Automate drafting releases

.github/workflows/create-release.yml

@@ -0,0 +1,67 @@
+# Create a new release with the specified version
+
+name: Create New Release
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Release version (must be in format <MAJOR>.<MINOR>.<PATCH>, e.g. 1.1.1)'
+        required: true
+        type: string
+
+jobs:
+  verify-input:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - name: Verify input
+        env:
+          VERSION: ${{ inputs.version }}
+        run: |
+          # Make sure the input matches the intended format
+          SEMVER_REGEX="^([0-9]+)\.([0-9]+)\.([0-9]+)$"
+          if [[ ! "$VERSION" =~ $SEMVER_REGEX ]]; then
+            echo "::error::Invalid version format '$VERSION'. Must match X.Y.Z (e.g., 1.0.4)"
+            exit 1
+          fi
+
+          TAG="v$VERSION"
+
+          # Fail if the tag already exists
+          if git ls-remote --tags origin | grep -q "refs/tags/$TAG"; then
+            echo "Error: Tag $TAG already exists. Aborting."
+            exit 1
+          fi
+
+          echo "Creating Tag $TAG ..."
+
+  run-test:
+    permissions:
+      contents: read
+      id-token: write
+    needs: verify-input
+    uses: ./.github/workflows/python-package.yml
+
+  draft-release:
+    needs: run-test
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    environment: release
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - name: Draft release v${{ inputs.version }}
+        env:
+          GH_TOKEN: ${{ github.token }}
+          VERSION: ${{ inputs.version }}
+        run: |
+          gh release create "v$VERSION" \
+            --title "v$VERSION" \
+            --generate-notes \
+            --target "$GITHUB_SHA"
+
+          echo "Drafted release v$VERSION"
+

.github/workflows/publish-release.yml

@@ -0,0 +1,81 @@
+# This workflow will publish the python binaries to PyPI
+
+name: Publish Release
+
+on:
+  workflow_call:
+
+jobs:
+  release-build:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+        with:
+          python-version: "3.x"
+
+      - name: build release distributions
+        run: |
+          # NOTE: put your own distribution build steps here.
+          pip install --upgrade pip
+          pip install -r requirements.txt
+          pip install build wheel setuptools
+          python setup.py install
+          python -m build
+
+      - name: upload artifacts
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: release-dists
+          path: dist/
+
+  pypi-publish-test:
+    runs-on: ubuntu-latest
+    environment: publish-test
+    needs:
+      - release-build
+    permissions:
+      id-token: write
+
+    steps:
+      - name: Retrieve release distributions
+        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5
+        with:
+          name: release-dists
+          path: dist/
+
+      - name: Publish release distributions to PyPI
+        uses: pypa/gh-action-pypi-publish@release/717ba43cfbb0387f6ce311b169a825772f54d295 # v1
+        with:
+          repository-url: https://test.pypi.org/legacy/
+
+  READ-PLEASE:
+    runs-on: ubuntu-latest
+    needs: pypi-publish-test
+    steps:
+      - name: Review Instructuons (PLEASE READ)
+        run: |
+          echo "Please do the following before approving release for prod."
+          echo "Go to https://test.pypi.org/project/aws-secretsmanager-caching/"
+          echo "Check the page for completeness. There should be a new version published, and two artifacts in the "Download files" section: a wheel (.whl) and a source distribution (.tar.gz)"
+
+  pypi-publish:
+    runs-on: ubuntu-latest
+    environment: publish # Will act as a temporary blocker that the invoker can self-approve so that they would check if the binaries uploaded properly
+    needs:
+      - READ-PLEASE
+    permissions:
+      id-token: write
+
+    steps:
+      - name: Retrieve release distributions
+        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5
+        with:
+          name: release-dists
+          path: dist/
+
+      - name: Publish release distributions to PyPI
+        uses: pypa/gh-action-pypi-publish@release/717ba43cfbb0387f6ce311b169a825772f54d295 # v1
+

.github/workflows/python-package.yml

@@ -8,6 +8,7 @@ on:
     branches: [master]
   pull_request:
     branches: [master]
+  workflow_call:
 
 permissions:
   contents: read
@@ -22,9 +23,9 @@ jobs:
         python-version: ["3.9", "3.10", "3.11", "3.12", "3.13"]
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: ${{ matrix.python-version }}
       - name: Install dependencies
@@ -41,14 +42,14 @@ jobs:
       - name: Lint with PyLint
         run: pylint --rcfile=.pylintrc src/aws_secretsmanager_caching
       - name: Check formatting with Ruff
-        uses: astral-sh/ruff-action@v3
+        uses: astral-sh/ruff-action@4919ec5cf1f49eff0871dbcea0da843445b837e6 # v3
         with:
           version: "0.15.22"
       - name: Test with pytest
         run: |
           pytest test/unit/
       - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@v5
+        uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5
         with:
           fail_ci_if_error: true
           use_oidc: true