feat(ci): add trusted publisher release workflows for JS and Python SDKs

Add GitHub Actions workflows that publish to npm and PyPI using OIDC
trusted publishers (no long-lived secrets).

- js-sdk-release.yml: triggered by js-sdk-v* tags, publishes to npm
  with provenance. Includes npm upgrade, OIDC verification, and
  repository consistency checks.
- python-sdk-release.yml: triggered by python-sdk-v* tags, builds
  with PDM and publishes via pypa/gh-action-pypi-publish.
- Add repository field to sdk/js/package.json (required for npm
  Trusted Publishers / Sigstore provenance verification).

Author: Leechael

.github/workflows/js-sdk-release.yml

@@ -0,0 +1,94 @@
+# SPDX-FileCopyrightText: © 2025 Phala Network <dstack@phala.network>
+#
+# SPDX-License-Identifier: Apache-2.0
+
+name: Publish JS SDK to npm
+on:
+  push:
+    tags: ['js-sdk-v*']
+  workflow_dispatch:
+    inputs:
+      npm_tag:
+        description: 'npm dist-tag (latest, beta, canary)'
+        required: true
+        default: 'latest'
+        type: choice
+        options:
+          - latest
+          - beta
+          - canary
+
+permissions:
+  id-token: write
+  contents: read
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          registry-url: 'https://registry.npmjs.org'
+
+      - name: Upgrade npm for OIDC support
+        run: |
+          npm install -g npm@latest
+          echo "npm version: $(npm --version)"
+
+      - name: Verify OIDC token availability
+        run: |
+          if [ -n "${ACTIONS_ID_TOKEN_REQUEST_URL}" ] && [ -n "${ACTIONS_ID_TOKEN_REQUEST_TOKEN}" ]; then
+            echo "OIDC token available"
+          else
+            echo "OIDC token NOT available"
+            echo "Check workflow permissions include 'id-token: write'"
+            exit 1
+          fi
+
+      - name: Verify repository configuration
+        working-directory: sdk/js
+        run: |
+          echo "Checking repository consistency..."
+          GIT_REPO=$(git remote get-url origin | sed 's/.*github.com[/:]//; s/.git$//')
+          PKG_REPO=$(node -e "console.log(require('./package.json').repository?.url || '')" | sed 's|https://github.com/||; s|git+||; s|.git$||')
+          echo "Git remote:   $GIT_REPO"
+          echo "package.json: $PKG_REPO"
+          if [ "$GIT_REPO" != "$PKG_REPO" ]; then
+            echo "Repository mismatch!"
+            echo "This will cause 422 error during publish"
+            exit 1
+          fi
+          echo "Repositories match"
+
+      - name: Install dependencies
+        working-directory: sdk/js
+        run: npm ci
+
+      - name: Build
+        working-directory: sdk/js
+        run: npm run build
+
+      - name: Determine npm dist-tag
+        id: tag
+        run: |
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            echo "tag=${{ github.event.inputs.npm_tag }}" >> "$GITHUB_OUTPUT"
+          else
+            # auto-detect from git tag: js-sdk-v0.5.8-beta.1 -> beta
+            RAW_TAG="${GITHUB_REF_NAME}"
+            if echo "$RAW_TAG" | grep -qiE '(beta|alpha|rc|preview)'; then
+              echo "tag=beta" >> "$GITHUB_OUTPUT"
+            else
+              echo "tag=latest" >> "$GITHUB_OUTPUT"
+            fi
+          fi
+
+      - name: Publish to npm
+        working-directory: sdk/js
+        run: |
+          NPM_TAG="${{ steps.tag.outputs.tag }}"
+          echo "Publishing with dist-tag: $NPM_TAG"
+          npm publish --access public --provenance --tag "$NPM_TAG"

.github/workflows/python-sdk-release.yml

@@ -0,0 +1,52 @@
+# SPDX-FileCopyrightText: © 2025 Phala Network <dstack@phala.network>
+#
+# SPDX-License-Identifier: Apache-2.0
+
+name: Publish Python SDK to PyPI
+on:
+  push:
+    tags: ['python-sdk-v*']
+  workflow_dispatch:
+    inputs:
+      target:
+        description: 'Publish target'
+        required: true
+        default: 'pypi'
+        type: choice
+        options:
+          - pypi
+          - testpypi
+
+permissions:
+  id-token: write
+  contents: read
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+
+      - name: Install PDM
+        run: pip install pdm
+
+      - name: Build distribution
+        working-directory: sdk/python
+        run: pdm build
+
+      - name: Publish to PyPI
+        if: github.event_name == 'push' || github.event.inputs.target == 'pypi'
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          packages-dir: sdk/python/dist
+
+      - name: Publish to TestPyPI
+        if: github.event_name == 'workflow_dispatch' && github.event.inputs.target == 'testpypi'
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          repository-url: https://test.pypi.org/legacy/
+          packages-dir: sdk/python/dist

sdk/js/package.json

@@ -92,6 +92,11 @@
     "dstack",
     "Phala"
   ],
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/Dstack-TEE/dstack",
+    "directory": "sdk/js"
+  },
   "author": "Leechael Yim",
   "license": "Apache-2.0",
   "dependencies": {