From fb718af154fe1832b1cd2c326d291dbaf8ade431 Mon Sep 17 00:00:00 2001
From: Thales Maciel <thales@thalesmaciel.com>
Date: Mon, 9 Mar 2026 19:26:57 -0300
Subject: [PATCH] Add Make target for PyPI publishing

---
 AGENTS.md |  1 +
 Makefile  | 20 +++++++++++++++++++-
 README.md | 10 ++++++++++
 3 files changed, 30 insertions(+), 1 deletion(-)

diff --git a/AGENTS.md b/AGENTS.md
index 9836499..f78972a 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -13,6 +13,7 @@ This repository ships `pyro-mcp`, an MCP-compatible package for ephemeral VM lif
 - Run `make setup` after cloning.
 - Run `make check` before opening a PR.
 - Run `make dist-check` when you change packaging, entrypoints, or install docs.
+- Use `make pypi-publish` for manual PyPI uploads after setting `TWINE_PASSWORD`.
 - Public user-facing CLI is `pyro`.
 - Public Python SDK entrypoint is `from pyro_mcp import Pyro`.
 - The packaged runtime images under `src/pyro_mcp/runtime_bundle/` are stored in Git LFS.
diff --git a/Makefile b/Makefile
index 3a65546..c1ccc4b 100644
--- a/Makefile
+++ b/Makefile
@@ -11,8 +11,11 @@ RUNTIME_MATERIALIZED_DIR ?= build/runtime_sources
 RUNTIME_OCI_LAYOUT_DIR ?= build/oci_layouts
 RUNTIME_ENVIRONMENT ?= debian:12-base
 RUNTIME_ENVIRONMENTS ?= debian:12-base debian:12 debian:12-build
+PYPI_DIST_DIR ?= dist
+TWINE_USERNAME ?= __token__
+PYPI_REPOSITORY_URL ?=
 
-.PHONY: help setup lint format typecheck test check dist-check demo network-demo doctor ollama ollama-demo run-server install-hooks runtime-bundle runtime-binaries runtime-kernel runtime-rootfs runtime-agent runtime-validate runtime-manifest runtime-sync runtime-clean runtime-fetch-binaries runtime-build-kernel-real runtime-build-rootfs-real runtime-materialize runtime-export-environment-oci runtime-export-official-environments-oci runtime-publish-environment-oci runtime-publish-official-environments-oci runtime-boot-check runtime-network-check
+.PHONY: help setup lint format typecheck test check dist-check pypi-publish demo network-demo doctor ollama ollama-demo run-server install-hooks runtime-bundle runtime-binaries runtime-kernel runtime-rootfs runtime-agent runtime-validate runtime-manifest runtime-sync runtime-clean runtime-fetch-binaries runtime-build-kernel-real runtime-build-rootfs-real runtime-materialize runtime-export-environment-oci runtime-export-official-environments-oci runtime-publish-environment-oci runtime-publish-official-environments-oci runtime-boot-check runtime-network-check
 
 help:
 	@printf '%s\n' \
@@ -25,6 +28,7 @@ help:
 		'  test                      Run pytest' \
 		'  check                     Run lint, typecheck, and tests' \
 		'  dist-check                Smoke-test the installed pyro CLI and environment UX' \
+		'  pypi-publish              Build, validate, and upload the package to PyPI' \
 		'  demo                      Run the deterministic VM demo' \
 		'  network-demo              Run the deterministic VM demo with guest networking enabled' \
 		'  doctor                    Show runtime and host diagnostics' \
@@ -77,6 +81,20 @@ dist-check:
 	.venv/bin/pyro env inspect debian:12 >/dev/null
 	.venv/bin/pyro doctor >/dev/null
 
+pypi-publish:
+	@if [ -z "$$TWINE_PASSWORD" ]; then \
+		printf '%s\n' 'TWINE_PASSWORD is required; use a PyPI API token.' >&2; \
+		exit 1; \
+	fi
+	rm -rf "$(PYPI_DIST_DIR)"
+	uv build --out-dir "$(PYPI_DIST_DIR)"
+	uvx --from twine twine check "$(PYPI_DIST_DIR)"/*
+	@if [ -n "$(PYPI_REPOSITORY_URL)" ]; then \
+		TWINE_USERNAME="$(TWINE_USERNAME)" uvx --from twine twine upload --repository-url "$(PYPI_REPOSITORY_URL)" "$(PYPI_DIST_DIR)"/*; \
+	else \
+		TWINE_USERNAME="$(TWINE_USERNAME)" uvx --from twine twine upload "$(PYPI_DIST_DIR)"/*; \
+	fi
+
 demo:
 	uv run pyro demo
 
diff --git a/README.md b/README.md
index b72876c..9048935 100644
--- a/README.md
+++ b/README.md
@@ -212,3 +212,13 @@ The publisher accepts either `DOCKERHUB_USERNAME` and `DOCKERHUB_TOKEN` or
 Docker Hub uploads are chunked by default for large rootfs layers; if you need to tune a slow
 link, use `PYRO_OCI_UPLOAD_TIMEOUT_SECONDS`, `PYRO_OCI_UPLOAD_CHUNK_SIZE_BYTES`, and
 `PYRO_OCI_REQUEST_TIMEOUT_SECONDS`.
+
+For a local PyPI publish:
+
+```bash
+export TWINE_PASSWORD='pypi-...'
+make pypi-publish
+```
+
+`make pypi-publish` defaults `TWINE_USERNAME` to `__token__`.
+Set `PYPI_REPOSITORY_URL=https://test.pypi.org/legacy/` to publish to TestPyPI instead.