[IxayWolf]

Intent

Migrate compatible client-python GitHub Actions jobs to Ciclone and fix GitHub release creation blocked by the organization IP allow list.

Context

All eight checked-in workflows currently use GitHub-hosted runners. This PR puts 19 job definitions on Ciclone; only the dedicated PyPI upload remains on ubuntu-24.04.

Run https://github.com/mistralai/client-python/actions/runs/39462631993/job/118765748051 built and uploaded mistralai successfully, then GitHub release creation failed with an IP-allow-list HTTP 403. This PR does not dispatch publishing, republish version 3.3.0, or recover that missing GitHub release.

Important technical choices

• Separate Ciclone distribution building, PyPI upload, and Ciclone release creation. The PyPA action documents a dedicated GitHub-hosted upload job as its recommended/supported path; self-hosted support is best effort. Keep OIDC and package attestations without introducing long-lived PyPI credentials or running repository build scripts with OIDC permissions.
• Transfer distributions with SHA-pinned artifact actions, the immutable artifact ID produced by this run's build job, one-day retention, and a run-attempt-specific artifact name. The upload job does not check out or execute repository code. Release metadata comes from the original workflow SHA.
• Use 1x1gi-x86 for version lookup, required-result checks, and release API calls; 2x2gi-x86 for packaging, Python-version example matrices, and version alignment; 4x8gi-x86 for lint/tests and SDK generation/update. Preserve the protected publish environment, Python 3.10-3.13 matrix, test commands, dependency policy, and generator credentials.
• Set read-only permissions for build/test/example/version-lookup jobs, OIDC only for PyPI upload, and repository write only for release creation. Restrict Ciclone PR jobs and their required-result aggregators to same-repository PRs; fork jobs intentionally skip. Existing failure/cancellation handling still fails required checks for same-repository jobs.

Breaking changes & Private Cloud skew

N/A. No SDK or public API changes. Fork PR checks intentionally skip rather than execute untrusted code on shared Ciclone infrastructure.

What has been tested or what should

• Built the wheel and source distribution locally using uv with isolated public-PyPI configuration matching CI. The initial build inherited this machine's unauthenticated Gemfury index; repository configuration was not changed to work around it.
• Semantic comparison against the base confirms unchanged triggers, matrices, build/publish/generation/test commands, release logic, and required-result failure checks.
• Fifteen mocked release executions cover stable, alpha, beta, release-candidate, development, postrelease, postrelease-with-development, existing-release skips, and missing version metadata.
• Automatic PR CI will exercise custom lint/tests and all four Python-version build/install jobs on Ciclone. PyPI upload, release creation, SDK generation/update/alignment, and protected main-only live examples have not been dispatched.
• Runner configuration provides per-pod work and Docker volumes. This PR does not prove live teardown, host/network isolation, or credential-bearing job behavior.

References:

• PyPA publishing action v1.14.2: https://github.com/pypa/gh-action-pypi-publish/blob/v1.14.2/README.md#non-goals
• Artifact ID producer (core.setOutput('artifact-id', uploadResponse.id)): https://github.com/actions/upload-artifact/blob/ea165f8d65b6e75b540449e92b4886f43607fa02/src/shared/upload-artifact.ts
• Same-run download scope: https://github.com/actions/download-artifact/blob/d3f86a106a0bac45b974a628896c90dbdf5c8093/README.md#download-artifacts-from-other-workflow-runs-or-repositories