---
phase: 05-publish-and-deploy
plan: 03
type: execute
wave: 2
depends_on: ["05-01", "05-02"]
files_modified: []
autonomous: false

user_setup:
  - service: pypi
    why: "Trusted Publisher OIDC registration for automated PyPI publishing"
    dashboard_config:
      - task: "Create Pending Trusted Publisher"
        location: "pypi.org → Account settings → Publishing (https://pypi.org/manage/account/publishing/)"
        details: "PyPI project name: meshulash-guard, Owner: <github-org>, Repository: meshulash-guard, Workflow: publish.yml, Environment: pypi"
  - service: github
    why: "Environment for OIDC scoping, dev branch for development workflow, Pages for docs"
    dashboard_config:
      - task: "Create 'pypi' environment in SDK repo"
        location: "SDK repo → Settings → Environments → New environment"
      - task: "Create 'dev' branch in SDK repo"
        location: "CLI: git checkout -b dev && git push -u origin dev"
      - task: "Configure GitHub Pages in docs repo"
        location: "Docs repo → Settings → Pages → Source: gh-pages branch, root folder"
      - task: "Set custom domain in docs repo GitHub Pages"
        location: "Docs repo → Settings → Pages → Custom domain: docs.guard.meshulash.ai → Save → Enforce HTTPS"

must_haves:
  truths:
    - "PyPI Pending Trusted Publisher is registered for meshulash-guard with workflow publish.yml and environment pypi"
    - "GitHub 'pypi' environment exists in the SDK repo"
    - "A 'dev' branch exists in the SDK repo for development work"
    - "GitHub Pages is configured in the docs repo with source set to gh-pages branch"
    - "Custom domain docs.guard.meshulash.ai is set in GitHub Pages settings with HTTPS enforced"
  artifacts: []
  key_links:
    - from: "PyPI Trusted Publisher config"
      to: ".github/workflows/publish.yml"
      via: "Workflow filename must match exactly (publish.yml)"
      pattern: "publish.yml"
    - from: "GitHub pypi environment"
      to: ".github/workflows/publish.yml"
      via: "environment: pypi in publish job"
      pattern: "environment.*pypi"
---

<objective>
Complete the manual setup steps that enable the automated CI/CD pipelines created in Plans 01 and 02 to function.

Purpose: The workflow files are in place but cannot function without PyPI Trusted Publisher registration, a GitHub environment for OIDC, a dev branch for the branching model, and GitHub Pages configuration for the docs site.
Output: All external services configured; pipelines ready to run on first push/merge.
</objective>

<execution_context>
@/Users/shalev/.claude/get-shit-done/workflows/execute-plan.md
@/Users/shalev/.claude/get-shit-done/templates/summary.md
</execution_context>

<context>
@.planning/PROJECT.md
@.planning/ROADMAP.md
@.planning/STATE.md
@.planning/phases/05-publish-and-deploy/05-CONTEXT.md
@.planning/phases/05-publish-and-deploy/05-RESEARCH.md
</context>

<tasks>

<task type="checkpoint:human-action" gate="blocking">
  <name>Task 1: Register PyPI Pending Trusted Publisher</name>
  <action>
  Go to https://pypi.org/manage/account/publishing/ (logged in as shalev@meshulash.ai).

  Fill in the "Add a new pending publisher" form:
  - PyPI Project Name: `meshulash-guard`
  - Owner: your GitHub org or username (the owner of the meshulash-guard repo)
  - Repository name: `meshulash-guard`
  - Workflow name: `publish.yml` (MUST match exactly — not `release.yml`, not `publish.yaml`)
  - Environment name: `pypi`

  Submit the form.

  IMPORTANT: This does NOT reserve the PyPI name. Publish promptly after setup.
  </action>
  <resume-signal>Type "publisher registered" when complete</resume-signal>
</task>

<task type="checkpoint:human-action" gate="blocking">
  <name>Task 2: Configure GitHub environments, branches, and Pages</name>
  <action>
  Complete these four setup steps:

  1. **Create `pypi` Environment in SDK repo:**
     - Go to SDK repo → Settings → Environments → "New environment"
     - Name: `pypi`
     - No additional protection rules needed (optional: add manual approval for extra safety)

  2. **Create `dev` branch in SDK repo:**
     - In terminal: `git checkout -b dev && git push -u origin dev`
     - Or via GitHub UI: Create branch from main named `dev`

  3. **Configure GitHub Pages in docs repo:**
     - Go to docs repo → Settings → Pages
     - Source: "Deploy from a branch"
     - Branch: `gh-pages` / `/ (root)`
     - (If gh-pages branch doesn't exist yet, push the deploy.yml workflow to main first — it will create the branch on first run)

  4. **Set custom domain for docs:**
     - Same Pages settings page → Custom domain
     - Enter: `docs.guard.meshulash.ai`
     - Click Save
     - Wait for DNS check to pass (Cloudflare CNAME already verified live)
     - Check "Enforce HTTPS" once available (may take up to 24h for Let's Encrypt cert)
  </action>
  <resume-signal>Type "setup complete" when all four steps are done</resume-signal>
</task>

<task type="auto">
  <name>Task 3: Verify end-to-end readiness</name>
  <files></files>
  <action>
  After human confirms setup, verify all pieces are in place:

  1. Check workflow files exist: `.github/workflows/ci.yml`, `.github/workflows/publish.yml`, `docs/.github/workflows/deploy.yml`
  2. Check CNAME: `cat docs/docs/CNAME` should show `docs.guard.meshulash.ai`
  3. Check mkdocs.yml: `grep site_url docs/mkdocs.yml` should show `https://docs.guard.meshulash.ai`
  4. Check pyproject.toml: `grep requires-python pyproject.toml` should show `>=3.10`
  5. Verify local build works: `cd /Users/shalev/Desktop/meshulash_guard && python -m build` (install `build` package if needed — `pip install build`)

  If local build succeeds, the package is ready for its first PyPI publish on merge to main.
  </action>
  <verify>All five checks pass. `python -m build` produces files in `dist/`.</verify>
  <done>All CI/CD artifacts verified locally, package builds successfully, ready for first push to main</done>
</task>

</tasks>

<verification>
1. PyPI shows a pending publisher for meshulash-guard (verify at https://pypi.org/manage/account/publishing/)
2. GitHub SDK repo has a `pypi` environment in Settings → Environments
3. GitHub SDK repo has a `dev` branch
4. GitHub docs repo has Pages configured with gh-pages source and custom domain
5. Local `python -m build` produces wheel + sdist in dist/
</verification>

<success_criteria>
- PyPI Pending Trusted Publisher registered with correct workflow filename and environment
- GitHub pypi environment exists in SDK repo
- dev branch exists in SDK repo
- GitHub Pages configured in docs repo with custom domain and HTTPS
- Local build verification passes
</success_criteria>

<output>
After completion, create `.planning/phases/05-publish-and-deploy/05-03-SUMMARY.md`
</output>
