Release job (#97)

## Why is this change necessary?

The template had no `Release` workflow. The existing `Publish` /
`Publish to Staging` workflows re-run lint/test/build themselves,
duplicating everything CI already does for the commit. We want a release
path that instead relies on a passing CI run — modeled on the
`copier-nuxt-python-intranet-app` `release.yaml` — while publishing to
PyPI (using the existing `publish.yaml` as the PyPI reference).

While wiring this up we also found that instantiated repos hit pylint
`R0801 duplicate-code` between `git_tag.py` and
`extract_project_version.py`, because this repo carried a pre-refactor
fork of `git_tag.py` (symlinked from `copier_template_resources/`) that
parsed `pyproject.toml` itself.

## How does this change address the issue?

- **CI builds the distribution.** Added a `build` job to `ci.yaml.jinja`
that runs `uv build --no-sources` and uploads a
`python-package-distributions` artifact (`if-no-files-found: error`),
wired into `workflow-summary` (needs + fail-check).
- **New `release.yaml.jinja`.** Manual `workflow_dispatch` with a
`dry_run` input, generated for both libraries and executables. A `guard`
job requires the ci.yaml run for the current commit to be
`completed`/`success` (including the `workflow-summary` job), extracts
the version via `extract_project_version.py`, and confirms the tag is
absent — real releases must run from `main`. The flow then branches on
`deploy_as_executable`:
- **Library:** download the CI-built dist (never rebuilds), publish to
Test PyPI and verify a fresh install, push the `v<version>` tag, publish
to PyPI and verify again, then create a GitHub Release with generated
notes.
- **Executable:** push the `v<version>` tag, download every
`exe-{os}-{python}` artifact the CI `executable` job built, package each
(tar on Linux / zip on Windows), and attach them all to a GitHub
Release. No PyPI publish.
  All tag/publish/release jobs are skipped on `dry_run`.
- **Aligned `git_tag.py` with base/nuxt.** Replaced the local fork with
the base version (`--version` required, no `pyproject.toml` parsing),
and collapsed the `copier_template_resources/` symlink into a real file
at `template/.github/workflows/git_tag.py` (matching its sibling
`extract_project_version.py`). Updated all call sites in `publish.yaml`
and `release.yaml` to source the version from
`extract_project_version.py` and pass `--version`.
- **Docs.** Documented the `Release` workflow in the generated README,
plus a TODO to eventually merge `Publish` / `Publish to Staging` into
`Release`.

## What side effects does this change have?

- CI now has an extra `build` job on every run (gated `{% if not
is_frozen_executable %}` to match `publish.yaml`).
- `git_tag.py`'s CLI changed: `--version` is now required and it no
longer prints/parses the version. Any external caller relying on the old
no-arg print behavior must switch to `extract_project_version.py`.
- `create-tag` gained a `needs` dependency (`guard` in `release.yaml`,
`get-values` in `publish.yaml`) to obtain the version.
- `template/.github/workflows/git_tag.py` changed from a symlink to a
regular file; `copier_template_resources/git_tag.py` was deleted.

## How is this change tested?

Rendered the template with `copier` (data1 / PyPI) and verified:
- `ci.yaml`, `release.yaml`, `publish.yaml` all parse as YAML; job
graph, `needs`, and `dry_run` guards asserted correct.
- All `git_tag.py` call sites pass `--version`; version sourced from
`extract_project_version.py`.
- pylint on the rendered scripts: `10.00/10` (previously exit 8 /
`R0801`). ruff and pyright pass on the source `git_tag.py`.
- CodeArtifact conditional branches render structurally (kept for parity
so existing CodeArtifact users aren't broken).

Final enforcement happens in the `lint-matrix` CI job, which generates
across data1/2/3 and runs pre-commit on the output.

## Other

- Fixed a pre-existing template bug: `is_frozen_executable` (used to
gate `entrypoint.py`, `main.py`, `publish.yaml`,
`publish_to_staging.yaml`) is undefined and evaluates falsy — so
executable projects shipped with no `entrypoint.py`/`main.py` yet still
got PyPI publish workflows. Renamed all guards (plus the CI `build` job)
to the real `deploy_as_executable` question. `release.yaml` is
intentionally ungated — it serves both cases and branches internally;
`publish.yaml` / `publish_to_staging.yaml` stay library-only. Verified
renders: executables now get `entrypoint.py`/`main.py`, no publish, and
a `release.yaml` that attaches the CI-built executables; libraries get
publish/release + the CI build job and no entrypoint/main.
- Test-data coverage gap (follow-up): after the fix, no
`tests/copier_data` file is PyPI + library (data1/data3 = PyPI +
executable, data2 = CodeArtifact + library), so `lint-matrix` no longer
exercises the PyPI-library publish/release path. Consider a data file
with `python_package_registry: PyPI` and `deploy_as_executable: no`.
- `release.yaml`'s `create-tag` pushes the tag before
`publish-to-primary`; the GitHub Release step then attaches to that
existing tag (softprops/action-gh-release handles a pre-existing tag
gracefully — no conflict).


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added a gated **Release** workflow with dry-run support, version
extraction, and safe Git tag checks.
  * Generated templates now support publishing releases.
* Optional packaging and uploading of platform executables during
release.
* Added staging publishing and install/verification prior to production
release.
* **Improvements**
* CI now conditionally builds/uploads distribution artifacts for release
and updates the Codecov action reference.
* Templates now automate version extraction and tag management for the
release pipeline.
* **Documentation**
* Updated release guidance to reflect the new **Release** workflow and
deployment options.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: ejfine

.config/.copier-answers.yml

@@ -15,7 +15,7 @@ ssh_port_number: 55874
 template_might_want_to_install_aws_ssm_port_forwarding_plugin: true
 template_might_want_to_use_python_asyncio: true
 template_might_want_to_use_vcrpy: true
-template_publishes_releases: false
+template_publishes_releases: true
 template_uses_pulumi: false
 template_uses_python: true
 template_uses_typescript: false

.config/.copier-managed-files.json

@@ -183,6 +183,7 @@
         "template/.github/actions/update-devcontainer-hash/action.yml",
         "template/.github/pull_request_template.md",
         "template/.github/workflows/confirm-on-tagged-copier-template.yaml",
+        "template/.github/workflows/extract_project_version.py",
         "template/.github/workflows/get-values.yaml",
         "template/.github/workflows/git_tag.py",
         "template/.github/workflows/hash_git_files.py",

.devcontainer/devcontainer.json

@@ -60,5 +60,5 @@
   "initializeCommand": "sh .devcontainer/initialize-command.sh",
   "onCreateCommand": "sh .devcontainer/on-create-command.sh",
   "postStartCommand": "sh .devcontainer/post-start-command.sh"
-  // Devcontainer context hash (do not manually edit this, it's managed by a pre-commit hook): bfadcd30 # spellchecker:disable-line
+  // Devcontainer context hash (do not manually edit this, it's managed by a pre-commit hook): 2c1bcc28 # spellchecker:disable-line
 }

copier_template_resources/git_tag.py

@@ -110,6 +110,7 @@ def hook(  # noqa: PLR0915 # yes, this is a lot of statements, but it's all just
         context["gha_amazon_ecr_login"] = "v2.1.5"
         context["gha_setup_node"] = "v6.4.0"
         context["gha_action_gh_release"] = "v3.0.0"
+        context["gha_codecov"] = "v7.0.0"
         context["gha_mutex"] = "1ebad517141198e08d47cf72f3c0975316620a65 # v1.0.0-alpha.10"
         context["gha_pypi_publish"] = "v1.14.0"
         context["gha_sleep"] = "v2.0.3"

extensions/context.py

@@ -97,7 +97,7 @@ jobs:
 {% endraw %}{% if use_codecov %}{% raw %}      - name: Upload coverage to Codecov
         # only upload coverage from fastest job
         if: ${{ matrix.JOB_MATCHING_DEV_ENV && github.actor != 'dependabot[bot]' }} # dependabot by default doesn't have access to the necessary secret...and dependabot should never be changing coverage anyway so it's fine not uploading it
-        uses: codecov/codecov-action@v5.1.1
+        uses: codecov/codecov-action@{% endraw %}{{ gha_codecov }}{% raw %}
         with:
           files: ./coverage.xml
           flags: unittests
@@ -107,6 +107,50 @@ jobs:
           token: ${{ secrets.CODECOV_TOKEN }}
           slug: {% endraw %}{{ full_repo_url | replace("https://github.com/", "") }}{% raw %}{% endraw %}{% endif %}{% raw %}
 
+{% endraw %}{% if not deploy_as_executable %}{% raw %}
+  build:
+    needs:
+      - test
+      - check-skip-duplicate
+    if: needs.check-skip-duplicate.outputs.should-run == 'true'
+    timeout-minutes: {% endraw %}{{ gha_medium_timeout_minutes }}{% raw %}
+    runs-on: {% endraw %}{{ gha_linux_runner }}{% raw %}
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@{% endraw %}{{ gha_checkout }}{% raw %}
+
+      - name: Install python tooling
+        uses: ./.github/actions/install_deps
+        with:
+          skip-installing-ssm-plugin-manager: true
+          skip-installing-pulumi-cli: true
+          python-version: {% endraw %}{{ python_version }}{% if python_package_registry == "AWS CodeArtifact" %}{% raw %}
+          code-artifact-auth-role-name: CoreInfraBaseAccess
+          code-artifact-auth-role-account-id: {% endraw %}{{ aws_central_infrastructure_account_id }}{% raw %}
+          code-artifact-auth-region: {% endraw %}{{ aws_org_home_region }}{% endif %}{% raw %}
+
+{% endraw %}{% if python_package_registry == "AWS CodeArtifact" %}{% raw %}
+      - name: OIDC Auth for Installing any dependencies that uv may need for build (sometimes it likes to install setuptools...even if it's already in the package dependencies)
+        uses: aws-actions/configure-aws-credentials@{% endraw %}{{ gha_configure_aws_credentials }}{% raw %}
+        with:
+          role-to-assume: arn:aws:iam::{% endraw %}{{ aws_central_infrastructure_account_id }}{% raw %}:role/CoreInfraBaseAccess
+          aws-region: {% endraw %}{{ aws_org_home_region }}{% raw %}
+
+{% endraw %}{% endif %}{% raw %}
+      - name: Build package
+        run: |
+{% endraw %}{% if python_package_registry == "AWS CodeArtifact" %}{% raw %}          . .devcontainer/code-artifact-auth.sh{% endraw %}{% endif %}{% raw %}
+          uv build --no-sources
+
+      - name: Upload build package
+        uses: actions/upload-artifact@{% endraw %}{{ gha_upload_artifact }}{% raw %}
+        with:
+          name: python-package-distributions
+          path: dist/
+          if-no-files-found: error
+{% endraw %}{% endif %}{% raw %}
+
 {% endraw %}{% if deploy_as_executable %}{% raw %}  executable:
     needs:
       - test
@@ -193,7 +237,8 @@ jobs:
       - get-values
       - check-skip-duplicate
       - lint
-      - test{% endraw %}{% if create_docs %}
+      - test{% endraw %}{% if not deploy_as_executable %}
+      - build{% endif %}{% if create_docs %}
       - build-docs{% endif %}{% if deploy_as_executable %}
       - executable{% endif %}{% raw %}
       - confirm-on-tagged-copier-template
@@ -207,7 +252,8 @@ jobs:
 
           if [[ ! "${{ needs.get-values.result }}" =~ $success_pattern ]] ||
             [[ ! "${{ needs.check-skip-duplicate.result }}" =~ $success_pattern ]] ||
-            [[ ! "${{ needs.lint.result }}" =~ $success_pattern ]] ||{% endraw %}{% if create_docs %}{% raw %}
+            [[ ! "${{ needs.lint.result }}" =~ $success_pattern ]] ||{% endraw %}{% if not deploy_as_executable %}{% raw %}
+            [[ ! "${{ needs.build.result }}" =~ $success_pattern ]] ||{% endraw %}{% endif %}{% if create_docs %}{% raw %}
             [[ ! "${{ needs.build-docs.result }}" =~ $success_pattern ]] ||{% endraw %}{% endif %}{% raw %}{% endraw %}{% if deploy_as_executable %}{% raw %}
             [[ ! "${{ needs.executable.result }}" =~ $success_pattern ]] ||{% endraw %}{% endif %}{% raw %}
             [[ ! "${{ needs.test.result }}" =~ $success_pattern ]] ||

template/.github/workflows/ci.yaml.jinja

@@ -0,0 +1,53 @@
+# ============== WARNING ==============================================================================
+# File is managed by copier template: gh:LabAutomationAndScreening/copier-base-template.git
+# See .config/.copier-managed-files.json for details.
+#
+# You are welcome to make changes to this file in your repo if they are custom to your project,
+# but if the change should be shared with other projects, please backport it to the template repo.
+# =====================================================================================================
+import argparse
+import json
+import tomllib
+from pathlib import Path
+
+
+def extract_version(file_path: Path | str) -> str:
+    path = Path(file_path)
+
+    if path.name == "package.json":
+        data = json.loads(path.read_text())
+        if version := data.get("version"):
+            return version
+        raise KeyError(f"No version field found in {path!r}")
+
+    if path.name == "pyproject.toml":
+        with path.open("rb") as f:
+            data = tomllib.load(f)
+        project = data.get("project", {})
+        if version := project.get("version"):
+            return version
+        tool = data.get("tool", {})
+        if version := tool.get("poetry", {}).get("version"):
+            return version
+        raise KeyError(f"No version field found in {path!r}")
+
+    raise ValueError(f"Unsupported file type {path.name!r}; expected pyproject.toml or package.json")
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser(
+        description="Extract the version from a pyproject.toml or package.json file and print it."
+    )
+    _ = parser.add_argument(
+        "file",
+        nargs="?",
+        default="pyproject.toml",
+        help="Path to pyproject.toml or package.json (default: pyproject.toml)",
+    )
+    args = parser.parse_args()
+
+    print(extract_version(args.file))  # noqa: T201 # specifically printing this out so CI pipelines can read the value from stdout
+
+
+if __name__ == "__main__":
+    main()

template/.github/workflows/extract_project_version.py

@@ -0,0 +1,67 @@
+# ============== WARNING ==============================================================================
+# File is managed by copier template: gh:LabAutomationAndScreening/copier-base-template.git
+# See .config/.copier-managed-files.json for details.
+#
+# You are welcome to make changes to this file in your repo if they are custom to your project,
+# but if the change should be shared with other projects, please backport it to the template repo.
+# =====================================================================================================
+import argparse
+import subprocess
+
+
+def ensure_tag_not_present(tag: str, remote: str) -> None:
+    no_matching_refs_return_code = 2
+    result = subprocess.run(  # noqa: S603 # this is trusted input, it's our own arguments being passed in
+        ["git", "ls-remote", "--exit-code", "--tags", remote, f"refs/tags/{tag}"],  # noqa: S607 # if `git` isn't in PATH already, then there are bigger problems to solve
+        stdout=subprocess.DEVNULL,
+        check=False,
+    )
+    if result.returncode == 0:
+        raise Exception(f"Error: tag '{tag}' exists on remote '{remote}'")  # noqa: TRY002 # not worth a custom exception
+    if (
+        result.returncode != no_matching_refs_return_code
+    ):  # anything else is a real error (bad remote, auth failure, network)
+        raise Exception(f"git ls-remote exited with code {result.returncode} (remote={remote!r})")  # noqa: TRY002 # not worth a custom exception
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser(
+        description=("Confirm that git tag v<version> is not present on a remote, or create and push the tag.")
+    )
+    _ = parser.add_argument(
+        "--version",
+        required=True,
+        help="Version string (e.g. 1.0.6 or v1.0.6); the tag will always be v<version>",
+    )
+    mode = parser.add_mutually_exclusive_group(required=True)
+    _ = mode.add_argument(
+        "--confirm-tag-not-present",
+        action="store_true",
+        help="Check that git tag v<version> is NOT present on the remote. If the tag exists, exit with an error.",
+    )
+    _ = mode.add_argument(
+        "--push-tag-to-remote",
+        action="store_true",
+        help="Create git tag v<version> locally and push it to the remote. Internally confirms the tag is not already present.",
+    )
+    _ = parser.add_argument(
+        "--remote",
+        default="origin",
+        help="Name of git remote to query/push (default: origin)",
+    )
+    args = parser.parse_args()
+
+    tag = args.version if args.version.startswith("v") else f"v{args.version}"
+
+    if args.push_tag_to_remote:
+        ensure_tag_not_present(tag, args.remote)
+        _ = subprocess.run(["git", "tag", tag], check=True)  # noqa: S603,S607 # this is trusted input, it's our own version string. and if `git` isn't in PATH, then there are larger problems anyway
+        _ = subprocess.run(["git", "push", args.remote, tag], check=True)  # noqa: S603,S607 # this is trusted input, it's our own version string. and if `git` isn't in PATH, then there are larger problems anyway
+        return
+
+    if args.confirm_tag_not_present:
+        ensure_tag_not_present(tag, args.remote)
+
+
+if __name__ == "__main__":
+    main()