Add SDK CI and failure email notifications

[atulpatildbz]

Summary

Add repository-native CI for the public Prompt Encryption SDK mirror and send a failure email to the current maintainers.

This PR is intended to serve as a reference for the corresponding change in the canonical internal repository. The tracked files should ultimately be produced or explicitly preserved by the Copybara workflow rather than maintained only in the GitHub destination.

What this covers

SDK CI

• Runs on every push to main, every pull request targeting main, and manual dispatch.
• Tests the SDK on Ubuntu with Python 3.10, 3.11, 3.12, 3.13, and 3.14, matching the current requires-python >=3.10 declaration.
• Installs the native OpenSSL build dependency and the SDK's test and server extras.
• Runs the complete pytest suite and pip check.
• Builds the source distribution and wheel, validates their metadata with strict twine check, and uploads the distributions as a workflow artifact.
• Exposes one stable aggregate check named Required CI, which can be selected in the main-branch ruleset without depending on individual matrix job names.
• Cancels superseded runs on the same ref.
• Uses read-only workflow permissions and pins all referenced GitHub Actions to full commit SHAs.

Failure email

• Uses a separate workflow_run workflow so SMTP credentials are never exposed to code from an untrusted pull request.
• Checks out only the trusted default branch before sending notifications.
• Sends one failure summary with the repository, event, branch, commit, actor, and workflow-run URL to:
  • patilatul@google.com
  • ashpaw@google.com
  • nilanjandaw@google.com
• Supports SMTP over implicit TLS or STARTTLS without a third-party email action.

Activation required after this change lands

1. Configure these GitHub Actions secrets:
   • Required: CI_SMTP_HOST, CI_SMTP_USERNAME, CI_SMTP_PASSWORD
   • Optional: CI_SMTP_PORT (defaults to 465), CI_SMTP_FROM (defaults to the username), and CI_SMTP_SECURITY (ssl by default or starttls)
2. Let SDK CI run at least once so GitHub registers the Required CI check.
3. Add Required CI to the existing Protect Main Branch ruleset with GitHub Actions as the expected source.
4. Keep the verified Copybara integration as a ruleset bypass so a sync can update main; CI then validates the exported commit after it lands.
5. Add these files to the canonical internal source or explicitly preserve/generate them in the Copybara configuration. Otherwise a later sync may remove them.

Known gaps and follow-up work

• This change exposes but does not repair existing public-environment failures. The audit run on a clean Python 3.11 environment produced 126 passing and 8 failing tests after OpenSSL was configured. The first real CI run is therefore expected to be red until those compatibility and test issues are fixed.
• Direct SMTP username/password authentication is implemented. If the selected Google Workspace relay requires OAuth or workload identity instead, the mail transport will need a follow-up change.
• CI currently covers Ubuntu. macOS and Windows support must either be added and tested or explicitly documented as unsupported.
• Minimum-dependency testing, linting, formatting, type checking, coverage thresholds, Docker builds, cloud integration tests, and documentation/link checks remain future work.
• The workflow builds artifacts but does not publish releases or packages.
• CodeQL, Dependabot, dependency graph updates, secret scanning, and CLA checks remain managed separately by the Google organization configuration.

Validation

• actionlint v1.7.12 passes for both workflows.
• The SMTP helper compiles successfully.
• A mocked SMTP delivery smoke test verified authentication, all three recipients, and the failed-run URL.
• git diff --check passes.