDC) — no token secret. Each
+  # package has its own job because a pending publisher must be unique per
+  # (repo, workflow, environment): the job's environment name must exactly
+  # match the publisher registered on PyPI for that project. All three gate
+  # on every build job, and they release strictly in dependency order:
+  # abi -> sdk -> shield-swap (shield-swap-sdk requires aleo-sdk on PyPI).
+  release-abi:
+    name: Release aleo-contract-abi-generator
     runs-on: ubuntu-latest
     if: "startsWith(github.ref, 'refs/tags/')"
-    needs: [build, sdist, build-abi, sdist-abi]
+    needs: [build, sdist, build-abi, sdist-abi, build-shield-swap]
+    environment: pypi-abi
+    permissions:
+      id-token: write
     steps:
       - uses: actions/download-artifact@v4
         with:
-          pattern: '*wheels-*'
+          pattern: 'abi-wheels-*'
           merge-multiple: true
           path: dist
       - name: Publish to PyPI
-        uses: PyO3/maturin-action@v1
-        env:
-          MATURIN_PYPI_TOKEN: ${{ secrets.PYPI_API_TOKEN }}
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          packages-dir: dist
+          skip-existing: true
+
+  release-sdk:
+    name: Release aleo-sdk
+    runs-on: ubuntu-latest
+    if: "startsWith(github.ref, 'refs/tags/')"
+    needs: [build, sdist, build-abi, sdist-abi, build-shield-swap, release-abi]
+    environment: pypi
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          pattern: 'wheels-*'
+          merge-multiple: true
+          path: dist
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          packages-dir: dist
+          skip-existing: true
+
+  release-shield-swap:
+    name: Release shield-swap-sdk
+    runs-on: ubuntu-latest
+    if: "startsWith(github.ref, 'refs/tags/')"
+    needs: [build, sdist, build-abi, sdist-abi, build-shield-swap, release-sdk]
+    environment: pypi-shield-swap
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          pattern: 'shield-swap-wheels-*'
+          merge-multiple: true
+          path: dist
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
         with:
-          command: upload
-          args: --non-interactive --skip-existing dist/*
+          packages-dir: dist
+          skip-existing: true