ci: add GCB configuration yaml for pypi releases (#35)

Google's OSS Exit Gate for publishing to public registries requires
using certain trusted builders, one of which is GCB. This configures a
GCB pipeline that is specifically for publishing to PyPi from release
tags.

Author: g-husam

cloudbuild.yaml

@@ -0,0 +1,69 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+steps:
+  # 1. Build the distribution (sdist and wheel).
+  # This uses scikit-build-core as defined in pyproject.toml to compile C++ extensions.
+  # We set BUILD_TESTING=OFF to ignore tests during the artifact build.
+  - name: 'python:3.10'
+    id: 'build'
+    entrypoint: 'bash'
+    args:
+      - '-c'
+      - |
+        if [ -z "$TAG_NAME" ]; then
+          echo "Error: TAG_NAME is not set. This pipeline is only for tag-based releases."
+          exit 1
+        fi
+        pip install build
+        
+        echo "Building C++ extensions with editable install..."
+        # Note: pip install -e . will also respect the build-system requirements
+        SKBUILD_CMAKE_ARGS="-DBUILD_TESTING=OFF" pip install -e .
+        
+        echo "Building sdist and wheel..."
+        SKBUILD_CMAKE_ARGS="-DBUILD_TESTING=OFF" python -m build
+
+  # 2. Upload to internal Artifact Registry (AR) for OSS Exit Gate.
+  # OSS Exit Gate fetches artifacts from this repository.
+  - name: 'python:3.10'
+    id: 'upload-to-ar'
+    entrypoint: 'bash'
+    args:
+      - '-c'
+      - |
+        pip install -U twine keyring keyrings.google-artifactregistry-auth
+        twine upload --repository-url https://us-python.pkg.dev/oss-exit-gate-prod/${_PROJECT_NAME}--pypi dist/*
+    waitFor: ['build']
+
+  # 3. Create and upload the manifest to GCS to trigger the Exit Gate publication.
+  # The presence of this file in the specific GCS bucket triggers the verification and publishing process.
+  - name: 'gcr.io/cloud-builders/gcloud'
+    id: 'trigger-exit-gate'
+    entrypoint: 'bash'
+    args:
+      - '-c'
+      - |
+        # Use a simple manifest that publishes all artifacts currently in the AR repository.
+        echo '{"publish_all": true}' > manifest.json
+        gcloud storage cp manifest.json gs://oss-exit-gate-prod-projects-bucket/${_PROJECT_NAME}/pypi/manifests/release-${TAG_NAME}.json
+    waitFor: ['upload-to-ar']
+
+options:
+  logging: CLOUD_LOGGING_ONLY
+  # Ensure we have enough resources for building C++ extensions.
+  machineType: 'E2_HIGHCPU_8'
+
+substitutions:
+  _PROJECT_NAME: 'ml-flashpoint'

pyproject.toml

@@ -99,6 +99,8 @@ dev = [
 requires = [
     "pybind11==3.0.1",
     "scikit-build-core==0.11.6",
+    "cmake==3.31.10",
+    "ninja==1.11.1.3",
 ]
 
 # The Python object that `pip` will call to execute the build.