ci: add release workflow automation (#1)

- Add tag-and-release workflow for automatic tagging and PyPI publishing
- Add create-release workflow for manual release creation with version bump PR

Author: kevinmessiaen

.github/workflows/create-release.yml

@@ -0,0 +1,86 @@
+name: Create Release
+
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Tag to be created, in the form X.Y.Z"
+        required: true
+        type: string
+
+permissions:
+  contents: write
+  packages: read
+  pull-requests: write
+
+jobs:
+  build-and-release:
+    runs-on: ubuntu-latest
+
+    steps:
+      # Check if the user is a member of the Giskard-AI organization
+      - name: Check if organization member
+        uses: JamesSingleton/is-organization-member@311430b0670cdec4036e721029b78018236a0b74 # 1.1.0
+        id: is_organization_member
+        with:
+          organization: Giskard-AI
+          username: ${{ github.actor }}
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Interrupt job if user is not a member of Giskard-AI organization
+        if: ${{ steps.is_organization_member.outputs.result == 'false' }}
+        shell: bash
+        run: |
+          echo "Job failed due to user not being a member of Giskard-AI organization and the 'safe for build' label not being set on the PR"
+          exit 1
+
+      - name: Validate version format
+        env:
+          VERSION_INPUT: ${{ inputs.version }}
+        run: |
+          if [[ ! "$VERSION_INPUT" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "Invalid version format. Use X.Y.Z"
+            exit 1
+          fi
+      # Checkout the repository
+      - name: Checkout repository
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
+        with:
+          fetch-tags: true
+          ref: main
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      # Write release version env vars
+      - name: Write release version env vars
+        env:
+          VERSION_INPUT: ${{ inputs.version }}
+        run: |
+          VERSION_NAME="v${VERSION_INPUT}"
+          VERSION_NUMBER="${VERSION_NAME:1}"
+          echo "VERSION_NUMBER=${VERSION_NUMBER}" >> $GITHUB_ENV
+          echo "VERSION_NAME=${VERSION_NAME}" >> $GITHUB_ENV
+
+      # Install uv
+      - name: Install uv
+        uses: astral-sh/setup-uv@85856786d1ce8acfbcc2f13a5f3fbd6b938f9f41 # v7
+
+      # Install toml-cli
+      - name: Install toml-cli
+        run: uv tool install toml-cli
+
+      # Update project version
+      - name: Update project version
+        run: toml set --toml-path pyproject.toml project.version "${{ env.VERSION_NUMBER }}"
+
+      - name: Commit changes and create PR
+        uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          branch: release/${{ env.VERSION_NAME }}
+          commit-message: "Release ${{ env.VERSION_NAME }}: Bump version to ${{ env.VERSION_NUMBER }}"
+          title: "Release ${{ env.VERSION_NAME }}"
+          body: |
+            This PR bumps the version to `${{ env.VERSION_NUMBER }}` for release.
+          labels: release
+          draft: false

.github/workflows/tag-and-release.yml

@@ -0,0 +1,85 @@
+name: Tag and Release
+
+on:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: write
+  packages: read
+  id-token: write
+
+jobs:
+  tag-and-release:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
+        with:
+          fetch-tags: true
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Read version from pyproject.toml
+        id: get_version
+        run: |
+          VERSION_NUMBER=$(grep '^version\s*=' pyproject.toml | head -1 | cut -d '"' -f2)
+          VERSION_NAME="v${VERSION_NUMBER}"
+          printf 'version_number=%s\n' "$VERSION_NUMBER" >> "$GITHUB_OUTPUT"
+          printf 'version_name=%s\n' "$VERSION_NAME" >> "$GITHUB_OUTPUT"
+
+      - name: Check if tag exists
+        env:
+          VERSION_NAME: ${{ steps.get_version.outputs.version_name }}
+        run: |
+          if git rev-parse "refs/tags/$VERSION_NAME" >/dev/null 2>&1; then
+            echo "Tag $VERSION_NAME already exists. Skipping."
+            exit 0
+          fi
+
+      - name: Configure git
+        run: |
+          git config --global user.name 'BotReleaser'
+          git config --global user.email 'bot.releaser@users.noreply.github.com'
+
+      - name: Create and push tag
+        env:
+          VERSION_NAME: ${{ steps.get_version.outputs.version_name }}
+        run: |
+          git tag "$VERSION_NAME"
+          git push origin "$VERSION_NAME"
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@85856786d1ce8acfbcc2f13a5f3fbd6b938f9f41 # v7
+
+      - name: Install dependencies
+        run: uv sync --frozen --all-extras --dev
+
+      - name: Build package
+        run: uv build
+
+      - name: Verify artifacts exist
+        run: |
+          ls -l dist
+          shopt -s nullglob
+          files=(dist/*.tar.gz dist/*.whl)
+          if [ ${#files[@]} -eq 0 ]; then
+            echo "No distribution files found in dist/"
+            exit 1
+          fi
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+
+      - name: Create GitHub Release
+        env:
+          VERSION_NAME: ${{ steps.get_version.outputs.version_name }}
+        uses: softprops/action-gh-release@5be0e66d93ac7ed76da52eca8bb058f665c3a5fe # v2
+        with:
+          tag_name: ${{ env.VERSION_NAME }}
+          fail_on_unmatched_files: true
+          generate_release_notes: true
+          files: |
+            dist/*.tar.gz
+            dist/*.whl