Set up publishing

.github/dependabot.yml

@@ -19,3 +19,8 @@ updates:
     directories: ['/reconcile-js', '/examples/website']
     schedule:
       interval: 'daily'
+
+  - package-ecosystem: 'pip'
+    directories: ['/reconcile-python']
+    schedule:
+      interval: 'daily'

.github/workflows/check.yml

@@ -24,6 +24,9 @@ jobs:
           node-version: '22.x'
           check-latest: true
 
+      - name: Install uv
+        uses: astral-sh/setup-uv@v6
+
       - name: Cache Rust dependencies
         uses: actions/cache@v5
         with:
@@ -115,3 +118,70 @@ jobs:
           npm publish
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+
+  build-python-wheels:
+    needs: build
+    if: startsWith(github.ref, 'refs/tags/')
+    strategy:
+      matrix:
+        include:
+          - os: ubuntu-latest
+            target: x86_64
+          - os: ubuntu-latest
+            target: aarch64
+          - os: macos-latest
+            target: x86_64
+          - os: macos-latest
+            target: aarch64
+          - os: windows-latest
+            target: x86_64
+    runs-on: ${{ matrix.os }}
+
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: PyO3/maturin-action@v1
+        with:
+          target: ${{ matrix.target }}
+          args: --release --out dist
+          manylinux: auto
+          working-directory: reconcile-python
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: wheels-${{ matrix.os }}-${{ matrix.target }}
+          path: reconcile-python/dist/*.whl
+
+  build-python-sdist:
+    needs: build
+    if: startsWith(github.ref, 'refs/tags/')
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: PyO3/maturin-action@v1
+        with:
+          command: sdist
+          args: --out dist
+          working-directory: reconcile-python
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: sdist
+          path: reconcile-python/dist/*.tar.gz
+
+  publish-pypi:
+    needs: [build-python-wheels, build-python-sdist]
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          pattern: '{wheels-*,sdist}'
+          merge-multiple: true
+          path: dist
+
+      - uses: pypa/gh-action-pypi-publish@release/v1