Publish Python SDK to PyPI as sst-sdk

.github/workflows/check.yml

@@ -66,3 +66,5 @@ jobs:
 
       - name: Build docs
         run: cd www && bun run build
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/release.yml

@@ -105,6 +105,18 @@ jobs:
         env:
           CARGO_REGISTRY_TOKEN: ${{ steps.crates-auth.outputs.token }}
 
+      - name: Release Python SDK
+        run: |
+          VERSION=$(jq -r .version dist/metadata.json)
+          cd sdk/python
+          sed -i "s/^version = \".*\"/version = \"$VERSION\"/" pyproject.toml
+          uv build
+
+      - name: Publish Python SDK to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          packages-dir: sdk/python/dist/
+
       - name: Announce on Discord
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

sdk/python/PUBLISHING.md

@@ -0,0 +1,58 @@
+# Publishing sst-sdk to PyPI
+
+The Python SDK publishes automatically as part of the SST release workflow
+(`.github/workflows/release.yml`), alongside the JS and Rust SDKs. It triggers
+on every version tag push.
+
+## One-time setup
+
+### 1. Configure trusted publishing on PyPI
+
+Go to https://pypi.org/manage/account/publishing/ and create a new pending publisher:
+
+- **PyPI project name**: `sst-sdk`
+- **Owner**: `sst` (the GitHub org)
+- **Repository**: `sst`
+- **Workflow name**: `release.yml`
+- **Environment name**: (leave blank — the release job doesn't use a named environment)
+
+This configures OIDC trusted publishing — no API tokens needed.
+
+### 2. Verify permissions
+
+The release workflow already has `id-token: write` permission, which is all
+`pypa/gh-action-pypi-publish` needs.
+
+## How it works
+
+When a tag is pushed:
+
+1. The release workflow runs `goreleaser` to build the CLI
+2. Publishes the JS SDK to npm
+3. Publishes the Rust SDK to crates.io
+4. **Publishes the Python SDK to PyPI**:
+   - Reads the version from `dist/metadata.json` (same source as other SDKs)
+   - Updates `pyproject.toml` with that version
+   - Builds with `uv build`
+   - Publishes via `pypa/gh-action-pypi-publish`
+5. Announces on Discord
+
+The Python SDK version stays in sync with the CLI and other SDKs automatically.
+
+## Testing locally
+
+Build the package without publishing:
+
+```bash
+cd sdk/python
+uv build
+```
+
+This creates `dist/sst_sdk-{version}.tar.gz` and `dist/sst_sdk-{version}-py3-none-any.whl`.
+
+Test the install:
+
+```bash
+pip install dist/sst_sdk-*.whl
+python -c "from sst import Resource; print('OK')"
+```

sdk/python/README.md

@@ -1,11 +1,76 @@
-# SST SDK
+# SST Python SDK
 
-Similar the to the JS SDK, the Python SDK provides a way to access resources in your app.
+The Python SDK for [SST](https://sst.dev) lets you access linked resources in your Python Lambda functions.
+
+## Installation
+
+```bash
+pip install sst-sdk
+```
+
+Or with uv:
+
+```bash
+uv add sst-sdk
+```
+
+> **Note**: When deploying with SST, the SDK is automatically included — you don't need to install it manually. This package is for local development and testing.
+
+## Migrating from the Git dependency
+
+If you were previously installing the SDK from GitHub:
+
+```toml
+# Before
+[project]
+dependencies = ["sst"]
+
+[tool.uv.sources]
+sst = { git = "https://github.com/sst/sst", subdirectory = "sdk/python" }
+```
+
+Update your `pyproject.toml` to use the PyPI package instead:
+
+```toml
+# After
+[project]
+dependencies = ["sst-sdk"]
+```
+
+That's it — remove the `[tool.uv.sources]` entry for `sst` and replace the dependency name. No code changes needed; `from sst import Resource` works the same way.
 
 ## Usage
 
+Use `Resource` to access any resource linked to your function in `sst.config.ts`:
+
 ```python
 from sst import Resource
 
-print(Resource.MyBucket.name)
+# Access linked resources by name
+bucket_name = Resource.MyBucket.name
+table_name = Resource.MyTable.name
 ```
+
+Resources are defined and linked in your `sst.config.ts`:
+
+```ts
+const bucket = new sst.aws.Bucket("MyBucket");
+
+new sst.aws.Function("MyFunction", {
+  handler: "handler.main",
+  link: [bucket],
+});
+```
+
+The SDK reads resource bindings from encrypted environment variables set by SST at deploy time. In `sst dev`, resources are available automatically through the local development bridge.
+
+## Supported Python Versions
+
+- Python 3.9+
+
+## Links
+
+- [SST Documentation](https://sst.dev/docs/)
+- [SDK Reference](https://sst.dev/docs/reference/sdk/)
+- [Python on SST](https://sst.dev/docs/examples/#aws-lambda-python)
+- [GitHub](https://github.com/sst/sst)

sdk/python/pyproject.toml

@@ -1,15 +1,41 @@
 [project]
-name = "sst"
+name = "sst-sdk"
 version = "0.2.0"
-description = "SST SDK"
+description = "Python SDK for SST — access linked resources in your SST app"
 readme = "README.md"
+license = "MIT"
 requires-python = ">=3.9"
+keywords = ["sst", "serverless", "aws", "lambda", "infrastructure"]
+classifiers = [
+    "Development Status :: 4 - Beta",
+    "Intended Audience :: Developers",
+    "License :: OSI Approved :: MIT License",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3.9",
+    "Programming Language :: Python :: 3.10",
+    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.13",
+    "Topic :: Software Development :: Libraries",
+]
 dependencies = ["pycryptodomex==3.20.0"]
 
+[project.urls]
+Homepage = "https://sst.dev"
+Documentation = "https://sst.dev/docs/reference/sdk/"
+Repository = "https://github.com/sst/sst"
+Issues = "https://github.com/sst/sst/issues"
+
 [build-system]
 requires = ["hatchling"]
 build-backend = "hatchling.build"
 
+[tool.hatch.build.targets.wheel]
+packages = ["src/sst"]
+
+[tool.hatch.build.targets.sdist]
+include = ["src/sst", "pyproject.toml", "README.md"]
+
 [dependency-groups]
 dev = [
     "pytest>=8.4.2",