Add CI and release workflows

.github/workflows/ci.yml

@@ -0,0 +1,125 @@
+---
+name: "CI"
+
+on:
+  push:
+    branches: ["main"]
+  pull_request:
+    branches: ["main"]
+  workflow_call:
+  workflow_dispatch:
+
+concurrency:
+  group: "${{ github.workflow }}-${{ github.ref }}"
+  cancel-in-progress: true
+
+env:
+  FORCE_COLOR: "1"
+  PIP_DISABLE_PIP_VERSION_CHECK: "1"
+  PYTHON_VERSION: "3.12"
+
+jobs:
+  tests:
+    name: "Tests"
+    runs-on: "ubuntu-latest"
+    strategy:
+      matrix:
+        python-version:
+          - "3.10"
+          - "3.11"
+          - "3.12"
+    steps:
+      - name: "Checkout code"
+        uses: "actions/checkout@v4"
+
+      - name: "Setup Python ${{ matrix.python-version }}"
+        uses: "actions/setup-python@v5"
+        with:
+          python-version: "${{ matrix.python-version }}"
+          cache: "pip"
+          cache-dependency-path: "pyproject.toml"
+
+      - name: "Update pip and wheel"
+        run: "python -m pip install --upgrade pip wheel"
+
+      - name: "Install Nox"
+        run: "python -m pip install nox"
+
+      - name: "Run tests (via Nox) on Python ${{ matrix.python-version }}"
+        run: "nox -s tests --python ${{ matrix.python-version }}"
+
+      - name: "Upload coverage data"
+        uses: "actions/upload-artifact@v4"
+        with:
+          name: "coverage-data-${{ matrix.python-version }}"
+          path: ".coverage.*"
+          include-hidden-files: true
+
+  coverage:
+    name: "Coverage report"
+    runs-on: "ubuntu-latest"
+    needs: "tests"
+
+    steps:
+      - name: "Checkout code"
+        uses: "actions/checkout@v4"
+
+      - name: "Setup Python ${{ env.PYTHON_VERSION }}"
+        uses: "actions/setup-python@v5"
+        with:
+          python-version: "${{ env.PYTHON_VERSION }}"
+          cache: "pip"
+          cache-dependency-path: "pyproject.toml"
+
+      - name: "Update pip and wheel"
+        run: "python -m pip install --upgrade pip wheel"
+
+      - name: "Install Nox"
+        run: "python -m pip install nox"
+
+      - uses: "actions/download-artifact@v4"
+        with:
+          pattern: "coverage-data-*"
+          merge-multiple: "true"
+
+      - name: "Combine coverage (via Nox)"
+        run: "nox -s coverage_report"
+
+      - name: "Upload coverage reports to Codecov"
+        uses: "codecov/codecov-action@v4"
+        with:
+          files: "coverage.xml"
+        env:
+          CODECOV_TOKEN: "${{ secrets.CODECOV_TOKEN }}"
+
+  checks:
+    name: "${{ matrix.name }}"
+    runs-on: "ubuntu-latest"
+    strategy:
+      matrix:
+        include:
+          - name: "Code style checks"
+            nox_session: "code_style_checks"
+          - name: "Type checks"
+            nox_session: "type_checks"
+          - name: "Docs"
+            nox_session: "docs"
+    steps:
+      - name: "Checkout code"
+        uses: "actions/checkout@v4"
+
+      - name: "Setup Python ${{ env.PYTHON_VERSION }}"
+        uses: "actions/setup-python@v5"
+        with:
+          python-version: "${{ env.PYTHON_VERSION }}"
+          cache: "pip"
+          cache-dependency-path: "pyproject.toml"
+
+      - name: "Update pip and wheel"
+        run: "python -m pip install --upgrade pip wheel"
+
+      - name: "Install Nox"
+        run: "python -m pip install nox"
+
+      - name: "Run '${{ matrix.nox_session }}' Nox session"
+        run: "nox -s ${{ matrix.nox_session }}"

.github/workflows/release.yml

@@ -0,0 +1,67 @@
+---
+name: "Release package to PyPI"
+
+on:
+  release:
+    types: ["published"]
+  workflow_dispatch:
+
+concurrency:
+  group: "release-pypi"
+  cancel-in-progress: false
+
+permissions:
+  contents: "read"
+  id-token: "write"
+
+jobs:
+  tests:
+    name: "Run tests and checks"
+    uses: "./.github/workflows/ci.yml"
+    secrets: "inherit"
+
+  build-package:
+    name: "Build and verify package"
+    runs-on: "ubuntu-latest"
+    steps:
+      - name: "Checkout code"
+        uses: "actions/checkout@v4"
+        with:
+          fetch-depth: 0
+
+      - name: "Build and verify package"
+        uses: "hynek/build-and-inspect-python-package@v2"
+
+  release-test-pypi:
+    name: "Publish package to test.pypi.org"
+    runs-on: "ubuntu-latest"
+    environment: "release-test-pypi"
+    needs:
+      - "tests"
+      - "build-package"
+    steps:
+      - name: "Download packages built by `build-and-inspect-python-package`"
+        uses: "actions/download-artifact@v4"
+        with:
+          name: "Packages"
+          path: "dist"
+
+      - name: "Upload package to Test PyPI"
+        uses: "pypa/gh-action-pypi-publish@release/v1"
+        with:
+          repository-url: "https://test.pypi.org/legacy/"
+
+  release-pypi:
+    name: "Publish package to pypi.org"
+    runs-on: "ubuntu-latest"
+    environment: "release-pypi"
+    needs: "release-test-pypi"
+    steps:
+      - name: "Download packages built by `build-and-inspect-python-package`"
+        uses: "actions/download-artifact@v4"
+        with:
+          name: "Packages"
+          path: "dist"
+
+      - name: "Upload package to PyPI"
+        uses: "pypa/gh-action-pypi-publish@release/v1"