Maintenance on release workflow (#59)

- rename default branch to main
- separated release pipeline (security)
- improve release drafter config

Author: ssbarnea

.github/CODEOWNERS

@@ -0,0 +1 @@
+*       @ssbarnea

.github/release-drafter.yml

@@ -1,4 +1,6 @@
 # Format and labels used aim to match those used by Ansible project
+name-template: '$RESOLVED_VERSION'
+tag-template: '$RESOLVED_VERSION'
 categories:
   - title: 'Major Changes'
     labels:
@@ -7,6 +9,7 @@ categories:
     labels:
       - 'feature'  # 006b75
       - 'enhancement'  # ededed
+      - 'refactoring'
   - title: 'Bugfixes'
     labels:
       - 'bug'  # fbca04
@@ -15,7 +18,34 @@ categories:
       - 'deprecated'  # fef2c0
 exclude-labels:
   - 'skip-changelog'
+version-resolver:
+  major:
+    labels:
+      - 'major'
+  minor:
+    labels:
+      - 'minor'
+      - 'feature'
+      - 'enhancement'
+      - 'refactoring'
+  patch:
+    labels:
+      - 'patch'
+      - 'bug'
+      - 'deprecated'
+  default: patch
+autolabeler:
+  - label: 'skip-changelog'
+    title: '/chore/i'
+  - label: 'bug'
+    title: '/fix/i'
+  - label: 'enhancement'
+    title: '/(enhance|improve)/i'
+  - label: 'feature'
+    title: '/feature/i'
+  - label: 'dreprecated'
+    title: '/deprecat/i'
 template: |
-  ## Changes
-
   $CHANGES
+
+  Kudos goes to: $CONTRIBUTORS

.github/workflows/labels.yml

@@ -0,0 +1,21 @@
+# See https://github.com/jesusvasquez333/verify-pr-label-action
+name: labels
+on:
+  pull_request_target:
+    types: [opened, labeled, unlabeled, synchronize]
+
+jobs:
+  check_pr_labels:
+    runs-on: ubuntu-latest
+    name: verify
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v2
+      - name: Verify PR label action
+        uses: jesusvasquez333/[email protected]
+        with:
+          github-token: '${{ secrets.GITHUB_TOKEN }}'
+          valid-labels: 'bug, enhancement, feature, refactoring, major, deprecated, skip-changelog'
+          invalid-labels: 'help wanted, invalid, feedback-needed, incomplete'
+          pull-request-number: '${{ github.event.pull_request.number }}'
+          disable-reviews: true

.github/workflows/release-drafter.yml

@@ -1,16 +1,18 @@
-name: Release Drafter
+name: release-drafter
 
 on:
   push:
     # branches to consider in the event; optional, defaults to all
     branches:
-      - master
+      - main
+      - 'releases/**'
+      - 'stable/**'
 
 jobs:
   update_release_draft:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-20.04
     steps:
-      # Drafts your next Release notes as Pull Requests are merged into "master"
+      # Drafts your next Release notes as Pull Requests are merged into "main"
       - uses: release-drafter/release-drafter@v5
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/release.yml

@@ -0,0 +1,48 @@
+name: release
+
+on:
+  release:
+    types: [published]
+
+jobs:
+  pypi:
+    name: Publish to PyPI registry
+    environment: release
+    runs-on: ubuntu-20.04
+
+    env:
+      FORCE_COLOR: 1
+      PY_COLORS: 1
+      TOXENV: packaging
+      TOX_PARALLEL_NO_SPINNER: 1
+
+    steps:
+    - name: Switch to using Python 3.8 by default
+      uses: actions/setup-python@v2
+      with:
+        python-version: 3.8
+    - name: Install tox
+      run: >-
+        python3 -m
+        pip install
+        --user
+        tox
+    - name: Check out src from Git
+      uses: actions/checkout@v2
+      with:
+        fetch-depth: 0  # needed by setuptools-scm
+    - name: Build dists
+      run: python -m tox
+    - name: Publish to test.pypi.org
+      if: >-  # "create" workflows run separately from "push" & "pull_request"
+        github.event_name == 'release'
+      uses: pypa/gh-action-pypi-publish@master
+      with:
+        password: ${{ secrets.testpypi_password }}
+        repository_url: https://test.pypi.org/legacy/
+    - name: Publish to pypi.org
+      if: >-  # "create" workflows run separately from "push" & "pull_request"
+        github.event_name == 'release'
+      uses: pypa/gh-action-pypi-publish@master
+      with:
+        password: ${{ secrets.pypi_password }}

.github/workflows/tox.yml

@@ -3,15 +3,11 @@ name: tox
 on:
   push:
     branches:
-      - master
-      - "[0-9]+.[0-9]+.x"
-    tags:
-      - "*"
+      - main
 
   pull_request:
     branches:
-      - master
-      - "[0-9]+.[0-9]+.x"
+      - main
 
 jobs:
   build:
@@ -73,70 +69,3 @@ jobs:
           pip install tox
       - name: Test
         run: "tox -e ${{ matrix.tox_env }}"
-
-  publish:
-    name: Publish to PyPI registry
-    needs:
-    - build
-    runs-on: ubuntu-latest
-
-    env:
-      PY_COLORS: 1
-      TOXENV: packaging
-
-    steps:
-    - name: Switch to using Python 3.6 by default
-      uses: actions/setup-python@v2
-      with:
-        python-version: 3.6
-    - name: Install tox
-      run: python -m pip install --user tox
-    - name: Check out src from Git
-      uses: actions/checkout@v2
-      with:
-        # Get shallow Git history (default) for tag creation events
-        # but have a complete clone for any other workflows.
-        # Both options fetch tags but since we're going to remove
-        # one from HEAD in non-create-tag workflows, we need full
-        # history for them.
-        fetch-depth: >-
-          ${{
-            (
-              github.event_name == 'create' &&
-              github.event.ref_type == 'tag'
-            ) &&
-            1 || 0
-          }}
-    - name: Drop Git tags from HEAD for non-tag-create events
-      if: >-
-        github.event_name != 'create' ||
-        github.event.ref_type != 'tag'
-      run: >-
-        git tag --points-at HEAD
-        |
-        xargs git tag --delete
-    - name: Build dists
-      run: python -m tox
-    - name: Publish to test.pypi.org
-      if: >-
-        (
-          github.event_name == 'push' &&
-          github.ref == format(
-            'refs/heads/{0}', github.event.repository.default_branch
-          )
-        ) ||
-        (
-          github.event_name == 'create' &&
-          github.event.ref_type == 'tag'
-        )
-      uses: pypa/gh-action-pypi-publish@master
-      with:
-        password: ${{ secrets.testpypi_password }}
-        repository_url: https://test.pypi.org/legacy/
-    - name: Publish to pypi.org
-      if: >-  # "create" workflows run separately from "push" & "pull_request"
-        github.event_name == 'create' &&
-        github.event.ref_type == 'tag'
-      uses: pypa/gh-action-pypi-publish@master
-      with:
-        password: ${{ secrets.pypi_password }}