feat: add PyPI publish workflow via python-semantic-release + OIDC

- Add pypi-release.yml with python-semantic-release and OIDC trusted
  publishing to PyPI, following org-standard release workflow pattern
- Switch pyproject.toml from static version to setuptools-scm dynamic
  versioning; add [tool.semantic_release] and [tool.setuptools_scm]
- Regenerate uv.lock

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: farhan

.github/workflows/pypi-release.yml

@@ -0,0 +1,76 @@
+name: Release
+
+on:
+  push:
+    branches: [master]
+
+jobs:
+  run_ci:
+    uses: ./.github/workflows/ci.yml
+
+  release:
+    needs: run_ci
+    runs-on: ubuntu-latest
+    if: github.ref_name == 'master'
+    concurrency:
+      group: ${{ github.workflow }}-release-${{ github.ref_name }}
+      cancel-in-progress: false
+
+    permissions:
+      contents: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          ref: ${{ github.ref_name }}
+
+      - name: Force branch to workflow sha
+        run: git reset --hard ${{ github.sha }}
+
+      - name: Run Semantic Release
+        id: release
+        uses: python-semantic-release/python-semantic-release@d137150c434dab15ebdf01b62c98f703c0163704 # v9.9.0
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          git_committer_name: "github-actions"
+          git_committer_email: "actions@users.noreply.github.com"
+          changelog: "false"
+
+      - name: Upload to GitHub Release Assets
+        uses: python-semantic-release/publish-action@297a78b9c98490d2f3041b60e3e696b91dd2ce31 # v9.9.0
+        if: steps.release.outputs.released == 'true'
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          tag: ${{ steps.release.outputs.tag }}
+
+      - name: Upload distribution artifacts
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        if: steps.release.outputs.released == 'true'
+        with:
+          name: distribution-artifacts
+          path: dist
+          if-no-files-found: error
+
+    outputs:
+      released: ${{ steps.release.outputs.released || 'false' }}
+      version: ${{ steps.release.outputs.version }}
+
+  publish_to_pypi:
+    runs-on: ubuntu-latest
+    needs: release
+    if: github.ref_name == 'master' && needs.release.outputs.released == 'true'
+
+    permissions:
+      contents: read
+      id-token: write   # Required for OIDC trusted publishing
+
+    steps:
+      - name: Download build artifacts
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          name: distribution-artifacts
+          path: dist
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@4bb033805d9e19112d8c697528791ff53f6c2f74 # v1.9.0

pyproject.toml

@@ -1,10 +1,9 @@
 [build-system]
-requires = ["setuptools>=61.0"]
+requires = ["setuptools>=61.0", "setuptools-scm>8.1"]
 build-backend = "setuptools.build_meta"
 
 [project]
 name = "mockprock"
-version = "2.0.0"
 description = "Mock proctoring backend for Open edX"
 readme = "README.rst"
 requires-python = ">=3.12"
@@ -28,6 +27,8 @@ keywords = [
     "openedx",
     "proctoring",
 ]
+dynamic = ["version"]
+
 dependencies = []
 
 [project.optional-dependencies]
@@ -128,3 +129,15 @@ show_missing = true
 [tool.coverage.html]
 directory = "htmlcov"
 
+[tool.semantic_release]
+# SETUPTOOLS_SCM_PRETEND_VERSION lets python-semantic-release drive the version
+# at build time without needing a setup.py file.
+build_command = "pip install build && SETUPTOOLS_SCM_PRETEND_VERSION=$NEW_VERSION python -m build"
+
+[tool.setuptools_scm]
+version_scheme = 'only-version'
+local_scheme = 'no-local-version'
+fallback_version = "2.0.0"
+# Only match Python-style version tags (e.g. v2.0.0), skipping npm-style tags (npmv*)
+git_describe_command = ["git", "describe", "--dirty", "--tags", "--long", "--match", "v*", "--match", "[0-9]*"]
+