From 01cded39226d7cf3633c2c968e5553a500619206 Mon Sep 17 00:00:00 2001
From: Tyler Suehr <tylersuehr@gmail.com>
Date: Thu, 3 Sep 2026 17:22:07 -0400
Subject: [PATCH] ci: prepare repo for Fern generation cutover

Adds .fernignore so Fern regeneration preserves the publish workflow,
LICENSE, and SECURITY.md, and rewrites the publish workflow for the
Fern build layout using OIDC trusted publishing (environment: prod,
matching the registry's trusted publisher registration).
---
 .fernignore                        |  4 ++++
 .github/workflows/publish-pypi.yml | 27 ++++++++++++++++++---------
 2 files changed, 22 insertions(+), 9 deletions(-)
 create mode 100644 .fernignore

diff --git a/.fernignore b/.fernignore
new file mode 100644
index 0000000..1808d93
--- /dev/null
+++ b/.fernignore
@@ -0,0 +1,4 @@
+# Files Fern must not overwrite or delete when regenerating this repo.
+LICENSE
+SECURITY.md
+.github/workflows/publish-pypi.yml
diff --git a/.github/workflows/publish-pypi.yml b/.github/workflows/publish-pypi.yml
index 2de6c17..686c49c 100644
--- a/.github/workflows/publish-pypi.yml
+++ b/.github/workflows/publish-pypi.yml
@@ -1,6 +1,9 @@
-# This workflow is triggered when a GitHub release is created.
-# It can also be run manually to re-publish to PyPI in case it failed for some reason.
-# You can run this workflow by navigating to https://www.github.com/Vitable-Inc/vitable-connect-python/actions/workflows/publish-pypi.yml
+# Publishes the Fern-generated SDK to PyPI via OIDC trusted publishing (the
+# PyPI project trusts this repo + workflow file + `prod` environment; no
+# token). Triggered when a GitHub release is published, or manually to
+# re-publish after a failure.
+#
+# This file is listed in .fernignore so Fern regeneration preserves it.
 name: Publish PyPI
 on:
   workflow_dispatch:
@@ -11,6 +14,8 @@ on:
 jobs:
   publish:
     name: publish
+    # Keep in sync with the PyPI trusted publisher registration, which pins
+    # this environment name.
     environment: prod
     runs-on: ubuntu-latest
     permissions:
@@ -18,13 +23,17 @@ jobs:
       id-token: write
 
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@v5
 
-      - name: Install uv
-        uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5.4.2
+      - name: Set up Python
+        uses: actions/setup-python@v6
         with:
-          version: '0.9.13'
+          python-version: "3.11"
 
-      - name: Publish to PyPI
+      - name: Build distribution
         run: |
-          bash ./bin/publish-pypi
+          pip install poetry
+          poetry build
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1