python-semantic-release.yml

name: 🐍 Python Package CI/CD Pipeline (Automatic Release)

on:
  workflow_call:
    inputs:
      # Python Configuration
      python-version:
        description: 'Python version to use'
        type: string
        default: '3.12'
      
      # Security Configuration  
      security-engine:
        description: 'Security scan engine (gitleaks, gitguardian, both)'
        type: string
        default: 'both'
        
      # Testing Configuration
      run-tests:
        description: 'Run tests before release'
        type: boolean
        default: true
        
      run-security-scan:
        description: 'Run security scans'
        type: boolean
        default: true
        
      # Build Configuration
      build-local-wheel:
        description: 'Build and test local wheel package'
        type: boolean
        default: true
        
      # Release Configuration
      skip-pypi:
        description: 'Skip PyPI publishing'
        type: boolean
        default: false
        
        
      # Documentation & Security Updates
      update-documentation:
        description: 'Update documentation after release'
        type: boolean
        default: true
        
      update-security-policy:
        description: 'Update security policy after release'
        type: boolean
        default: true
      runs-on:
        description: 'Runner to use. Use string for GitHub-hosted (e.g., "ubuntu-latest") or JSON array for self-hosted (e.g., ["self-hosted", "linux"])'
        required: false
        type: string
        default: 'ubuntu-latest'

    secrets:
      PYPI_API_TOKEN:
        description: 'PyPI API token (optional if using Trusted Publishing)'
        required: false
      GITGUARDIAN_API_KEY:
        description: 'GitGuardian API key for security scanning'
        required: false
      GITLEAKS_LICENSE:
        description: 'Gitleaks Pro license key'
        required: false

    outputs:
      released:
        description: 'Whether a release was created'
        value: ${{ jobs.release.outputs.released }}
      version:
        description: 'Release version'
        value: ${{ jobs.release.outputs.version }}
      tag:
        description: 'Git tag name'
        value: ${{ jobs.release.outputs.tag }}

permissions:
  contents: write           # Git commits, releases, workflow file access
  issues: write            # GitHub Issues creation/updates  
  pull-requests: write     # PR operations, comments
  id-token: write          # PyPI Trusted Publishing
  checks: write            # PR validation checks
  security-events: write   # Security scan results upload
  actions: read            # Workflow run access for security/license scans

jobs:
  # PR validation for pull requests
  pr-validation:
    name: PR Quality Gate
    if: github.event_name == 'pull_request'
    uses: bauer-group/automation-templates/.github/workflows/modules-pr-validation.yml@main
    with:
      enable-security-scan: ${{ inputs.run-security-scan }}
      enable-license-check: true
      enable-commit-lint: true
      security-scan-engine: ${{ inputs.security-engine }}
      fail-on-security-issues: true
      fail-on-license-issues: false
    secrets: inherit

  # Python testing and quality checks
  test-and-quality:
    name: 🧪 Tests & Quality
    if: inputs.run-tests == true && github.event_name != 'pull_request'
    runs-on: ${{ startsWith(inputs.runs-on, '[') && fromJSON(inputs.runs-on) || inputs.runs-on }}
    outputs:
      tests-passed: ${{ steps.run-tests.outputs.tests-passed || 'skipped' }}
      coverage-percentage: ${{ steps.run-tests.outputs.coverage-percentage || 'N/A' }}
      security-issues-found: ${{ steps.security-scan.outputs.security-issues-found || steps.security-scan-fallback.outputs.security-issues-found || '0' }}
      linting-issues-found: ${{ steps.lint-code.outputs.linting-issues-found || '0' }}
    
    steps:
      - name: 📥 Checkout Repository
        uses: actions/checkout@v6
        with:
          fetch-depth: 0
          
      - name: 🐍 Setup Python
        uses: actions/setup-python@v6
        with:
          python-version: ${{ inputs.python-version }}
          cache: pip
          
      - name: 📦 Install Dependencies
        run: |
          python -m pip install --upgrade pip
          
          # Install project in editable mode
          if [ -f "pyproject.toml" ]; then
            pip install -e ".[dev]" 2>/dev/null || pip install -e .
          elif [ -f "setup.py" ]; then
            pip install -e .
          fi
          
          # Install test dependencies
          pip install pytest pytest-cov pytest-xdist bandit ruff pip-audit
          
          # Install tomli for Python <3.11 compatibility (needed for pyproject.toml parsing)
          python -c "import sys; sys.exit(0 if sys.version_info >= (3,11) else 1)" || pip install tomli
          
      - name: 🧪 Run Tests
        id: run-tests
        run: |
          # Detect test directory intelligently
          if [ -d "tests" ]; then
            TEST_DIR="tests"
          elif [ -d "test" ]; then
            TEST_DIR="test"
          else
            echo "⚠️ No test directory found, creating placeholder"
            mkdir tests
            echo 'def test_placeholder(): assert True' > tests/test_placeholder.py
            TEST_DIR="tests"
          fi
          
          # Run tests with coverage (capture exit code properly)
          set +e  # Allow command to fail without stopping the script
          pytest "$TEST_DIR" --cov=. --cov-report=xml --cov-report=html -n auto --tb=short -q
          TEST_EXIT_CODE=$?
          set -e  # Re-enable exit on error
          
          # Extract test results and coverage
          if [ $TEST_EXIT_CODE -eq 0 ]; then
            echo "tests-passed=true" >> $GITHUB_OUTPUT
          else
            echo "tests-passed=false" >> $GITHUB_OUTPUT
            echo "❌ Tests failed with exit code $TEST_EXIT_CODE"
          fi
          
          # Extract coverage percentage if coverage.xml exists (with error handling)
          if [ -f "coverage.xml" ]; then
            COVERAGE=$(python -c "
            import xml.etree.ElementTree as ET
            import sys
            try:
                tree = ET.parse('coverage.xml')
                root = tree.getroot()
                coverage = root.attrib.get('line-rate', '0')
                result = float(coverage) * 100
                print(f'{result:.1f}')
            except Exception as e:
                print('N/A', file=sys.stderr)
                print('N/A')
            " 2>/dev/null || echo "N/A")
            echo "coverage-percentage=$COVERAGE" >> $GITHUB_OUTPUT
          else
            echo "coverage-percentage=N/A" >> $GITHUB_OUTPUT
          fi
          
          # Fail the step if tests failed (after extracting all information)
          if [ $TEST_EXIT_CODE -ne 0 ]; then
            exit $TEST_EXIT_CODE
          fi
          
      - name: 🔐 Security Scan
        id: security-scan
        if: inputs.run-security-scan == true
        run: |
          # Run bandit security scan
          bandit -r . -f json -o bandit-report.json || true
          
          # Run pip-audit vulnerability check (modern replacement for safety)
          pip-audit --format=json --output=pip-audit-report.json || echo "⚠️ Vulnerability scan completed with warnings"
          
          # Count security issues (with robust error handling)
          BANDIT_ISSUES=0
          VULN_ISSUES=0
          
          if [ -f "bandit-report.json" ] && [ -s "bandit-report.json" ]; then
            BANDIT_ISSUES=$(python -c "
            import json
            import sys
            try:
                with open('bandit-report.json', 'r') as f:
                    data = json.load(f)
                if isinstance(data, dict) and 'results' in data:
                    print(len(data['results']))
                else:
                    print(0)
            except Exception as e:
                print(0, file=sys.stderr)
                print(0)
            " 2>/dev/null || echo "0")
          fi
          
          if [ -f "pip-audit-report.json" ] && [ -s "pip-audit-report.json" ]; then
            VULN_ISSUES=$(python -c "
            import json
            import sys
            try:
                with open('pip-audit-report.json', 'r') as f:
                    data = json.load(f)
                if isinstance(data, dict) and 'dependencies' in data:
                    total = sum(len(dep.get('vulns', [])) for dep in data['dependencies'] if isinstance(dep, dict))
                    print(total)
                else:
                    print(0)
            except Exception as e:
                print(0, file=sys.stderr)
                print(0)
            " 2>/dev/null || echo "0")
          fi
          
          # Ensure numeric values
          BANDIT_ISSUES=${BANDIT_ISSUES:-0}
          VULN_ISSUES=${VULN_ISSUES:-0}
          TOTAL_SECURITY_ISSUES=$((BANDIT_ISSUES + VULN_ISSUES))
          echo "security-issues-found=$TOTAL_SECURITY_ISSUES" >> $GITHUB_OUTPUT
          
      - name: 🔐 Security Scan Fallback
        id: security-scan-fallback
        if: inputs.run-security-scan != true
        run: |
          echo "security-issues-found=0" >> $GITHUB_OUTPUT
          
      - name: 🧹 Lint Code
        id: lint-code
        run: |
          ruff check . --output-format=json --output-file=ruff-report.json || true
          
          # Count linting issues (with robust error handling)
          LINT_ISSUES=0
          if [ -f "ruff-report.json" ] && [ -s "ruff-report.json" ]; then
            LINT_ISSUES=$(python -c "
            import json
            import sys
            try:
                with open('ruff-report.json', 'r') as f:
                    data = json.load(f)
                if isinstance(data, list):
                    print(len(data))
                elif isinstance(data, dict):
                    # Some linters return dict format
                    print(len(data.get('messages', [])))
                else:
                    print(0)
            except Exception as e:
                print(0, file=sys.stderr)
                print(0)
            " 2>/dev/null || echo "0")
          fi
          
          # Ensure numeric value
          LINT_ISSUES=${LINT_ISSUES:-0}
          echo "linting-issues-found=$LINT_ISSUES" >> $GITHUB_OUTPUT
          
      - name: 📊 Upload Coverage
        uses: codecov/codecov-action@v4
        with:
          file: ./coverage.xml
          fail_ci_if_error: false

  # Semantic Release - The main event (MOVED UP)
  release:
    name: 🚀 Semantic Release
    if: always() && (github.event_name == 'push' || github.event_name == 'workflow_call') && (needs.test-and-quality.result == 'success' || needs.test-and-quality.result == 'skipped') && (needs.security-scan.result == 'success' || needs.security-scan.result == 'skipped') && (needs.license-compliance.result == 'success' || needs.license-compliance.result == 'skipped')
    needs: [test-and-quality, security-scan, license-compliance]
    runs-on: ${{ startsWith(inputs.runs-on, '[') && fromJSON(inputs.runs-on) || inputs.runs-on }}
    concurrency: release
    outputs:
      released: ${{ steps.release.outputs.released }}
      version: ${{ steps.release.outputs.version }}
      tag: ${{ steps.release.outputs.tag }}
      wheel-built: ${{ steps.release.outputs.wheel-built }}
      wheel-tested: ${{ steps.release.outputs.wheel-tested }}
      package-name: ${{ steps.release.outputs.package-name }}
      
    steps:
      - name: 📥 Checkout Repository
        uses: actions/checkout@v6
        with:
          fetch-depth: 0
          token: ${{ secrets.GITHUB_TOKEN }}
          
      - name: 🐍 Setup Python
        uses: actions/setup-python@v6
        with:
          python-version: ${{ inputs.python-version }}
          
      - name: 📦 Install python-semantic-release and build tools
        run: |
          python -m pip install --upgrade pip
          pip install python-semantic-release build
          
          # Install tomli for Python <3.11 compatibility (needed for pyproject.toml parsing)
          python -c "import sys; sys.exit(0 if sys.version_info >= (3,11) else 1)" || pip install tomli
          
      - name: 📋 Ensure Changelog Exists
        run: |
          # Create CHANGELOG.MD if it doesn't exist (semantic-release needs it)
          if [ ! -f "CHANGELOG.MD" ]; then
            echo "📝 Creating CHANGELOG.MD for semantic-release"
            echo "# Changelog" > CHANGELOG.MD            
            echo "" >> CHANGELOG.MD
            echo "✅ CHANGELOG.MD created successfully"
          else
            echo "✅ CHANGELOG.MD already exists"
          fi

      - name: 🚀 Python Semantic Release
        id: release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          # Configure git
          git config --global user.name "github-actions[bot]"
          git config --global user.email "github-actions[bot]@users.noreply.github.com"

          # Sync with remote to avoid push conflicts
          echo "📥 Syncing with remote branch..."
          git fetch origin ${{ github.ref_name }}

          # Check if remote has changes
          LOCAL=$(git rev-parse HEAD)
          REMOTE=$(git rev-parse origin/${{ github.ref_name }})

          if [ "$LOCAL" != "$REMOTE" ]; then
            echo "⚠️ Remote branch has changes, rebasing..."
            git pull --rebase origin ${{ github.ref_name }}
          else
            echo "✅ Local and remote are in sync"
          fi

          # Run semantic release (creates version, commit, tag, release, and builds packages)
          semantic-release --verbose version
          
          # Check if release was created and extract build information
          if git describe --exact-match --tags HEAD 2>/dev/null; then
            echo "released=true" >> $GITHUB_OUTPUT
            VERSION=$(git describe --tags --abbrev=0)
            echo "version=$VERSION" >> $GITHUB_OUTPUT
            echo "tag=$VERSION" >> $GITHUB_OUTPUT
            
            # Check if wheel was built
            if ls dist/*.whl >/dev/null 2>&1; then
              echo "wheel-built=true" >> $GITHUB_OUTPUT
              WHEEL_FILE=$(ls dist/*.whl | head -n1)
              echo "✅ Wheel built successfully: $WHEEL_FILE"
              
              # Test wheel import
              pip install "$WHEEL_FILE" 2>/dev/null || echo "⚠️ Wheel install test skipped"
              
              # Extract package name for testing
              if [ -f "pyproject.toml" ]; then
                PACKAGE_NAME=$(python -c "
                try: import tomllib
                except ImportError: import tomli as tomllib
                with open('pyproject.toml', 'rb') as f:
                    config = tomllib.load(f)
                print(config['project']['name'].replace('-', '_'))
                " 2>/dev/null || echo "unknown")
                
                if [ "$PACKAGE_NAME" != "unknown" ]; then
                  echo "package-name=$PACKAGE_NAME" >> $GITHUB_OUTPUT
                  if python -c "import $PACKAGE_NAME; print('✅ Package import test successful')" 2>/dev/null; then
                    echo "wheel-tested=true" >> $GITHUB_OUTPUT
                  else
                    echo "wheel-tested=false" >> $GITHUB_OUTPUT
                    echo "⚠️ Package import test failed"
                  fi
                else
                  echo "package-name=unknown" >> $GITHUB_OUTPUT
                  echo "wheel-tested=unknown" >> $GITHUB_OUTPUT
                fi
              else
                echo "package-name=unknown" >> $GITHUB_OUTPUT
                echo "wheel-tested=unknown" >> $GITHUB_OUTPUT
              fi
            else
              echo "wheel-built=false" >> $GITHUB_OUTPUT
              echo "package-name=unknown" >> $GITHUB_OUTPUT
              echo "wheel-tested=false" >> $GITHUB_OUTPUT
              echo "⚠️ No wheel file found in dist/"
            fi
          else
            echo "released=false" >> $GITHUB_OUTPUT
            echo "version=" >> $GITHUB_OUTPUT
            echo "tag=" >> $GITHUB_OUTPUT
            echo "wheel-built=false" >> $GITHUB_OUTPUT
            echo "package-name=unknown" >> $GITHUB_OUTPUT
            echo "wheel-tested=false" >> $GITHUB_OUTPUT
          fi

      - name: 📤 Upload Build Artifacts
        if: steps.release.outputs.released == 'true' && steps.release.outputs.wheel-built == 'true'
        uses: actions/upload-artifact@v6
        with:
          name: python-wheel-${{ github.run_number }}
          path: dist/
          retention-days: 30

  # Comprehensive security scan
  security-scan:
    name: 🔐 Security Analysis
    if: inputs.run-security-scan == true && github.event_name != 'pull_request'
    uses: bauer-group/automation-templates/.github/workflows/modules-security-scan.yml@main
    with:
      scan-engine: ${{ inputs.security-engine }}
      scan-type: 'all'
      fail-on-findings: false
      minimum-severity: 'medium'
    secrets: inherit

  # License compliance check
  license-compliance:
    name: 📄 License Compliance
    if: github.event_name != 'pull_request'
    uses: bauer-group/automation-templates/.github/workflows/modules-license-compliance.yml@main
    with:
      fail-on-forbidden: false
      fail-on-unknown: false
      scan-dependencies: true
      generate-sbom: true
    secrets: inherit


  # Publish to PyPI using packages built by semantic-release
  pypi-publish:
    name: 📤 Publish to PyPI
    if: needs.release.outputs.released == 'true' && needs.release.outputs.wheel-built == 'true' && inputs.skip-pypi != true
    needs: [release]
    runs-on: ${{ startsWith(inputs.runs-on, '[') && fromJSON(inputs.runs-on) || inputs.runs-on }}
    environment: production
    
    steps:
      - name: 📥 Download Build Artifacts
        uses: actions/download-artifact@v7
        with:
          name: python-wheel-${{ github.run_number }}
          path: dist/
          
      - name: 📤 Publish to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          # Uses Trusted Publishing by default (recommended)
          # Falls back to token if PYPI_API_TOKEN is provided
          password: ${{ secrets.PYPI_API_TOKEN }}

  # Update documentation for new release
  update-documentation:
    name: 📚 Update Documentation
    if: needs.release.outputs.released == 'true' && inputs.update-documentation == true
    needs: [release]
    uses: bauer-group/automation-templates/.github/workflows/documentation.yml@main
    with:
      force-update: true
      custom-version: ${{ needs.release.outputs.version }}
    secrets: inherit

  # Update security policy for new release
  update-security:
    name: 🔒 Update Security Policy
    if: needs.release.outputs.released == 'true' && inputs.update-security-policy == true
    needs: [release, update-documentation]
    uses: bauer-group/automation-templates/.github/workflows/security-management.yml@main
    with:
      force-update: true
      custom-version: ${{ needs.release.outputs.version }}
    secrets: inherit

  # Pipeline summary
  pipeline-summary:
    name: 📊 Pipeline Summary
    if: always() && ((github.event_name == 'push' && github.ref == 'refs/heads/main') || github.event_name == 'workflow_call')
    needs: [test-and-quality, security-scan, license-compliance, release, pypi-publish, update-documentation, update-security]
    runs-on: ${{ startsWith(inputs.runs-on, '[') && fromJSON(inputs.runs-on) || inputs.runs-on }}
    
    steps:
      - name: 📊 Generate Pipeline Summary
        run: |
          echo "### 🐍 Python Semantic Release Pipeline Summary" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "**Repository:** ${{ github.repository }}" >> $GITHUB_STEP_SUMMARY
          echo "**Pipeline:** Modern Python Semantic Release" >> $GITHUB_STEP_SUMMARY
          echo "**Event:** ${{ github.event_name }}" >> $GITHUB_STEP_SUMMARY
          echo "**Branch:** ${{ github.ref_name }}" >> $GITHUB_STEP_SUMMARY
          echo "**Python Version:** ${{ inputs.python-version }}" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          
          echo "| Stage | Status | Details |" >> $GITHUB_STEP_SUMMARY
          echo "|-------|--------|---------|" >> $GITHUB_STEP_SUMMARY
          # Test & Quality details (with safe fallbacks for skipped jobs)
          TEST_DETAILS="Python ${{ inputs.python-version }}"
          
          if [ "${{ needs.test-and-quality.result }}" != "skipped" ]; then
            COVERAGE="${{ needs.test-and-quality.outputs.coverage-percentage }}"
            SECURITY_ISSUES="${{ needs.test-and-quality.outputs.security-issues-found }}"
            LINT_ISSUES="${{ needs.test-and-quality.outputs.linting-issues-found }}"
            
            if [ "$COVERAGE" != "" ] && [ "$COVERAGE" != "N/A" ] && [ "$COVERAGE" != "null" ]; then
              TEST_DETAILS="$TEST_DETAILS, Coverage: ${COVERAGE}%"
            fi
            if [ "$SECURITY_ISSUES" != "" ] && [ "$SECURITY_ISSUES" != "null" ]; then
              TEST_DETAILS="$TEST_DETAILS, Security: ${SECURITY_ISSUES} issues"
            fi
            if [ "$LINT_ISSUES" != "" ] && [ "$LINT_ISSUES" != "null" ]; then
              TEST_DETAILS="$TEST_DETAILS, Lint: ${LINT_ISSUES} issues"
            fi
          else
            TEST_DETAILS="$TEST_DETAILS (tests disabled)"
          fi
          
          echo "| **Tests & Quality** | ${{ needs.test-and-quality.result == 'success' && '✅ PASS' || needs.test-and-quality.result == 'skipped' && '⏭️ SKIP' || '❌ FAIL' }} | $TEST_DETAILS |" >> $GITHUB_STEP_SUMMARY
          # Build Wheel details (now integrated in semantic-release)
          BUILD_DETAILS="Integrated with release"
          
          if [ "${{ needs.release.outputs.released }}" == "true" ]; then
            PACKAGE_NAME="${{ needs.release.outputs.package-name }}"
            WHEEL_TESTED="${{ needs.release.outputs.wheel-tested }}"
            WHEEL_BUILT="${{ needs.release.outputs.wheel-built }}"
            
            if [ "$PACKAGE_NAME" != "" ] && [ "$PACKAGE_NAME" != "unknown" ] && [ "$PACKAGE_NAME" != "null" ]; then
              BUILD_DETAILS="Package: $PACKAGE_NAME"
            fi
            if [ "$WHEEL_BUILT" == "true" ]; then
              BUILD_DETAILS="$BUILD_DETAILS, Built: ✅"
              if [ "$WHEEL_TESTED" == "true" ]; then
                BUILD_DETAILS="$BUILD_DETAILS, Import: ✅"
              elif [ "$WHEEL_TESTED" == "false" ]; then
                BUILD_DETAILS="$BUILD_DETAILS, Import: ❌"
              fi
            else
              BUILD_DETAILS="$BUILD_DETAILS, Built: ❌"
            fi
          else
            BUILD_DETAILS="$BUILD_DETAILS (no release created)"
          fi
          
          echo "| **Build Wheel** | ${{ needs.release.outputs.wheel-built == 'true' && '✅ PASS' || needs.release.outputs.released != 'true' && '⏭️ SKIP' || '❌ FAIL' }} | $BUILD_DETAILS |" >> $GITHUB_STEP_SUMMARY
          echo "| **Security Scan** | ${{ needs.security-scan.result == 'success' && '✅ PASS' || needs.security-scan.result == 'skipped' && '⏭️ SKIP' || '❌ FAIL' }} | Engine: ${{ inputs.security-engine }} |" >> $GITHUB_STEP_SUMMARY
          echo "| **License Compliance** | ${{ needs.license-compliance.result == 'success' && '✅ PASS' || needs.license-compliance.result == 'skipped' && '⏭️ SKIP' || '❌ FAIL' }} | SBOM generated |" >> $GITHUB_STEP_SUMMARY
          echo "| **Semantic Release** | ${{ needs.release.result == 'success' && '✅ PASS' || '❌ FAIL' }} | Released: ${{ needs.release.outputs.released || 'false' }} |" >> $GITHUB_STEP_SUMMARY
          # PyPI Publishing details with proper skip handling
          PYPI_STATUS="❌ FAIL"
          PYPI_DETAILS="Package upload"
          
          # Check if PyPI publishing was intentionally skipped
          if [ "${{ inputs.skip-pypi }}" == "true" ]; then
            PYPI_STATUS="⏭️ SKIP"
            PYPI_DETAILS="PyPI upload disabled by parameter"
          elif [ "${{ needs.release.outputs.released }}" != "true" ]; then
            PYPI_STATUS="⏭️ SKIP"
            PYPI_DETAILS="No release created to publish"
          elif [ "${{ needs.release.outputs.wheel-built }}" != "true" ]; then
            PYPI_STATUS="⏭️ SKIP"
            PYPI_DETAILS="No wheel built to publish"
          elif [ "${{ needs.pypi-publish.result }}" == "success" ]; then
            PYPI_STATUS="✅ PUBLISHED"
            PYPI_DETAILS="Package uploaded to PyPI"
          elif [ "${{ needs.pypi-publish.result }}" == "skipped" ]; then
            PYPI_STATUS="⏭️ SKIP"
            PYPI_DETAILS="PyPI job skipped"
          elif [ "${{ needs.pypi-publish.result }}" != "" ]; then
            PYPI_STATUS="❌ FAIL"
            PYPI_DETAILS="PyPI upload failed"
          else
            # Job didn't run (conditional was false)
            PYPI_STATUS="⏭️ SKIP"
            PYPI_DETAILS="PyPI upload not triggered"
          fi
          
          echo "| **PyPI Publishing** | $PYPI_STATUS | $PYPI_DETAILS |" >> $GITHUB_STEP_SUMMARY
          echo "| **Documentation** | ${{ needs.update-documentation.result == 'success' && '✅ UPDATED' || needs.update-documentation.result == 'skipped' && '⏭️ SKIP' || '❌ FAIL' }} | Auto-generated docs |" >> $GITHUB_STEP_SUMMARY
          echo "| **Security Policy** | ${{ needs.update-security.result == 'success' && '✅ UPDATED' || needs.update-security.result == 'skipped' && '⏭️ SKIP' || '❌ FAIL' }} | Auto-updated |" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          
          if [ "${{ needs.release.outputs.released }}" = "true" ]; then
            echo "🎉 **Python Release ${{ needs.release.outputs.version }} created successfully!**" >> $GITHUB_STEP_SUMMARY
            echo "" >> $GITHUB_STEP_SUMMARY
            echo "**Installation:**" >> $GITHUB_STEP_SUMMARY
            
            if [ "${{ inputs.skip-pypi }}" != "true" ]; then
              echo "\`\`\`bash" >> $GITHUB_STEP_SUMMARY
              echo "pip install <package-name>==${{ needs.release.outputs.version }}" >> $GITHUB_STEP_SUMMARY
              echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
            else
              echo "\`\`\`bash" >> $GITHUB_STEP_SUMMARY
              echo "pip install git+https://github.com/${{ github.repository }}@${{ needs.release.outputs.tag }}" >> $GITHUB_STEP_SUMMARY
              echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
            fi
            
            echo "" >> $GITHUB_STEP_SUMMARY
            echo "**Release:** [View on GitHub](https://github.com/${{ github.repository }}/releases/tag/${{ needs.release.outputs.tag }})" >> $GITHUB_STEP_SUMMARY
          else
            echo "ℹ️ **No release created.** Pipeline completed successfully." >> $GITHUB_STEP_SUMMARY
          fi
          
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "---" >> $GITHUB_STEP_SUMMARY
          echo "*Powered by **python-semantic-release** and **BAUER GROUP** automation* 🐍" >> $GITHUB_STEP_SUMMARY