chore: release process upgrades (#39)

* chore: release process upgrades

* chore: dev dep group is not an extra

* chore: drop 3.9 support

* chore: upgrade pyarrow dep

Author: lmmx

.github/workflows/CI.yml

@@ -3,22 +3,79 @@ name: CI
 on:
   push:
     branches:
+      - main
       - master
+    tags:
+      - "*"
   pull_request:
   workflow_dispatch:
+  workflow_run:
+    workflows: ["Deploy Release"]
+    types:
+      - completed
+
+permissions:
+  contents: read
 
 jobs:
-  linux_tests:
+  check-commit:
+    runs-on: ubuntu-latest
+    if: >
+      (
+        (
+          (github.event_name == 'push')
+          || (github.event_name == 'pull_request' && github.event.pull_request.user.login == 'lmmx')
+        )
+        &&
+        (
+          startsWith(github.event.head_commit.message, 'chore(release)') ||
+          contains(github.event.head_commit.message, 'cibuildwheel')
+        )
+      )
+      || (github.event_name == 'workflow_dispatch')
+      || (github.event_name == 'workflow_run')
+    steps:
+      - name: Confirm commit message matched
+        run: echo "Commit message matched the condition."
+
+  build:
+    needs: [check-commit]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v7
+
+      - name: Build package
+        run: uv build
+
+      - name: Upload wheels
+        uses: actions/upload-artifact@v4
+        with:
+          name: wheels-sdist
+          path: dist
+
+  release:
+    name: Release
+    environment: pypi
     runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        target: [x86_64]
+    if: ${{ startsWith(github.ref, 'refs/tags/') || github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_run' }}
+    needs: [build]
+    permissions:
+      id-token: write
+      contents: write
+      attestations: write
     steps:
-      - uses: actions/checkout@v3
-      - name: "Install uv"
-        uses: astral-sh/setup-uv@v5
+      - uses: actions/download-artifact@v4
+
+      - name: Generate artifact attestation
+        uses: actions/attest-build-provenance@v1
+        with:
+          subject-path: "wheels-*/*"
+
+      - name: Publish to PyPI
+        if: ${{ startsWith(github.ref, 'refs/tags/') || github.event_name == 'workflow_run' }}
+        uses: pypa/gh-action-pypi-publish@release/v1
         with:
-          version: "0.6.8"
-      - name: Install the project
-        run: uv sync
-      - run: uv run pytest tests -s
+          packages-dir: wheels-sdist/

.github/workflows/deploy.yml

@@ -0,0 +1,36 @@
+name: Deploy Release
+
+on:
+  workflow_dispatch:
+
+jobs:
+  deploy-release:
+    name: Run just release
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          persist-credentials: true
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v7
+
+      - name: Install just
+        uses: taiki-e/install-action@64adfd9e935fa438859b9e080fd026720b2ba070 # tag=just
+        with:
+          tool: [email protected],[email protected]
+
+      - name: Configure git identity
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+
+      # Bump version, commit changes, tag as the version, and push both
+      # commit and tag (pushing the latter triggers package release)
+      - name: Run just release
+        run: just release

.github/workflows/test.yml

@@ -0,0 +1,82 @@
+name: Test
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref_name }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: true
+
+jobs:
+  get-python-versions:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    outputs:
+      python-versions: ${{ steps.get-versions.outputs.python-versions }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v7
+
+      - name: Get Python versions from pyproject.toml
+        id: get-versions
+        run: |
+          set -euo pipefail
+          MIN_VERSION=$(uvx --from=toml-cli toml get --toml-path=pyproject.toml project.requires-python | sed 's/>=//;s/"//g')
+
+          LIST=$(uv python list --all-versions --output-format json)
+
+          CPYTHON_VERSIONS=$(echo "$LIST" | jq -c --arg min "$MIN_VERSION" '
+            ($min | split(".") | {major: .[0]|tonumber, minor: .[1]|tonumber}) as $minv |
+            [.[] | {v:.version_parts, t:.variant, impl:.implementation}]
+            | unique_by([.v.minor,.t])
+            | map(select(
+                (.impl == "cpython") and
+                (.v.major == 3) and
+                (.v.minor >= $minv.minor)
+              ))
+            | map(select(.t != "freethreaded")) # Delete this line to include FT variants
+            | map("\(.v.major).\(.v.minor)\(if .t=="freethreaded" then "t" else "" end)")')
+
+          # PYPY_VERSIONS=$(echo "$LIST" | jq -c --arg min "$MIN_VERSION" '
+          #   ($min | split(".") | {major: .[0]|tonumber, minor: .[1]|tonumber}) as $minv |
+          #   [.[] | {v:.version_parts, t:.variant, impl:.implementation}]
+          #   | unique_by([.v.minor,.impl])
+          #   | map(select(
+          #       (.impl == "pypy") and
+          #       (.v.major == 3) and
+          #       (.v.minor >= $minv.minor)
+          #     ))
+          #   | map("pypy-\(.v.major).\(.v.minor)")')
+
+          # versions=$(jq -nc --argjson a "$CPYTHON_VERSIONS" --argjson b "$PYPY_VERSIONS" '$a + $b')
+          versions=$(jq -nc --argjson a "$CPYTHON_VERSIONS" '$a')
+
+          echo "python-versions=$versions" >> $GITHUB_OUTPUT
+
+  test:
+    needs: get-python-versions
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ${{ fromJson(needs.get-python-versions.outputs.python-versions) }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v7
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: Install dependencies
+        run: uv sync --group test
+
+      - name: Run tests
+        run: $(uv python find) -m pytest

.just/py-release.just

@@ -0,0 +1,36 @@
+# Release a new version, pass --help for options to `uv version --bump`
+release bump_level="patch":
+    #!/usr/bin/env -S echo-comment --shell-flags="-e" --color bright-green
+
+    ## Exit early if help was requested
+    if [[ "{{ bump_level }}" == "--help" ]]; then
+        uv version --help
+        exit 0
+    fi
+
+    # 📈 Bump the version in pyproject.toml (patch/minor/major: {{ bump_level }})
+    uv version --bump {{ bump_level }}
+
+    # 📦 Stage all changes (including the version bump)
+    git add --all
+
+    # 🔄 Create a temporary commit to capture the new version
+    git commit -m "chore(temp): version check"
+
+    # ✂️  Extract the new version number that was just set, undo the commit
+    new_version=$(uv version --short)
+    git reset --soft HEAD~1
+
+    # ✅ Stage everything again and create the real release commit
+    git add --all
+    git commit -m  "chore(release): bump 🐍 -> v$new_version"
+
+    # 🏷️ Create the git tag for this release
+    git tag -a "$new_version" -m "Release $new_version"
+
+    branch_name=$(git rev-parse --abbrev-ref HEAD);
+    # 🚀 Push the release commit to $branch_name
+    git push origin $branch_name
+
+    # 🚀 Push the commit tag to the remote (will trigger PyPI release via Trusted Publishing)
+    git push origin "$new_version"

.just/ship.just

@@ -0,0 +1,2 @@
+test *args:
+   $(uv python find) -m pytest {{args}}