PyPI publish path (and optional Homebrew) so `pipx install personality-protect` works

[telivity-otaip]

Why

Distribution friction kills trial. Today the path is clone → venv → pip install -e. A real PyPI release (and optionally Homebrew) turns "try it" into one command — exactly what Show HN / Reddit / issue-farmer traffic needs.

Scope

PyPI

1. Confirm pyproject.toml metadata (version, classifiers, URLs, extras)
2. Add a GitHub Actions workflow for tagged releases → build sdist/wheel → publish (Trusted Publishing preferred)
3. Document: pipx install personality-protect then personality-protect demo
4. Keep heavy extras optional: personality-protect[mlx], [gguf], [models]

Optional stretch: Homebrew

• Formula or tap that installs the CLI (Python formula pattern)
• Document Apple Silicon MLX extra install after brew

Acceptance criteria

• python -m build produces clean sdist + wheel locally
• Tag-driven CI publish workflow (dry-run / workflow_dispatch first)
• README Quick start offers the pipx one-liner and keeps the editable-dev path
• Package excludes profiles, adapters, weights, personal paths (verify with wheel contents)
• Version bump policy noted in CONTRIBUTING (or this issue until CONTRIBUTING lands)

Pointers

• pyproject.toml
• .github/workflows/ci.yml
• Package data under personality_protect/data/

Privacy / safety

Release artifacts must contain code + synthetic demo/eval fixtures only.

Difficulty

Easy–Medium — packaging + CI; high traction payoff.

[atiqur-rahman-pro]

🚀 Proposal: PyPI Packaging & Tag-Driven CI Release Workflow for personality-protect

Objective

Streamline distribution by transitioning from git clone -> venv -> pip install -e . to a single-command installation (pipx install personality-protect), establishing tag-driven automated PyPI releases via GitHub Actions.

---

Scope of Changes

1. pyproject.toml Optimization & Metadata Alignment:

   • Define package metadata (versioning, classifiers, repository/issue URLs, license).
   • Expose CLI script entrypoint: personality-protect = "personality_protect.cli:main".
   • Configure optional extras to keep base installation lightweight:
     • personality-protect[mlx] (Apple Silicon MLX backend)
     • personality-protect[gguf] (GGUF / llama-cpp backend)
     • personality-protect[models] (Heavy model runtime dependencies)
   • Enforce strict package data inclusion rules: include ONLY siddhi/synthetic demo fixtures under personality_protect/data/, while strictly excluding personal weights, adapters, profiles, or local paths.

2. GitHub Actions CI/CD Release Workflow (.github/workflows/release.yml):

   • Add tag-triggered (v*.*.*) and workflow_dispatch (manual test/dry-run) workflow.
   • Build clean sdist (.tar.gz) and wheel (.whl) via python -m build.
   • Automate PyPI publishing via Trusted Publishing (OIDC).

3. Documentation Updates:

   • README.md: Update Quick Start with pipx install personality-protect and personality-protect demo while retaining the editable development path.
   • CONTRIBUTING.md: Note version bump guidelines (Semantic Versioning vX.Y.Z).

---

Verification & Acceptance

• Local python -m build produces clean sdist + wheel without heavy weights or personal paths.
• Verified CLI execution (personality-protect demo).
• CI publish workflow ready for tag-driven release.

[telivity-otaip]

Thanks @atiqur-rahman-pro — this is a great direction and lines up well with what we want for #62. Appreciate you taking the time to scope it out.

A few small corrections so a PR lands cleanly:

1. CLI entrypoint — please keep the existing Typer entrypoint as-is:

   personality-protect = "personality_protect.cli:app"

   (:main would break the CLI; app is the Typer instance.)

2. Package data — include only the synthetic Contoso demo/eval fixtures under personality_protect/data/ (demo + evals). No personal weights, adapters, profiles, or local paths. (I think “siddhi” was a typo — Contoso/synthetic is the rule.)

3. [models] extra — this one is just huggingface_hub for downloading public quantized bases, not the heavy runtime. The heavy backends stay behind [mlx] / [gguf] / [cuda].

Much of the pyproject.toml metadata is already in good shape, so the highest-value pieces are:

• .github/workflows/release.yml (tag v*.*.* + workflow_dispatch dry-run, Trusted Publishing / OIDC)
• README Quick Start with pipx install personality-protect (keep the editable-dev path too)
• A short SemVer / version-bump note (in CONTRIBUTING if that lands, otherwise in the PR is fine)

When you open a PR, could you leave the acceptance boxes unchecked until CI shows a green dry-run build, and include a quick note that the wheel/sdist listing is Contoso-safe (code + synthetic data/ only)?

Looking forward to the PR — happy to review.