ci: migrate client-python CI and GitHub releases to Ciclone

.github/workflows/lint_custom_code.yaml

@@ -1,5 +1,8 @@
 name: Linting Python custom files
 
+permissions:
+  contents: read
+
 on:
   push:
     branches:
@@ -10,11 +13,14 @@ on:
 
 jobs:
   lint:
-    runs-on: ubuntu-latest
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: [ciclone, 4x8gi-x86]
 
     steps:
       - name: Checkout code
         uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
+        with:
+          persist-credentials: false
 
       - name: Set up Python
         uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # v4
@@ -36,9 +42,9 @@ jobs:
         run: scripts/lint_custom_code.sh
 
   lint_custom_code_required:
-    runs-on: ubuntu-latest
+    runs-on: [ciclone, 1x1gi-x86]
     needs: lint
-    if: ${{ always() }}
+    if: ${{ always() && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) }}
 
     steps:
       - name: Require custom code lint to pass

.github/workflows/run_example_scripts.yaml

@@ -1,5 +1,8 @@
 name: Running the examples
 
+permissions:
+  contents: read
+
 on:
   push:
     branches:
@@ -10,7 +13,8 @@ on:
 
 jobs:
   run_examples:
-    runs-on: ubuntu-24.04
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: [ciclone, 2x2gi-x86]
     strategy:
       fail-fast: false
       matrix:
@@ -19,6 +23,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
+        with:
+          persist-credentials: false
 
       - name: Set up Python ${{ matrix.python-version }}
         uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
@@ -39,7 +45,7 @@ jobs:
 
   examples:
     if: github.event_name == 'push' && github.ref == 'refs/heads/main'
-    runs-on: ubuntu-24.04
+    runs-on: [ciclone, 2x2gi-x86]
     environment: publish
     strategy:
       fail-fast: false
@@ -49,6 +55,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
+        with:
+          persist-credentials: false
 
       - name: Set up Python ${{ matrix.python-version }}
         uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
@@ -80,9 +88,9 @@ jobs:
           MISTRAL_API_KEY: ${{ env.MISTRAL_API_KEY }}
 
   run_examples_required:
-    runs-on: ubuntu-24.04
+    runs-on: [ciclone, 1x1gi-x86]
     needs: run_examples
-    if: ${{ always() }}
+    if: ${{ always() && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) }}
 
     steps:
       - name: Require all example jobs to pass

.github/workflows/sdk_generation_mistralai_azure_sdk.yaml

@@ -16,12 +16,16 @@ permissions:
         type: string
 jobs:
   resolve-speakeasy-version:
-    runs-on: ubuntu-24.04
+    runs-on: [ciclone, 1x1gi-x86]
+    permissions:
+      contents: read
     outputs:
       version: ${{ steps.resolve.outputs.version }}
     steps:
       - name: Checkout repository
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        with:
+          persist-credentials: false
 
       - name: Resolve Speakeasy version from workflow config
         id: resolve
@@ -39,7 +43,7 @@ jobs:
 
   generate:
     needs: resolve-speakeasy-version
-    runs-on: ubuntu-24.04
+    runs-on: [ciclone, 4x8gi-x86]
     environment: publish
     steps:
       - name: Checkout
@@ -70,7 +74,7 @@ jobs:
 
   align-version:
     needs: generate
-    runs-on: ubuntu-24.04
+    runs-on: [ciclone, 2x2gi-x86]
     environment: publish
     steps:
       - name: Compute expected PR branch

.github/workflows/sdk_generation_mistralai_gcp_sdk.yaml

@@ -16,12 +16,16 @@ permissions:
         type: string
 jobs:
   resolve-speakeasy-version:
-    runs-on: ubuntu-24.04
+    runs-on: [ciclone, 1x1gi-x86]
+    permissions:
+      contents: read
     outputs:
       version: ${{ steps.resolve.outputs.version }}
     steps:
       - name: Checkout repository
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        with:
+          persist-credentials: false
 
       - name: Resolve Speakeasy version from workflow config
         id: resolve
@@ -39,7 +43,7 @@ jobs:
 
   generate:
     needs: resolve-speakeasy-version
-    runs-on: ubuntu-24.04
+    runs-on: [ciclone, 4x8gi-x86]
     environment: publish
     steps:
       - name: Checkout
@@ -70,7 +74,7 @@ jobs:
 
   align-version:
     needs: generate
-    runs-on: ubuntu-24.04
+    runs-on: [ciclone, 2x2gi-x86]
     environment: publish
     steps:
       - name: Compute expected PR branch

.github/workflows/sdk_generation_mistralai_sdk.yaml

@@ -16,12 +16,16 @@ permissions:
         type: string
 jobs:
   resolve-speakeasy-version:
-    runs-on: ubuntu-24.04
+    runs-on: [ciclone, 1x1gi-x86]
+    permissions:
+      contents: read
     outputs:
       version: ${{ steps.resolve.outputs.version }}
     steps:
       - name: Checkout repository
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        with:
+          persist-credentials: false
 
       - name: Resolve Speakeasy version from workflow config
         id: resolve
@@ -39,7 +43,7 @@ jobs:
 
   generate:
     needs: resolve-speakeasy-version
-    runs-on: ubuntu-24.04
+    runs-on: [ciclone, 4x8gi-x86]
     environment: publish
     steps:
       - name: Checkout
@@ -70,7 +74,7 @@ jobs:
 
   align-version:
     needs: generate
-    runs-on: ubuntu-24.04
+    runs-on: [ciclone, 2x2gi-x86]
     environment: publish
     steps:
       - name: Compute expected PR branch

.github/workflows/sdk_publish_mistralai_sdk.yaml

@@ -1,7 +1,6 @@
 name: Publish MISTRALAI-SDK
 permissions:
-  contents: write
-  id-token: write
+  contents: read
 "on":
   workflow_dispatch:
     inputs:
@@ -15,18 +14,22 @@ permissions:
     paths:
       - RELEASES.md
 jobs:
-  publish:
-    name: Publish Python SDKs to PyPI
+  build:
+    name: Build Python SDK distributions
     # Auto-publish on push to main branch; require manual confirmation for workflow_dispatch
     if: |
       (github.event_name == 'push' && github.ref == 'refs/heads/main') ||
       (github.event_name == 'workflow_dispatch' && github.event.inputs.confirm_publish == 'publish')
-    runs-on: ubuntu-24.04
+    runs-on: [ciclone, 2x2gi-x86]
+    outputs:
+      artifact-id: ${{ steps.upload.outputs.artifact-id }}
     environment:
       name: publish
     steps:
       - name: Checkout repository
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        with:
+          persist-credentials: false
 
       - name: Set up Python
         uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
@@ -41,6 +44,33 @@ jobs:
           python scripts/prepare_readme.py
           uv build --sdist --wheel --out-dir dist/mistralai
 
+      - name: Upload distributions
+        id: upload
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: mistralai-distributions-${{ github.run_attempt }}
+          path: dist/mistralai/
+          if-no-files-found: error
+          retention-days: 1
+
+  publish:
+    name: Publish Python SDKs to PyPI
+    needs: build
+    # The PyPA action recommends a dedicated GitHub-hosted publishing job.
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      id-token: write
+    environment:
+      name: publish
+    steps:
+      - name: Download distributions
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          artifact-ids: ${{ needs.build.outputs.artifact-id }}
+          path: dist/mistralai/
+          merge-multiple: true
+
       - name: Publish mistralai to PyPI
         uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
         with:
@@ -49,6 +79,24 @@ jobs:
           verbose: true
           skip-existing: true
 
+  release:
+    needs: publish
+    runs-on: [ciclone, 1x1gi-x86]
+    permissions:
+      contents: write
+    environment:
+      name: publish
+    steps:
+      - name: Checkout release metadata
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        with:
+          ref: ${{ github.sha }}
+          persist-credentials: false
+          sparse-checkout: |
+            RELEASES.md
+            pyproject.toml
+          sparse-checkout-cone-mode: false
+
       - name: Create GitHub Release
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/test_custom_code.yaml

@@ -1,5 +1,8 @@
 name: Testing Python custom files
 
+permissions:
+  contents: read
+
 on:
   push:
     branches:
@@ -10,11 +13,14 @@ on:
 
 jobs:
   lint:
-    runs-on: ubuntu-latest
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: [ciclone, 4x8gi-x86]
 
     steps:
       - name: Checkout code
         uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
+        with:
+          persist-credentials: false
 
       - name: Set up Python
         id: setup-python
@@ -39,9 +45,9 @@ jobs:
         run: uv run pytest tests/
 
   test_custom_code_required:
-    runs-on: ubuntu-latest
+    runs-on: [ciclone, 1x1gi-x86]
     needs: lint
-    if: ${{ always() }}
+    if: ${{ always() && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) }}
 
     steps:
       - name: Require custom code tests to pass

.github/workflows/update_speakeasy.yaml

@@ -23,7 +23,7 @@ on:
 
 jobs:
   update-sdks:
-    runs-on: ubuntu-latest
+    runs-on: [ciclone, 4x8gi-x86]
     environment: publish
     steps:
       - name: Checkout repository