feat(sdks): fold SDK monorepo in-tree under sdks/

.github/workflows/sdks-publish-csharp.yml

@@ -0,0 +1,82 @@
+name: SDKs — C# publish (NuGet)
+
+# Config only: this workflow builds/tests on every push and, on a version tag,
+# packs and pushes to NuGet. Publishing requires the NUGET_API_KEY secret to be
+# configured in the repo; without it the push step is skipped (never fails).
+#
+# Tag gating uses the `csharp-v*` prefix so it never collides with go-ios's own
+# `v*` release tags.
+
+on:
+  push:
+    branches: [main]
+    tags: ["csharp-v*"]
+    paths:
+      - "sdks/packages/csharp/**"
+      - "sdks/spec/openapi/**"
+      - ".github/workflows/sdks-publish-csharp.yml"
+  pull_request:
+    paths:
+      - "sdks/packages/csharp/**"
+      - ".github/workflows/sdks-publish-csharp.yml"
+  workflow_dispatch:
+
+defaults:
+  run:
+    working-directory: sdks/packages/csharp
+
+jobs:
+  build-test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0 # SourceLink wants full history
+
+      - uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: "8.0.x"
+
+      - name: Restore
+        run: dotnet restore GoIos.Sdk.sln
+
+      - name: Build (Release)
+        run: dotnet build GoIos.Sdk.sln --configuration Release --no-restore
+
+      - name: Test
+        run: dotnet test GoIos.Sdk.sln --configuration Release --no-build --verbosity normal
+
+  publish:
+    # Only on a csharp-v* tag, and after build/test passes.
+    needs: build-test
+    if: startsWith(github.ref, 'refs/tags/csharp-v')
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: "8.0.x"
+
+      - name: Pack (Release)
+        run: dotnet pack src/GoIos.Sdk/GoIos.Sdk.csproj --configuration Release --output ../../artifacts
+
+      - name: Upload package artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: nupkg
+          path: sdks/artifacts/*.nupkg
+
+      - name: Push to NuGet
+        # Skipped automatically when the secret is not configured.
+        if: ${{ env.NUGET_API_KEY != '' }}
+        env:
+          NUGET_API_KEY: ${{ secrets.NUGET_API_KEY }}
+        working-directory: .
+        run: |
+          dotnet nuget push "sdks/artifacts/*.nupkg" \
+            --api-key "$NUGET_API_KEY" \
+            --source https://api.nuget.org/v3/index.json \
+            --skip-duplicate

.github/workflows/sdks-publish-java.yml

@@ -0,0 +1,39 @@
+name: SDKs — Java SDK
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "sdks/packages/java/**"
+      - "sdks/spec/openapi/openapi.yaml"
+      - ".github/workflows/sdks-publish-java.yml"
+  pull_request:
+    paths:
+      - "sdks/packages/java/**"
+      - "sdks/spec/openapi/openapi.yaml"
+      - ".github/workflows/sdks-publish-java.yml"
+
+jobs:
+  build:
+    name: Build & test (Java 17)
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: sdks/packages/java
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: "17"
+          cache: maven
+
+      - name: Verify generated client is up to date
+        run: |
+          ./scripts/generate.sh
+          git diff --exit-code -- generated/src \
+            || (echo "::error::generated/ is stale — run sdks/packages/java/scripts/generate.sh and commit" && exit 1)
+
+      - name: Build & test
+        run: mvn -B -ntp verify

.github/workflows/sdks-publish-python.yml

@@ -0,0 +1,101 @@
+name: SDKs — Python publish (PyPI)
+
+# Tests the Python SDK on every push/PR that touches it, and publishes to PyPI
+# via Trusted Publishing (OIDC) when a `python-v*` tag is pushed or the workflow
+# is dispatched manually. No API token is used — publishing is authorised by the
+# OIDC identity registered as a Trusted Publisher for `go-ios-sdk` on PyPI.
+#
+# Tag gating uses the `python-v*` prefix so it never collides with go-ios's own
+# `v*` release tags.
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "sdks/packages/python/**"
+      - ".github/workflows/sdks-publish-python.yml"
+    tags:
+      - "python-v*"
+  pull_request:
+    paths:
+      - "sdks/packages/python/**"
+      - ".github/workflows/sdks-publish-python.yml"
+  workflow_dispatch:
+    inputs:
+      publish:
+        description: "Publish to PyPI (requires a Trusted Publisher config)"
+        type: boolean
+        default: false
+
+defaults:
+  run:
+    working-directory: sdks/packages/python
+
+jobs:
+  test:
+    name: test (py${{ matrix.python-version }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.9", "3.10", "3.11", "3.12", "3.13"]
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: Install (with dev deps)
+        run: uv pip install --system -e ".[dev]"
+
+      - name: Lint
+        run: ruff check src tests
+
+      - name: Type-check facade
+        run: mypy src/go_ios_sdk
+
+      - name: Unit tests
+        run: pytest -q
+
+  build:
+    name: build sdist + wheel
+    runs-on: ubuntu-latest
+    needs: test
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install uv
+        uses: astral-sh/setup-uv@v5
+        with:
+          python-version: "3.12"
+      - name: Build
+        run: uv build --sdist --wheel
+      - uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: sdks/packages/python/dist/*
+
+  publish:
+    name: publish to PyPI (OIDC)
+    runs-on: ubuntu-latest
+    needs: build
+    # Only on a release tag, or a manual dispatch that opted in.
+    if: >-
+      startsWith(github.ref, 'refs/tags/python-v') ||
+      (github.event_name == 'workflow_dispatch' && inputs.publish)
+    environment:
+      name: pypi
+      url: https://pypi.org/project/go-ios-sdk/
+    permissions:
+      # Required for PyPI Trusted Publishing (OIDC). Do NOT add a token.
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist
+      - name: Publish
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          packages-dir: dist

.github/workflows/sdks-publish-typescript.yml

@@ -0,0 +1,50 @@
+name: SDKs — TypeScript publish (npm)
+
+# Config only — dispatch-driven. Publishes @go-ios/sdk to npm with provenance.
+# Do NOT enable auto-publish on push without a maintainer sign-off.
+on:
+  workflow_dispatch: {}
+
+permissions:
+  contents: read
+  # Required for npm provenance (OIDC-signed publish attestation).
+  id-token: write
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: sdks/packages/typescript
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+          registry-url: "https://registry.npmjs.org"
+          cache: npm
+          cache-dependency-path: sdks/packages/typescript/package-lock.json
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Type-check
+        run: npm run typecheck
+
+      - name: Test
+        run: npm test
+
+      - name: Build
+        run: npm run build
+
+      # `changeset publish` runs `npm publish`; with npm >= 9 and id-token: write
+      # this emits a provenance attestation. Do NOT set NODE_AUTH_TOKEN to an
+      # empty value or add an .npmrc token line — that breaks OIDC provenance.
+      - name: Version & publish
+        run: |
+          npx changeset version
+          npx changeset publish
+        env:
+          NPM_CONFIG_PROVENANCE: "true"
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}