Context

Describe the background behind the problem.
This is a requirement for the Security section of the Launch Readiness Assessment (LRA) to be considered green. We have successfully published with claude-agent-sdk-mongodb-session-store, and copied that pattern with mlflow-mongodb.

Definition of done

What must be done to consider the task complete?

We add another job to the existing pipeline. This can be tested with a manual workflow dispatch that builds, tests, and signs, but does not publish. The *.sig files can be compared for their signature before publishing. After publishing, sha sums are also available, and PyPI will mark the release as signed.

Pitfalls

We need to vigilant when dealing with screts.