Severity: P3 · Category: DX
Surfaced while adding package keywords (#311, PR #358).
Finding
packages/sdk (npm) auto-publishes via .github/workflows/publish-sdk.yml on push to main when package.json changes.
packages/python-sdk has no equivalent — a search of .github/workflows/ finds no PyPI publish workflow at all. So the pyproject.toml version bump in #358 (0.1.1 to 0.1.2) has no automated effect; it matters only on the next manual publish.
Why it matters
The asymmetry is invisible and easy to get wrong: a contributor who bumps the Python version reasonably assumes it ships the way the npm one does. README badges now advertise both packages, which makes the mismatch more likely to bite.
Fix
Either add a PyPI publish workflow mirroring publish-sdk.yml (trusted publishing / PYPI_API_TOKEN), or document the manual release process so the gap is at least explicit.
From automated audit 2026-07-17.
Severity: P3 · Category: DX
Surfaced while adding package keywords (#311, PR #358).
Finding
packages/sdk(npm) auto-publishes via.github/workflows/publish-sdk.ymlon push to main whenpackage.jsonchanges.packages/python-sdkhas no equivalent — a search of.github/workflows/finds no PyPI publish workflow at all. So thepyproject.tomlversion bump in #358 (0.1.1 to 0.1.2) has no automated effect; it matters only on the next manual publish.Why it matters
The asymmetry is invisible and easy to get wrong: a contributor who bumps the Python version reasonably assumes it ships the way the npm one does. README badges now advertise both packages, which makes the mismatch more likely to bite.
Fix
Either add a PyPI publish workflow mirroring
publish-sdk.yml(trusted publishing /PYPI_API_TOKEN), or document the manual release process so the gap is at least explicit.From automated audit 2026-07-17.