Add CI/CD and build scripts

GitHub Actions CI (Python 3.9-3.13, pytest), publish workflow (PyPI via
OIDC trusted publishing on tag push), bump-version.sh (PEP 440 version
management with tag-based releases).

Co-Authored-By: claude-flow <ruv@ruv.net>

Author: Allow2CEO

.github/workflows/ci.yml

@@ -0,0 +1,30 @@
+name: CI
+
+on:
+  push:
+    branches: [master, main]
+  pull_request:
+    branches: [master, main]
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python: ['3.9', '3.10', '3.11', '3.12', '3.13']
+
+    name: Python ${{ matrix.python }}
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python }}
+
+      - name: Install dependencies
+        run: pip install -e .[dev]
+
+      - name: Run tests
+        run: pytest --cov=allow2_service --cov-report=term-missing

.github/workflows/publish.yml

@@ -0,0 +1,49 @@
+name: Publish
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      contents: write
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+
+      - name: Install build dependencies
+        run: pip install build
+
+      - name: Install package with dev dependencies
+        run: pip install -e .[dev]
+
+      - name: Run tests
+        run: pytest
+
+      - name: Build package
+        run: python -m build
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+
+      - name: Create GitHub Release
+        uses: softprops/action-gh-release@v2
+        with:
+          generate_release_notes: true
+          body: |
+            ## Installation
+
+            ```bash
+            pip install allow2-service
+            ```
+
+            See [PyPI](https://pypi.org/project/allow2-service/) for details.

scripts/bump-version.sh

@@ -0,0 +1,73 @@
+#!/usr/bin/env bash
+# bump-version.sh -- Standardised version bumping for Allow2 Python Service SDK
+# Usage: ./scripts/bump-version.sh [prerelease|patch|minor|major] [--preid alpha|beta|rc]
+#
+# Python uses pyproject.toml version + git tags.
+# PyPI reads version from pyproject.toml.
+#
+# Examples:
+#   ./scripts/bump-version.sh prerelease --preid alpha   # 2.0.0a1 -> 2.0.0a2
+#   ./scripts/bump-version.sh patch                       # 2.0.0 -> 2.0.1
+set -euo pipefail
+cd "$(dirname "$0")/.."
+
+BUMP="${1:-prerelease}"
+PREID=""
+if [[ "${2:-}" == "--preid" ]]; then PREID="${3:-alpha}"; fi
+
+# Get latest version tag
+OLD=$(git tag -l 'v*' --sort=-v:refname | head -1 | sed 's/^v//')
+if [[ -z "$OLD" ]]; then
+  echo "No version tags found. Create one first: git tag v2.0.0a1" >&2
+  exit 1
+fi
+
+# Parse: 2.0.0 or 2.0.0a1 or 2.0.0-alpha.1
+if [[ "$OLD" =~ ^([0-9]+)\.([0-9]+)\.([0-9]+)(([a-z]+)([0-9]+))?$ ]]; then
+  MAJOR="${BASH_REMATCH[1]}"
+  MINOR="${BASH_REMATCH[2]}"
+  PATCH="${BASH_REMATCH[3]}"
+  PRE_TYPE="${BASH_REMATCH[5]:-}"
+  PRE_NUM="${BASH_REMATCH[6]:-}"
+elif [[ "$OLD" =~ ^([0-9]+)\.([0-9]+)\.([0-9]+)(-([a-z]+)\.([0-9]+))?$ ]]; then
+  MAJOR="${BASH_REMATCH[1]}"
+  MINOR="${BASH_REMATCH[2]}"
+  PATCH="${BASH_REMATCH[3]}"
+  PRE_TYPE="${BASH_REMATCH[5]:-}"
+  PRE_NUM="${BASH_REMATCH[6]:-}"
+else
+  echo "Cannot parse version: $OLD" >&2; exit 1
+fi
+
+case "$BUMP" in
+  prerelease)
+    PRE="${PREID:-${PRE_TYPE:-a}}"
+    # Map preid to PEP 440: alpha->a, beta->b, rc->rc
+    case "$PRE" in
+      alpha) PEP="a" ;;
+      beta)  PEP="b" ;;
+      rc)    PEP="rc" ;;
+      *)     PEP="$PRE" ;;
+    esac
+    if [[ "$PRE_TYPE" == "$PEP" && -n "$PRE_NUM" ]]; then
+      NEW="${MAJOR}.${MINOR}.${PATCH}${PEP}$((PRE_NUM + 1))"
+    else
+      NEW="${MAJOR}.${MINOR}.${PATCH}${PEP}1"
+    fi
+    ;;
+  patch) NEW="$MAJOR.$MINOR.$((PATCH + 1))" ;;
+  minor) NEW="$MAJOR.$((MINOR + 1)).0" ;;
+  major) NEW="$((MAJOR + 1)).0.0" ;;
+  *) echo "Usage: $0 [prerelease|patch|minor|major] [--preid alpha|beta|rc]" >&2; exit 1 ;;
+esac
+
+echo "$OLD -> $NEW"
+
+# Update pyproject.toml
+sed -i "s/^version = \".*\"/version = \"$NEW\"/" pyproject.toml
+
+# Update __init__.py
+sed -i "s/^__version__ = \".*\"/__version__ = \"$NEW\"/" allow2_service/__init__.py
+
+git tag "v$NEW"
+echo "Tagged v$NEW -- push with: git push origin master --tags"