Skip to content

Commit a8d6268

Browse files
PascalRepondPascalRepond
committed
ci: add automatic release publication and repo automation
- Add semantic-release workflow cutting releases from `staging` via a GitHub App token - Add [tool.semantic_release] config, dev dep and changelog marker - Pin all workflow actions to immutable SHAs - Add dependabot.yml and auto-assign workflow Co-Authored-by: Pascal Repond <pascal.repond@rero.ch>
1 parent f16d053 commit a8d6268

9 files changed

Lines changed: 473 additions & 13 deletions

File tree

‎.github/auto_assign.yml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
# Set to true to add reviewers to pull requests
2+
addReviewers: false
3+
4+
# Set to true to add assignees to pull requests
5+
addAssignees: author
6+
7+
runOnDraft: true
8+
9+
# A number of reviewers added to the pull request
10+
# Set 0 to add all the reviewers (default: 0)
11+
# numberOfReviewers: 1
12+
13+
# A number of assignees to add to the pull request
14+
# Set to 0 to add all of the assignees.
15+
# Uses numberOfReviewers if unset.
16+
# numberOfAssignees: 2
17+
18+
# A list of keywords to be skipped the process that add reviewers if pull requests include it
19+
# skipKeywords:
20+
# - wip

‎.github/dependabot.yml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
version: 2
2+
updates:
3+
- package-ecosystem: "github-actions"
4+
directory: "/"
5+
target-branch: 'staging'
6+
schedule:
7+
interval: "monthly"
8+
commit-message:
9+
prefix: "ci"

‎.github/workflows/auto_assign.yml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
name: 'Auto Assign'
2+
on:
3+
pull_request_target:
4+
types: [opened, ready_for_review]
5+
6+
jobs:
7+
add-reviews:
8+
runs-on: ubuntu-latest
9+
steps:
10+
- uses: kentaro-m/auto-assign-action@0a2c53d3721e4c5cfcce6afd4014aecc337979f6 # v2.0.2

‎.github/workflows/continuous-integration-test.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,10 +14,10 @@ jobs:
1414
dependencies: ["dev", "deploy"]
1515
steps:
1616

17-
- uses: actions/checkout@v6.0.2
17+
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
1818

1919
- name: Install uv
20-
uses: astral-sh/setup-uv@v8.0.0
20+
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
2121
with:
2222
enable-cache: true
2323
cache-dependency-glob: uv.lock

‎.github/workflows/pypi-publish.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,10 +13,10 @@ jobs:
1313
id-token: write
1414

1515
steps:
16-
- uses: actions/checkout@v6.0.2
16+
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
1717

1818
- name: Install uv
19-
uses: astral-sh/setup-uv@v8.0.0
19+
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
2020
with:
2121
enable-cache: true
2222
cache-dependency-glob: uv.lock

‎.github/workflows/release.yml‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
# Cuts a release with python-semantic-release. Run it from `staging` (our
2+
# active branch): it reads the conventional commits since the last tag,
3+
# computes the next version, updates the version, the lock file and the
4+
# changelog, commits, tags and publishes a GitHub Release on `staging`, then
5+
# fast-forwards `master` to that commit. Publishing the release triggers
6+
# `pypi-publish.yml`.
7+
8+
name: Release
9+
10+
on:
11+
workflow_dispatch:
12+
13+
permissions:
14+
contents: write
15+
16+
jobs:
17+
release:
18+
runs-on: ubuntu-latest
19+
if: github.ref == 'refs/heads/staging'
20+
concurrency: release
21+
22+
steps:
23+
- name: Generate a token
24+
id: app-token
25+
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
26+
with:
27+
client-id: ${{ secrets.APP_CLIENT_ID }}
28+
private-key: ${{ secrets.APP_PRIVATE_KEY }}
29+
30+
- name: Checkout repository
31+
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
32+
with:
33+
fetch-depth: 0
34+
token: ${{ steps.app-token.outputs.token }}
35+
36+
- name: Install uv
37+
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
38+
with:
39+
enable-cache: true
40+
cache-dependency-glob: uv.lock
41+
42+
- name: Set up Python
43+
run: uv python install 3.14
44+
45+
- name: Install dependencies
46+
run: uv sync --frozen
47+
48+
- name: Python Semantic Release
49+
id: release
50+
env:
51+
GH_TOKEN: ${{ steps.app-token.outputs.token }}
52+
run: |
53+
git config user.name "github-actions[bot]"
54+
git config user.email "github-actions[bot]@users.noreply.github.com"
55+
56+
uv run semantic-release version
57+
58+
# A release was made if HEAD now points exactly at a tag.
59+
if git describe --exact-match HEAD 2>/dev/null; then
60+
echo "released=true" >> "$GITHUB_OUTPUT"
61+
else
62+
echo "released=false" >> "$GITHUB_OUTPUT"
63+
fi
64+
65+
- name: Fast-forward master to the release commit
66+
if: steps.release.outputs.released == 'true'
67+
run: git push origin HEAD:master

‎CHANGELOG.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,8 @@ SPDX-License-Identifier: AGPL-3.0-or-later
55

66
# Changelog
77

8+
<!-- version list -->
9+
810
## [v1.0.0](https://github.com/rero/rero-invenio-base/tree/v1.0.0) (2026-05-06)
911

1012
[Full Changelog](https://github.com/rero/rero-invenio-base/compare/v0.3.3...v1.0.0)

‎pyproject.toml‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,7 @@ dev = [
3434
"docker-services-cli<=1.0.0",
3535
"poethepoet>=0.36.0",
3636
"ruff>=0.12.3",
37+
"python-semantic-release>=10.5.3",
3738
]
3839

3940
[tool.project.entry-points]
@@ -73,3 +74,44 @@ format = {cmd = "ruff format .", help = "Formats all files"}
7374
lint = {cmd = "ruff check", help = "Checks linting"}
7475
run_tests = {cmd = "./scripts/test", help = "Runs all tests"}
7576

77+
# Release management
78+
[tool.poe.tasks.changelog]
79+
cmd = "semantic-release changelog"
80+
help = "Preview the next changelog without making changes"
81+
82+
[tool.poe.tasks.version]
83+
cmd = "semantic-release version --print"
84+
help = "Print the next version number without making changes"
85+
86+
[tool.poe.tasks.release]
87+
cmd = "semantic-release version --no-push --no-tag --no-commit"
88+
help = "Generate changelog and bump version locally (does not push, tag, or commit - for local testing only)"
89+
90+
[tool.semantic_release]
91+
version_toml = ["pyproject.toml:project.version"]
92+
tag_format = "v{version}"
93+
commit_message = "chore(release): v{version}"
94+
build_command = """
95+
uv lock --upgrade-package rero-invenio-base
96+
git add uv.lock
97+
"""
98+
99+
[tool.semantic_release.commit_author]
100+
env = "GIT_COMMIT_AUTHOR"
101+
default = "github-actions[bot] <github-actions[bot]@users.noreply.github.com>"
102+
103+
[tool.semantic_release.commit_parser_options]
104+
allowed_tags = ["feat", "fix", "docs", "style", "refactor", "perf", "test", "build", "ci", "chore"]
105+
minor_tags = ["feat"]
106+
patch_tags = ["fix", "perf", "chore", "docs", "style", "refactor", "test", "build", "ci"]
107+
108+
[tool.semantic_release.changelog]
109+
exclude_commit_patterns = [
110+
"chore\\(release\\):.*",
111+
]
112+
mode = "update"
113+
114+
[tool.semantic_release.branches.staging]
115+
match = "staging"
116+
prerelease = false
117+

0 commit comments

Comments
 (0)