Skip to content

ci: adopt release-please for automated releases - #448

Merged
pdecat merged 1 commit into
masterfrom
ci/adopt-release-please
Jul 17, 2026
Merged

ci: adopt release-please for automated releases#448
pdecat merged 1 commit into
masterfrom
ci/adopt-release-please

Conversation

@pdecat

@pdecat pdecat commented Jul 17, 2026

Copy link
Copy Markdown
Collaborator

Replaces the manual scripts/release.sh + github-changelog-generator flow with release-please.

How it works now

  • On every push to master, release-please maintains a release PR that bumps pyproject.toml and prepends CHANGELOG.md from the Conventional Commits since the last tag.
  • Merging that PR creates the vX.Y.Z tag + GitHub release, and the publish job builds and uploads the distributions to PyPI.
  • Publishing uses PyPI OIDC trusted publishing (no token secret), scoped to release.yml and the release environment.
  • build.yml is now tests-only; the publish job and the tag trigger moved to release.yml.
  • pyproject.toml drops the aN dev-version dance since release-please owns version bumps.

Before the first release (one-time PyPI setup)

Add a Trusted Publisher on the PyPI aws-adfs project (Manage -> Publishing) with:

Field Value
Owner venth
Repository aws-adfs
Workflow release.yml
Environment release

Once that's in place the OIDC publish works with no secrets. The old pypi_password / test_pypi_password repo secrets can be dropped afterwards.

This release (2.13.0)

The Duo Universal Prompt PR (#447) was squash-merged with a non-Conventional subject, so release-please can't infer it. This commit carries a Release-As: 2.13.0 footer so the first release PR targets 2.13.0. Worth a quick curate of that PR's changelog to headline the Duo feature (link #447) before merging; everything after this is automatic from Conventional Commit subjects.

Replace the manual scripts/release.sh + github-changelog-generator flow
with release-please:

- release-please-config.json / .release-please-manifest.json drive a
  Python release that bumps pyproject.toml and prepends CHANGELOG.md from
  the Conventional Commits since the last tag.
- release.yml maintains a release pull request on every push to master;
  merging it creates the vX.Y.Z tag and GitHub release, then builds and
  publishes to PyPI via OIDC trusted publishing (no token secret).
- build.yml is trimmed to tests only; the publish job and the tag trigger
  move to release.yml.
- pyproject.toml drops the aN development version, since release-please
  now owns version bumps.

Release-As: 2.13.0
@pdecat
pdecat merged commit 384c7de into master Jul 17, 2026
15 checks passed
@pdecat
pdecat deleted the ci/adopt-release-please branch July 17, 2026 21:42
pdecat added a commit that referenced this pull request Jul 18, 2026
The manual scripts/release.sh + github-changelog-generator flow was
replaced by release-please (#448); point the Development "release" step
and the Changelog note at it.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant