name: Release
on:
push:
branches:
- main
workflow_dispatch:
inputs:
release_type:
description: 'Type of release (patch, minor, major)'
required: false
default: 'auto'
type: choice
options:
- auto
- patch
- minor
- major
permissions:
contents: write
issues: write
pull-requests: write
id-token: write
jobs:
release:
runs-on: ubuntu-latest
if: "!contains(github.event.head_commit.message, '[skip ci]')"
steps:
- name: Checkout
uses: actions/checkout@v4
with:
fetch-depth: 0
token: ${{ secrets.GITHUB_TOKEN }}
- name: Install uv
uses: astral-sh/setup-uv@v4
with:
version: "latest"
- name: Set up Python
uses: actions/setup-python@v5
with:
python-version: "3.11"
- name: Install dependencies
run: |
uv sync --dev
- name: Run tests
run: |
uv run pytest --cov=src --cov-report=xml tests/
- name: Run security checks
run: |
uv add --dev safety bandit
uv run safety check || true
uv run bandit -r src/ || true
- name: Install semantic-release
run: |
uv add --dev python-semantic-release
- name: Configure Git
run: |
git config --global user.name "github-actions[bot]"
git config --global user.email "github-actions[bot]@users.noreply.github.com"
- name: Determine version bump
id: version
run: |
if [ "${{ github.event.inputs.release_type }}" != "auto" ] && [ "${{ github.event.inputs.release_type }}" != "" ]; then
echo "bump=${{ github.event.inputs.release_type }}" >> $GITHUB_OUTPUT
else
echo "bump=auto" >> $GITHUB_OUTPUT
fi
- name: Semantic Release
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: |
if [ "${{ steps.version.outputs.bump }}" == "auto" ]; then
uv run semantic-release version --commit --tag --push --changelog
else
uv run semantic-release version --${{ steps.version.outputs.bump }} --commit --tag --push --changelog
fi
- name: Get new version
id: get_version
run: |
VERSION=$(uv run python -c "import tomllib; print(tomllib.load(open('pyproject.toml', 'rb'))['project']['version'])")
echo "version=$VERSION" >> $GITHUB_OUTPUT
- name: Build package
run: |
uv build
- name: Create GitHub Release
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: |
gh release create v${{ steps.get_version.outputs.version }} \
--title "Release v${{ steps.get_version.outputs.version }}" \
--notes-file CHANGELOG.md \
--draft=false \
--prerelease=false \
dist/*
- name: Publish to PyPI
if: success()
env:
TWINE_USERNAME: __token__
TWINE_PASSWORD: ${{ secrets.PYPI_API_TOKEN }}
run: |
uv add --dev twine
uv run twine upload dist/* --verbose
notify:
runs-on: ubuntu-latest
needs: release
if: success()
steps:
- name: Notify success
run: |
echo "✅ Release completed successfully!"
echo "Version: v${{ needs.release.outputs.version }}"
echo "Published to PyPI and GitHub Releases"
cleanup:
runs-on: ubuntu-latest
needs: release
if: failure()
steps:
- name: Cleanup on failure
run: |
echo "❌ Release failed. Manual intervention may be required."
echo "Check logs for details and consider rolling back any partial changes."
