From f58a590fe5e0cb4962dfa6bf67b269b1bb22c253 Mon Sep 17 00:00:00 2001 From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Date: Sat, 31 Oct 2026 15:07:49 +0000 Subject: [PATCH 1/3] Migrate releases to release-please Adds release-please (googleapis/release-please-action v5) to own the version bump, tag, and GitHub release. The publish workflow gains a workflow_dispatch trigger and is kicked off automatically when release-please cuts a release (GITHUB_TOKEN-created tags don't fire push/tags triggers). The draft-publishing 'release' job and release-drafter are removed; release notes now come from the release-please release itself. Co-Authored-By: Quentin Rousseau --- .github/release-drafter.yml | 55 --------------------------- .github/workflows/publish.yml | 46 +--------------------- .github/workflows/release-drafter.yml | 29 -------------- .github/workflows/release-please.yml | 26 +++++++++++++ .release-please-manifest.json | 3 ++ release-please-config.json | 12 ++++++ 6 files changed, 42 insertions(+), 129 deletions(-) delete mode 100644 .github/release-drafter.yml delete mode 100644 .github/workflows/release-drafter.yml create mode 100644 .github/workflows/release-please.yml create mode 100644 .release-please-manifest.json create mode 100644 release-please-config.json diff --git a/.github/release-drafter.yml b/.github/release-drafter.yml deleted file mode 100644 index bf6ece34..00000000 --- a/.github/release-drafter.yml +++ /dev/null @@ -1,55 +0,0 @@ -# Configuration for Release Drafter: https://github.com/toolmantim/release-drafter -name-template: v$RESOLVED_VERSION -tag-template: v$RESOLVED_VERSION - -template: | - $CHANGES - - ## OpenAPI spec - - - -categories: - - type: version-resolver - semver-increment: major - when: - label: breaking - - type: version-resolver - semver-increment: minor - when: - label: enhancement - - type: version-resolver - semver-increment: patch - - title: 🚀 New features and improvements - labels: - - enhancement - - title: 🐛 Bug fixes - labels: - - bug - - title: 📝 Documentation updates - labels: - - documentation - - title: 👻 Maintenance - labels: - - chore - - maintenance - - title: 🚦 Tests - labels: - - test - - title: ✍ Other changes - - title: 📦 Dependency updates - labels: - - dependencies - collapse-after: 5 - - title: 🔐 Security - labels: - - "🔐 security" - -exclude-labels: - - skip-changelog - - invalid - -autolabeler: - - label: "documentation" - files: - - "*.md" diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 13e0587f..5e283c69 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -4,6 +4,7 @@ on: push: tags: - 'v*' + workflow_dispatch: permissions: contents: read @@ -64,48 +65,3 @@ jobs: - name: Publish to PyPI uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # release/v1 - release: - needs: publish-to-pypi - runs-on: blacksmith-2vcpu-ubuntu-2404 - timeout-minutes: 5 - permissions: - contents: write - steps: - - name: Checkout Repository - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - name: Fetch annotated tag message - run: git fetch --force origin "refs/tags/${GITHUB_REF_NAME}:refs/tags/${GITHUB_REF_NAME}" - - name: Publish GitHub Release - env: - GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - run: | - TAG_REF="refs/tags/${GITHUB_REF_NAME}" - HIGHLIGHTS="" - if [ "$(git cat-file -t "$TAG_REF" 2>/dev/null || true)" = "tag" ]; then - HIGHLIGHTS=$(git for-each-ref "$TAG_REF" --format='%(contents)' | sed '/^-----BEGIN PGP SIGNATURE-----/,$d') - if [ -z "$(printf '%s' "$HIGHLIGHTS" | tr -d '[:space:]')" ]; then - HIGHLIGHTS="" - fi - fi - - RELEASE_ID=$(gh api "repos/${GITHUB_REPOSITORY}/releases?per_page=100" --jq 'map(select(.draft))[0].id // empty') - if [ -n "$RELEASE_ID" ]; then - BODY=$(gh api "repos/${GITHUB_REPOSITORY}/releases/${RELEASE_ID}" --jq '.body // ""') - if [ -n "$HIGHLIGHTS" ]; then - BODY=$(printf '## Highlights\n\n%s\n\n%s' "$HIGHLIGHTS" "$BODY") - fi - jq -n \ - --arg tag_name "$GITHUB_REF_NAME" \ - --arg name "$GITHUB_REF_NAME" \ - --arg body "$BODY" \ - '{tag_name: $tag_name, name: $name, body: $body, draft: false, make_latest: "true"}' \ - > /tmp/release.json - gh api --method PATCH "repos/${GITHUB_REPOSITORY}/releases/${RELEASE_ID}" --input /tmp/release.json - elif [ -n "$HIGHLIGHTS" ]; then - gh release create "$GITHUB_REF_NAME" --verify-tag --generate-notes \ - --title "$GITHUB_REF_NAME" --latest \ - --notes "$(printf '## Highlights\n\n%s' "$HIGHLIGHTS")" - else - gh release create "$GITHUB_REF_NAME" --verify-tag --generate-notes \ - --title "$GITHUB_REF_NAME" --latest - fi diff --git a/.github/workflows/release-drafter.yml b/.github/workflows/release-drafter.yml deleted file mode 100644 index 8e339724..00000000 --- a/.github/workflows/release-drafter.yml +++ /dev/null @@ -1,29 +0,0 @@ -name: Release Drafter - -on: - push: - branches: [master] - pull_request: - types: [opened, reopened, synchronize] - -permissions: - contents: read - -jobs: - update-release-draft: - if: github.event_name == 'push' - runs-on: blacksmith-2vcpu-ubuntu-2404 - permissions: - contents: write - pull-requests: read - steps: - - uses: release-drafter/release-drafter@978bb0b30c5ee8cdd332ced253758157150d43f0 # v7.10.0 - - auto-label: - if: github.event_name == 'pull_request' - runs-on: blacksmith-2vcpu-ubuntu-2404 - permissions: - contents: read - pull-requests: write - steps: - - uses: release-drafter/release-drafter/autolabeler@978bb0b30c5ee8cdd332ced253758157150d43f0 # v7.10.0 diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml new file mode 100644 index 00000000..a22caea1 --- /dev/null +++ b/.github/workflows/release-please.yml @@ -0,0 +1,26 @@ +name: Release Please + +on: + push: + branches: [master] + +permissions: + actions: write + contents: write + pull-requests: write + +jobs: + release-please: + runs-on: blacksmith-2vcpu-ubuntu-2404 + steps: + - uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0 + id: release + with: + token: ${{ secrets.GITHUB_TOKEN }} + + - name: Trigger publish workflow + if: ${{ steps.release.outputs.release_created }} + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + TAG: ${{ steps.release.outputs.tag_name }} + run: gh workflow run publish.yml --repo "$GITHUB_REPOSITORY" --ref "$TAG" diff --git a/.release-please-manifest.json b/.release-please-manifest.json new file mode 100644 index 00000000..d6f54056 --- /dev/null +++ b/.release-please-manifest.json @@ -0,0 +1,3 @@ +{ + ".": "3.0.1" +} diff --git a/release-please-config.json b/release-please-config.json new file mode 100644 index 00000000..a13c5676 --- /dev/null +++ b/release-please-config.json @@ -0,0 +1,12 @@ +{ + "$schema": "https://raw.githubusercontent.com/googleapis/release-please/main/schemas/config.json", + "packages": { + ".": { + "release-type": "python", + "bump-minor-pre-major": true, + "bump-patch-for-minor-pre-major": true, + "include-component-in-tag": false, + "skip-changelog": true + } + } +} From bc39ddf8f2c42fe93bb0b3e70afe9a8a7fd95faa Mon Sep 17 00:00:00 2001 From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Date: Sat, 31 Oct 2026 15:21:47 +0000 Subject: [PATCH 2/3] Create GitHub release on manual tag pushes MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Adds a release job gated on push events that creates the GitHub release when none exists (manual v* tag pushes). The release-please dispatch path is unaffected — this job only runs on push, and the release already exists there. Replaces the removed draft-publish tail job. Co-Authored-By: Quentin Rousseau --- .github/workflows/publish.yml | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 5e283c69..f30a2926 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -7,7 +7,7 @@ on: workflow_dispatch: permissions: - contents: read + contents: write jobs: build: @@ -65,3 +65,17 @@ jobs: - name: Publish to PyPI uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # release/v1 + + release: + if: github.event_name == 'push' + needs: + - publish-to-pypi + runs-on: blacksmith-2vcpu-ubuntu-2404 + steps: + - name: Create GitHub release if missing + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + TAG: ${{ github.ref_name }} + # Manual `git push origin v*` tags have no release yet; release-please + # dispatch never reaches this job (it only runs on push). + run: gh release view "$TAG" > /dev/null 2>&1 || gh release create "$TAG" --generate-notes --verify-tag From 02ae8e9463e4608e856a3dcfba3107a1d83af71a Mon Sep 17 00:00:00 2001 From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Date: Sat, 31 Oct 2026 15:25:59 +0000 Subject: [PATCH 3/3] Scope contents:write to the release job only Co-Authored-By: Quentin Rousseau --- .github/workflows/publish.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index f30a2926..073902d4 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -7,7 +7,7 @@ on: workflow_dispatch: permissions: - contents: write + contents: read jobs: build: @@ -71,6 +71,8 @@ jobs: needs: - publish-to-pypi runs-on: blacksmith-2vcpu-ubuntu-2404 + permissions: + contents: write steps: - name: Create GitHub release if missing env: