Migrate to GitHub Actions automated release process

.github/dependabot.yml

@@ -0,0 +1,14 @@
+# To get started with Dependabot version updates, you'll need to specify which
+# package ecosystems to update and where the package manifests are located.
+# Please see the documentation for all configuration options:
+# https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
+
+version: 2
+updates:
+ # Enable version updates for GitHub Actions
+  - package-ecosystem: "github-actions"
+    # Workflow files stored in the default location of `.github/workflows`
+    # You don't need to specify `/.github/workflows` for `directory`. You can use `directory: "/"`.
+    directory: "/"
+    schedule:
+      interval: "weekly"

.github/workflows/docs.yml

@@ -1,17 +1,29 @@
 name: Docs
 
-on: [push, workflow_dispatch]
+on:
+  push:
+  workflow_call:
+  workflow_dispatch:
 
 jobs:
   docs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v3
-    - uses: actions/setup-python@v4
-    - uses: actions/setup-node@v3
+    - uses: actions/checkout@v5
+
+    - name: Set up uv
+      uses: astral-sh/setup-uv@v7
+      with:
+        enable-cache: true
+        cache-dependency-glob: "pyproject.toml"
+
+    - name: Set up Python 3.13
+      run: uv python install 3.13
+
+    - uses: actions/setup-node@v4
       with:
-        node-version: 16
+        node-version: 20
 
     - run: npm install -g @mermaid-js/mermaid-cli
 

.github/workflows/lint.yml

@@ -0,0 +1,28 @@
+name: Lint
+
+on:
+  push:
+  workflow_call:
+  workflow_dispatch:
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: Set up uv
+        uses: astral-sh/setup-uv@v7
+        with:
+          enable-cache: true
+          cache-dependency-glob: "pyproject.toml"
+
+      - name: Set up Python 3.10
+        run: uv python install 3.10
+
+      - name: Install Project
+        run: make install
+
+      - name: Run checks
+        run: make check

.github/workflows/release.yml

@@ -0,0 +1,85 @@
+---
+name: Build & upload PyPI package
+
+on:
+  push:
+    branches: [master]
+    tags: ["*"]
+  release:
+    types:
+      - published
+  workflow_dispatch:
+
+jobs:
+  tests:
+    uses: "./.github/workflows/test.yml"
+  lint:
+    uses: "./.github/workflows/lint.yml"
+  typecheck:
+    uses: "./.github/workflows/typecheck.yml"
+
+  # Always build & lint package.
+  build-package:
+    name: Build & verify package
+    needs:
+      - lint
+      - tests
+      - typecheck
+    runs-on: ubuntu-latest
+    permissions:
+      attestations: write
+      id-token: write
+
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - uses: hynek/build-and-inspect-python-package@v2
+        with:
+          attest-build-provenance-github: 'true'
+
+  # Upload to Test PyPI on every commit on master.
+  release-test-pypi:
+    name: Publish in-dev package to test.pypi.org
+    environment: release-test-pypi
+    if: github.event_name == 'push' && github.ref == 'refs/heads/master'
+    runs-on: ubuntu-latest
+    needs:
+      - build-package
+    permissions:
+      id-token: write
+
+    steps:
+      - name: Download packages built by build-and-inspect-python-package
+        uses: actions/download-artifact@v6
+        with:
+          name: Packages
+          path: dist
+
+      - name: Upload package to Test PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          repository-url: https://test.pypi.org/legacy/
+
+  # Upload to real PyPI on GitHub Releases.
+  release-pypi:
+    name: Publish released package to pypi.org
+    environment: release-pypi
+    if: github.event.action == 'published'
+    runs-on: ubuntu-latest
+    needs:
+      - build-package
+    permissions:
+      id-token: write
+
+    steps:
+      - name: Download packages built by build-and-inspect-python-package
+        uses: actions/download-artifact@v6
+        with:
+          name: Packages
+          path: dist
+
+      - name: Upload package to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1

.github/workflows/test.yml

@@ -1,40 +1,101 @@
 name: Tests
 
-on: [push]
+on:
+  push:
+  workflow_call:
+  workflow_dispatch:
 
 jobs:
-  test:
-    name: Test ${{ matrix.python }} - ${{ matrix.os }}
+  tests:
+    name: Test ${{ matrix.python-version }} - ${{ matrix.os }}
     runs-on: ${{ matrix.os }}
 
     strategy:
       fail-fast: false
       matrix:
-        os:
-          - ubuntu-latest
-          - windows-latest
-          - macos-latest
-
-        python:
+        python-version:
           - "3.10"
           - "3.11"
           - "3.12"
           - "3.13"
           - "3.14"
+        os:
+          - ubuntu-latest
+          - macos-latest
+          - windows-latest
 
     steps:
       - uses: actions/checkout@v5
 
-      - name: Set up Python
-        uses: actions/setup-python@v5
+      - name: Set up uv
+        uses: astral-sh/setup-uv@v7
         with:
-          python-version: ${{ matrix.python }}
+          enable-cache: true
+          cache-dependency-glob: "pyproject.toml"
 
-      - name: Show Python version
-        run: python -c "import sys; print(sys.version)"
+      - name: Set up Python ${{ matrix.python-version }}
+        run: uv python install ${{ matrix.python-version }}
 
-      - name: Install environment
+      - name: Install Project (Windows)
+        if: runner.os == 'Windows'
+        run: make MAKESHELL='C:/Program Files/Git/usr/bin/bash' install
+
+      - name: Install Project (Unix)
+        if: runner.os != 'Windows'
         run: make install
 
-      - name: Run tests an collect code coverage
+      - name: Run Coverage (Windows)
+        if: runner.os == 'Windows'
+        run: make MAKESHELL='C:/Program Files/Git/usr/bin/bash' coverage
+
+      - name: Run Coverage (Unix)
+        if: runner.os != 'Windows'
         run: make coverage
+
+      - name: Upload coverage data
+        uses: actions/upload-artifact@v4
+        with:
+          name: coverage-data-${{ matrix.os }}-${{ matrix.python-version }}
+          path: .coverage.*
+          if-no-files-found: ignore
+          include-hidden-files: true
+
+  coverage:
+    name: Combine & check coverage
+    needs: tests
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: Set up uv
+        uses: astral-sh/setup-uv@v7
+        with:
+          enable-cache: true
+          cache-dependency-glob: "pyproject.toml"
+
+      - name: Set up Python 3.13
+        run: uv python install 3.13
+
+      - name: Install Project
+        run: make install
+
+      - name: Download coverage data
+        uses: actions/download-artifact@v4
+        with:
+          pattern: coverage-data-*
+          merge-multiple: true
+
+      - name: Combine coverage & fail if it's <100%
+        run: |
+          source venv/bin/activate
+          coverage combine
+          coverage html --skip-covered --skip-empty
+          coverage report --fail-under=100
+
+      - name: Upload HTML report if check failed
+        uses: actions/upload-artifact@v4
+        with:
+          name: html-report
+          path: htmlcov
+        if: ${{ failure() }}

.github/workflows/typecheck.yml

@@ -0,0 +1,28 @@
+name: Type checks
+
+on:
+  push:
+  workflow_call:
+  workflow_dispatch:
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+
+    steps:
+    - uses: actions/checkout@v5
+
+    - name: Set up uv
+      uses: astral-sh/setup-uv@v7
+      with:
+        enable-cache: true
+        cache-dependency-glob: "pyproject.toml"
+
+    - name: Set up Python 3.13
+      run: uv python install 3.13
+
+    - name: Install Project
+      run: make install
+
+    - name: Run Typechecks
+      run: make typecheck

.gitignore

@@ -3,6 +3,7 @@
 /.coverage
 /.mxmake
 /.ruff_cache
+/webresource/_version.py
 /CLAUDE.md
 /build
 /dist/

Makefile

@@ -172,6 +172,7 @@ COVERAGE_COMMAND?=\
 	coverage run \
 		--source webresource \
 		-m pytest tests \
+	&& coverage combine --keep \
 	&& coverage report --fail-under=100
 
 ## qa.mypy