fix(template): improve GitHub Actions workflow templates

- fix: use {% raw %} to protect GitHub Actions expressions
- fix: remove redundant setup.yaml workflow
- fix: update version tag pattern to match semantic versioning
- fix: use cookiecutter variables for Python version

Author: colyerdeng

.github/workflows/deploy_docs.yaml

@@ -3,7 +3,7 @@ name: Deploy Docs
 on:
   push:
     tags:
-      - '*'  # 匹配所有标签
+      - '[0-9]*.[0-9]*.[0-9]*'  # 匹配语义化版本号标签 (e.g., 1.0.0, 1.0.0-beta)
   workflow_dispatch:  # 保留手动触发选项
 
 permissions:

.github/workflows/release_build.yaml

@@ -3,7 +3,7 @@ name: release-build
 on:
   push:
     tags:
-      - '*'  # 匹配所有标签
+      - '[0-9]*.[0-9]*.[0-9]*'  # 匹配语义化版本号标签 (e.g., 1.0.0, 1.0.0-beta)
   workflow_dispatch:
     inputs:
       version:

repo_scaffold/templates/template-python/{{cookiecutter.project_slug}}/.github/workflows/bump_version.yaml

@@ -31,12 +31,12 @@ jobs:
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
-          token: ${{ github.token }}
+          {% raw %}token: ${{ github.token }}{% endraw %}
 
       - name: Setup Python
         uses: actions/setup-python@v5
         with:
-          python-version: "3.12"
+          python-version: "{{ cookiecutter.max_python_version[0] }}"
 
       - name: Install uv
         uses: astral-sh/setup-uv@v5
@@ -48,14 +48,14 @@ jobs:
         name: Create bump and changelog
         uses: commitizen-tools/commitizen-action@master
         with:
-          github_token: ${{ github.token }}
+          {% raw %}github_token: ${{ github.token }}{% endraw %}
           changelog_increment_filename: body.md
-          increment: ${{ github.event.inputs.increment }}
+          {% raw %}increment: ${{ github.event.inputs.increment }}{% endraw %}
 
       - name: Create Release
         uses: softprops/action-gh-release@v2
         with:
           body_path: body.md
-          tag_name: ${{ env.REVISION }}
+          {% raw %}tag_name: ${{ env.REVISION }}{% endraw %}
         env:
-          GITHUB_TOKEN: ${{ github.token }}
+          {% raw %}GITHUB_TOKEN: ${{ github.token }}{% endraw %}

repo_scaffold/templates/template-python/{{cookiecutter.project_slug}}/.github/workflows/deploy_docs.yaml

@@ -4,7 +4,7 @@ name: Deploy Docs
 on:
   push:
     tags:
-      - '*'  # 匹配所有标签
+      - '[0-9]*.[0-9]*.[0-9]*'  # 匹配语义化版本号标签 (e.g., 1.0.0, 1.0.0-beta)
   workflow_dispatch:  # 保留手动触发选项
 
 permissions:
@@ -24,5 +24,5 @@ jobs:
       - name: Build and deploy documentation
         run: uvx mkdocs gh-deploy --force
         env:
-          GITHUB_TOKEN: ${{ needs.setup.outputs.PERSONAL_ACCESS_TOKEN || github.token }}
+          {% raw %}GITHUB_TOKEN: ${{ needs.setup.outputs.PERSONAL_ACCESS_TOKEN || github.token }}{% endraw %}
 {% endif %}

repo_scaffold/templates/template-python/{{cookiecutter.project_slug}}/.github/workflows/release_build.yaml

@@ -3,7 +3,7 @@ name: release_build
 on:
   push:
     tags:
-      - '*'  # 匹配所有标签
+      - '[0-9]*.[0-9]*.[0-9]*'  # 匹配语义化版本号标签 (e.g., 1.0.0, 1.0.0-beta)
   workflow_dispatch:
     inputs:
       version:
@@ -16,40 +16,50 @@ permissions:
   id-token: write  # 用于发布到 PyPI
 
 jobs:
-  setup:
-    uses: ./.github/workflows/setup.yaml
-    with:
-      install-deps: dev
-      python-version: "{{ cookiecutter.max_python_version }}"
-    secrets:
-      OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
-      PERSONAL_ACCESS_TOKEN: ${{ secrets.PERSONAL_ACCESS_TOKEN }}
-    outputs:
-      personal-access-token: ${{ secrets.PERSONAL_ACCESS_TOKEN }}
-
   build:
-    needs: setup
     runs-on: ubuntu-latest
     steps:
-      - name: Run tests
-        run: uvx nox -s test_all
+      - uses: actions/checkout@v4
+      
+      - name: Load secret
+        uses: 1password/load-secrets-action@v2
+        with:
+          export-env: true
+        env:
+          {% raw %}OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}{% endraw %}
+          PERSONAL_ACCESS_TOKEN: op://shawndengdev/github_access_token/credential
+          PYPI_TOKEN: op://shawndengdev/pypi_token/credential
 
-      - name: Build package
-        run: uvx nox -s build
+      - name: Setup Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "{{ cookiecutter.max_python_version[0] }}"
 
-      - name: Create Release
-        id: create_release
-        uses: softprops/action-gh-release@v2
+      - name: Install uv
+        uses: astral-sh/setup-uv@v5
         with:
-          token: ${{ needs.setup.outputs.PERSONAL_ACCESS_TOKEN || github.token }}
-          tag_name: ${{ github.event.inputs.version || github.ref_name }}
-          draft: false
-          prerelease: false
-          files: |
-            dist/*
+          version: ">=0.4.0"
+
+      - name: Install dependencies
+        run: uv sync --extra dev
+
+      - name: Build and test
+        run: |
+          uvx nox -s lint
+          uvx nox -s test
+          uvx nox -s build
 
       - name: Publish to PyPI
-        uses: pypa/gh-action-pypi-publish@release/v1
+        env:
+          {% raw %}UV_PUBLISH_TOKEN: ${{ env.PYPI_TOKEN }}{% endraw %}
+        run: uv publish
+
+      - name: Release
+        uses: softprops/action-gh-release@v2
         with:
-          packages-dir: dist/
-          repository-url: https://upload.pypi.org/legacy/
+          files: |
+            dist/*.tar.gz
+            dist/*.whl
+          generate_release_notes: true
+        env:
+          {% raw %}GITHUB_TOKEN: ${{ env.PERSONAL_ACCESS_TOKEN }}{% endraw %}