feat(ci): add trusted publisher release workflows for JS and Python SDKs

[Leechael]

Add GitHub Actions workflows that publish to npm and PyPI using OIDC trusted publishers (no long-lived secrets).

• JS SDK (js-sdk-release.yml): triggered by js-sdk-v* tags, publishes to npm with provenance. Includes npm upgrade, OIDC verification, and repository consistency checks.
• Python SDK (python-sdk-release.yml): triggered by python-sdk-v* tags, builds with PDM and publishes via pypa/gh-action-pypi-publish.
• Adds repository field to sdk/js/package.json — required for npm Trusted Publishers / Sigstore provenance verification.

Registry configuration needed before first publish

• npm: Go to https://www.npmjs.com/package/@phala/dstack-sdk/access → Add trusted publisher with Owner Dstack-TEE, Repository dstack, Workflow js-sdk-release.yml.
• PyPI: Go to https://pypi.org/manage/project/dstack-sdk/settings/publishing/ → Add trusted publisher with Owner Dstack-TEE, Repository dstack, Workflow python-sdk-release.yml.

[Copilot]

Pull request overview

Adds GitHub Actions release automation to publish the JS SDK to npm and the Python SDK to PyPI using OIDC trusted publishers (no long-lived registry tokens), plus small SDK metadata/config updates to support trusted publishing.

Changes:

• Introduces tag-triggered release workflows for publishing JS (js-sdk-v*) to npm (with provenance) and Python (python-sdk-v*) to PyPI/TestPyPI.
• Updates SDK versions and npm package metadata (repository), and bumps TS compile targets to ES2020.
• Adjusts JS env var encryption key import and adds Claude local settings files under sdk/js/.claude/.

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 24 comments.

Show a summary per file

File	Description
sdk/python/pyproject.toml	Bumps Python SDK version and minor formatting cleanup.
sdk/js/tsconfig.json	Raises TS compilation target to ES2020.
sdk/js/tsconfig.node.json	Raises Node TS compilation target to ES2020.
sdk/js/tsconfig.browser.json	Raises browser TS compilation target to ES2020 and trims whitespace.
sdk/js/src/encrypt-env-vars.ts	Tweaks WebCrypto key import input type for AES-GCM.
sdk/js/package.json	Bumps JS SDK version, adds repository metadata for npm trusted publishing, pins typescript.
sdk/js/.claude/settings.local.json	Adds Claude local permissions configuration (machine-local content).
sdk/js/.claude/settings.local.json.license	Adds license sidecar for the local Claude settings file.
.github/workflows/python-sdk-release.yml	New workflow to build (PDM) and publish Python SDK to PyPI/TestPyPI via OIDC.
.github/workflows/js-sdk-release.yml	New workflow to build and publish JS SDK to npm via OIDC + provenance and create a GitHub Release.

Comments suppressed due to low confidence (3)

sdk/js/src/encrypt-env-vars.ts:55

• In Node.js, the crypto module does not expose subtle/getRandomValues at the top level; those live under crypto.webcrypto (or globalThis.crypto). As written, crypto.subtle will be undefined at runtime and encryption will fail.

  // Import shared key for AES-GCM
  const importedShared = await crypto.subtle.importKey(
    "raw",
    new Uint8Array(shared),
    { name: "AES-GCM", length: 256 },
    true,
    ["encrypt"],
  );

  // Encrypt the data
  const iv = crypto.getRandomValues(new Uint8Array(12));
  const encrypted = await crypto.subtle.encrypt(
    { name: "AES-GCM", iv },
    importedShared,
    new TextEncoder().encode(envsJson),
  );

sdk/js/src/encrypt-env-vars.ts:55

• In Node.js, the crypto module does not expose subtle/getRandomValues at the top level; those live under crypto.webcrypto (or globalThis.crypto). As written, crypto.subtle will be undefined at runtime and encryption will fail.

  // Import shared key for AES-GCM
  const importedShared = await crypto.subtle.importKey(
    "raw",
    new Uint8Array(shared),
    { name: "AES-GCM", length: 256 },
    true,
    ["encrypt"],
  );

  // Encrypt the data
  const iv = crypto.getRandomValues(new Uint8Array(12));
  const encrypted = await crypto.subtle.encrypt(
    { name: "AES-GCM", iv },
    importedShared,
    new TextEncoder().encode(envsJson),
  );

sdk/js/src/encrypt-env-vars.ts:55

• In Node.js, the crypto module does not expose subtle/getRandomValues at the top level; those live under crypto.webcrypto (or globalThis.crypto). As written, crypto.subtle will be undefined at runtime and encryption will fail.

  // Import shared key for AES-GCM
  const importedShared = await crypto.subtle.importKey(
    "raw",
    new Uint8Array(shared),
    { name: "AES-GCM", length: 256 },
    true,
    ["encrypt"],
  );

  // Encrypt the data
  const iv = crypto.getRandomValues(new Uint8Array(12));
  const encrypted = await crypto.subtle.encrypt(
    { name: "AES-GCM", iv },
    importedShared,
    new TextEncoder().encode(envsJson),
  );

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.