Users/bogdanbebic/staging april

.github/dco.yml

@@ -0,0 +1,3 @@
+---
+require:
+  members: false

.github/dependabot.yml

@@ -0,0 +1,15 @@
+---
+version: 2
+updates:
+
+  # Maintain GitHub Actions dependencies
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+    labels:
+      - "bot"
+    commit-message:
+      prefix: "[CHORE](deps)"
+      include: "scope"

.github/workflows/check-python-code.yaml

@@ -1,7 +1,7 @@
 name: Check Python package code
 
 on:
-  pull_request_target:
+  pull_request:
     paths:
       - 'packages/**'
       - 'pyproject.toml'
@@ -16,20 +16,17 @@ on:
 jobs:
   check:
     runs-on: ubuntu-latest
-    if: github.event.pull_request.head.repo.full_name == github.repository
 
     steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ github.event.pull_request.head.sha }}
+      - uses: actions/checkout@v6
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v4
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
         with:
           version: "latest"
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: "3.10"
 

.github/workflows/check-python-package-versions.yaml

@@ -1,7 +1,7 @@
 name: Check Python package version numbers
 
 on:
-  pull_request_target:
+  pull_request:
     paths:
       - '**/pyproject.toml'
       - 'packages/**/__about__.py'
@@ -12,7 +12,6 @@ permissions:
 
 jobs:
   check:
-    if: github.event.pull_request.head.repo.full_name == github.repository
     uses: ./.github/workflows/reusable-check-python-package-versions.yaml
     with:
       before_commit: ${{ github.event.pull_request.base.sha }}

.github/workflows/enforce-change-type-label.yaml

@@ -9,7 +9,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Require exactly one change type label
-        uses: actions/github-script@v6
+        uses: actions/github-script@v8
         with:
           script: |
             const allChangeTypeLabels = new Set([

.github/workflows/publish-python-packages.yaml

@@ -0,0 +1,98 @@
+name: Publish Python packages to PyPI
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - '**/pyproject.toml'
+      - 'packages/**/__about__.py'
+  workflow_dispatch:
+    inputs:
+      aws_iam_role_name:
+        description: The name of the IAM role to assume for accessing CodeArtifact
+        type: string
+        required: false
+        default: GithubActions_Schema_CodeArtifact_Publish
+      domain:
+        description: The CodeArtifact domain name
+        type: string
+        required: false
+        default: overture-pypi
+      repository:
+        description: The CodeArtifact repository name
+        type: string
+        required: false
+        default: overture
+
+permissions:
+  id-token: write
+  contents: read
+
+jobs:
+  check:
+    if: github.event.repository.full_name == github.repository
+    uses: ./.github/workflows/reusable-check-python-package-versions.yaml
+    with:
+      before_commit: ${{ github.event.before }}
+      after_commit: ${{ github.event.after }}
+
+  publish:
+    needs: [check]
+    if: github.event.repository.full_name == github.repository && needs.check.outputs.num_changed_packages > 0
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        include: ${{ fromJson(needs.check.outputs.changed_packages) }}
+    steps:
+      - name: Install uv
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
+        with:
+          version: latest
+
+      - name: Check out code
+        uses: actions/checkout@v6
+
+      - name: Sync code to make packages visible to Python
+        run: uv sync --all-packages
+
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v6
+        with:
+          aws-region: us-west-2
+          role-to-assume: arn:aws:iam::505071440022:role/GithubActions_Schema_CodeArtifact_Publish
+          role-session-name: GitHubActions_${{github.job}}_${{github.run_id}}
+
+      - name: Get CodeArtifact publish URL
+        id: get-code-artifact-params
+        run: |
+          token=$(./.github/workflows/scripts/code-artifact.sh token \
+            505071440022 us-west-2 overture-pypi)
+          echo "::add-mask::${token}"
+          echo "token=${token}" >> $GITHUB_OUTPUT
+          publish_url=$(./.github/workflows/scripts/code-artifact.sh publish-url \
+            505071440022 us-west-2 overture-pypi overture)
+          echo "publish_url=${publish_url}" >> $GITHUB_OUTPUT
+
+      - name: Publish package ${{ matrix.package }} version ${{ matrix.after }} to PyPI
+        env:
+          CA_TOKEN: ${{ steps.get-code-artifact-params.outputs.token }}
+          CA_PUBLISH_URL: ${{ steps.get-code-artifact-params.outputs.publish_url }}
+        run: |
+          package="${{ matrix.package }}"
+          before="${{ matrix.before }}"
+          after="${{ matrix.after }}"
+          printf 'Publishing package %s version %s to PyPI (previous version %s)...\n' "$package" "$after" "$before"
+          uv build --package "$package"
+          wheel="dist/${package//-/_}-${after}-py3-none-any.whl"
+          if [ ! -f "$wheel" ]; then
+            echo "    Wheel file [$wheel] not found. Aborting!"
+            exit 1
+          fi
+          tarball="dist/${package//-/_}-${after}.tar.gz"
+          if [ ! -f "$tarball" ]; then
+            echo "    Source tarball file [$tarball] not found. Aborting!"
+            exit 1
+          fi
+          uv publish "$wheel" "$tarball" \
+             -t "${CA_TOKEN}" \
+            --publish-url "${CA_PUBLISH_URL}"