Add publish.yml release workflow

[glenn-jocher]

🛠️ Summary

Adds a publish.yml workflow mirroring the release pipeline used in ultralytics/mkdocs and ultralytics/ultralytics, adapted for this template:

• Version gate: fires when __version__ in template/__init__.py changes in the pushed diff (compares github.event.before → HEAD, falling back to HEAD~1). The sibling repos gate on check_pypi_version(), but the template name on PyPI belongs to an unrelated package at 0.7.6, so that check would never fire here; the original step is left commented for forks to restore.
• Tag + Release: tags v{version}, pushes the tag, and generates an AI release summary via ultralytics-actions-summarize-release.
• Build: builds sdist/wheel and uploads the dist/ artifact.
• PyPI publish: intentionally commented out (environment, id-token permission, and pypa/gh-action-pypi-publish step) with notes on enabling trusted publishing when forking this template into a real package.
• SBOM: SPDX SBOM generated and attached to the GitHub release.
• Notify: Slack success/failure notifications.

🧪 Testing

• YAML validated with yaml.safe_load.
• check_version gate logic dry-run locally under bash: no version change → increment=False, simulated bump → increment=True; bump-then-revert within one push correctly yields no release.

🛠️ PR Summary

_{Made with ❤️ by Ultralytics Actions}

🌟 Summary

Adds a complete GitHub Actions release workflow for the Ultralytics Python package template, enabling automated tagging, release creation, builds, SBOM generation, and optional PyPI publishing 🚀

📊 Key Changes

• Added a new .github/workflows/publish.yml workflow for release automation 📦
• Detects version bumps in template/__init__.py on main and creates a matching Git tag and GitHub Release 🏷️
• Builds Python distribution artifacts using python -m build and uploads them as workflow artifacts 🛠️
• Includes a placeholder PyPI publishing step with guidance for enabling trusted publishing 🔐
• Generates and uploads an SPDX JSON SBOM to the GitHub Release for supply-chain transparency 📄
• Adds Slack notifications for release success or failure 🔔
• Updates AGENTS.md to document the new publishing workflow and its security assumptions
• Updates README.md project tree to include publish.yml

🎯 Purpose & Impact

• Streamlines package release management for projects created from this template ⚡
• Reduces manual work by automating tags, releases, builds, and release notes generation 🤖
• Improves security and compliance with SBOM generation and PyPI trusted publishing guidance 🛡️
• Makes the template more production-ready while keeping PyPI publishing disabled by default for safe customization ✅
• Helps maintainers quickly adapt the workflow for their own forked or renamed packages 🧩

[UltralyticsAssistant]

👋 Hello @glenn-jocher, thank you for submitting a ultralytics/template 🚀 PR! This automated message is here to help with initial review, and an Ultralytics engineer will assist as needed. Please review the following checklist to ensure a seamless integration of your release workflow changes:

• ✅ Define a Purpose: Clearly explain the purpose of your fix or feature in your PR description, and link to any relevant issues. Ensure your commit messages are clear, concise, and adhere to the project's conventions.
• ✅ Synchronize with Source: Confirm your PR is synchronized with the ultralytics/template main branch. If it's behind, update it by clicking the 'Update branch' button or by running git pull and git merge main locally.
• ✅ Ensure CI Checks Pass: Verify all Ultralytics Continuous Integration (CI) checks are passing. If any checks fail, please address the issues.
• ✅ Update Documentation: Update the relevant documentation for any new or modified features.
• ✅ Add Tests: If applicable, include or update tests to cover your changes, and confirm that all tests are passing.
• ✅ Sign the CLA: Please ensure you have signed our Contributor License Agreement if this is your first Ultralytics PR by writing "I have read the CLA Document and I sign the CLA" in a new message.
• ✅ Minimize Changes: Limit your changes to the minimum necessary for your bug fix or feature addition. "It is not daily increase but daily decrease, hack away the unessential. The closer to the source, the less wastage there is." — Bruce Lee

For more guidance, please refer to our Contributing Guide. Don't hesitate to leave a comment if you have any questions. Thank you for contributing to Ultralytics! 🚀

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[UltralyticsAssistant]

🔍 PR Review

_{Made with ❤️ by Ultralytics Actions}

The workflow is generally structured well for version detection, tagging, artifact building, and release attachments. The main issues are that the release pipeline is currently limited to a single GitHub actor, which can skip legitimate releases, and Slack can report success before the SBOM upload has completed.

💬 Posted 2 inline comments

[UltralyticsAssistant]

🔍 PR Review 2

_{Made with ❤️ by Ultralytics Actions}

No genuine blocking issues found. The new workflow is consistent with the intended template release flow: it gates on template.__version__, tags/releases only on increments or manual recovery, builds artifacts, leaves PyPI publishing intentionally disabled, generates an SBOM, and sends release notifications.

[UltralyticsAssistant]

🚀 Merged — thank you @glenn-jocher for adding this complete release automation workflow!

“Plans are nothing; planning is everything.” — Dwight D. Eisenhower

This PR brings that spirit to the Ultralytics Python package template by turning release planning into a reliable, repeatable process: automated version detection, tagging, GitHub Releases, package builds, SBOM generation, Slack notifications, and safe PyPI publishing guidance. These improvements reduce manual maintenance, strengthen supply-chain transparency, and make the template more production-ready for future projects.

Great work helping contributors ship faster, safer, and with more confidence 🙌