feat: fix CI workflow issues and improve release automation

- Add workflow_call trigger to test.yml to make it reusable by other workflows
- Fix codecov action parameter from 'file' to 'files' for v4 compatibility
- Update deprecated actions/create-release@v1 to softprops/action-gh-release@v2
- Add automated version bumping with commitizen
- Implement PyPI trusted publishing for secure, token-free uploads
- Add changelog generation with smart commit filtering
- Update to Python 3.13 and enhance dependency caching
- Use PERSONAL_ACCESS_TOKEN for enhanced permissions

Signed-off-by: longhao <hal.long@outlook.com>

.github/workflows/bumpversion.yml

@@ -0,0 +1,23 @@
+name: Bump version
+
+on:
+  push:
+    branches:
+      - main
+
+jobs:
+  bump-version:
+    if: "!startsWith(github.event.head_commit.message, 'bump:')"
+    runs-on: ubuntu-latest
+    name: "Bump version and create changelog with commitizen"
+    steps:
+      - name: Check out
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        with:
+          fetch-depth: 0
+          token: '${{ secrets.PERSONAL_ACCESS_TOKEN }}'
+      - name: Create bump and changelog
+        uses: commitizen-tools/commitizen-action@master
+        with:
+          github_token: ${{ secrets.PERSONAL_ACCESS_TOKEN }}
+          branch: main

.github/workflows/release.yml

@@ -1,102 +1,86 @@
-name: Release
+name: Upload Python Package
 
 on:
   push:
     tags:
-      - 'v*'
+      - "v*"
-
-permissions:
-  contents: read
 
 jobs:
-  test:
+  deploy:
-    uses: ./.github/workflows/test.yml
-
-  build:
-    needs: test
     runs-on: ubuntu-latest
-    steps:
+    permissions:
-    - name: Checkout code
+      # IMPORTANT: this permission is mandatory for trusted publishing
-      uses: actions/checkout@v4
+      id-token: write
-      with:
+      contents: write
-        fetch-depth: 0
 
+    steps:
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+      with:
+        token: "${{ secrets.GITHUB_TOKEN }}"
+        fetch-depth: 0
+        ref: main
+    - uses: olegtarasov/get-tag@v2.1.4
+      id: get_tag_name
+      with:
+        tagRegex: "v(?<version>.*)"
     - name: Set up Python
       uses: actions/setup-python@v5
       with:
-        python-version: "3.11"
+        python-version: '3.13'
         
-    - name: Install uv
+    # 缓存 Poetry 依赖
+    - name: Cache Poetry dependencies
+      uses: actions/cache@v4
+      with:
+        path: ~/.cache/pypoetry
+        key: ${{ runner.os }}-poetry-${{ hashFiles('**/poetry.lock') }}
+        restore-keys: |
+          ${{ runner.os }}-poetry-
+          
+    - name: Install Poetry
       run: |
         python -m pip install --upgrade pip
         pip install uv
+        uv --version
         
     - name: Install dependencies
       run: |
         uvx poetry install
-    
-    - name: Build package
-      run: |
         uvx poetry build
         
-    - name: Check package
+    # Note that we don't need credentials.
-      run: |
+    # We rely on https://docs.pypi.org/trusted-publishers/.
-        uvx poetry run twine check dist/*
+    - name: Upload to PyPI
-    
-    - name: Upload build artifacts
-      uses: actions/upload-artifact@v4
-      with:
-        name: dist
-        path: dist/
-
-  publish:
-    needs: build
-    runs-on: ubuntu-latest
-    environment: release
-    permissions:
-      id-token: write  # IMPORTANT: this permission is mandatory for trusted publishing
-    steps:
-    - name: Download build artifacts
-      uses: actions/download-artifact@v4
-      with:
-        name: dist
-        path: dist/
-    
-    - name: Publish to PyPI
       uses: pypa/gh-action-pypi-publish@release/v1
       with:
-        skip-existing: true
+        packages-dir: dist
-
+        verbose: true
-  github-release:
+        print-hash: true
-    needs: publish
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-    steps:
-    - name: Checkout code
-      uses: actions/checkout@v4
-      with:
-        fetch-depth: 0
         
     - name: Generate changelog
       id: changelog
-      run: |
+      uses: jaywcjlove/changelog-generator@main
-        # Extract version from tag
-        VERSION=${GITHUB_REF#refs/tags/v}
-        echo "version=$VERSION" >> $GITHUB_OUTPUT
-        
-        # Generate changelog (basic implementation)
-        echo "## Changes in v$VERSION" > CHANGELOG.md
-        echo "" >> CHANGELOG.md
-        git log --pretty=format:"- %s" $(git describe --tags --abbrev=0 HEAD^)..HEAD >> CHANGELOG.md || echo "- Initial release" >> CHANGELOG.md
-    
-    - name: Create GitHub Release
-      uses: actions/create-release@v1
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       with:
-        tag_name: ${{ github.ref }}
+        token: ${{ secrets.PERSONAL_ACCESS_TOKEN }}
-        release_name: Release v${{ steps.changelog.outputs.version }}
+        filter-author: (|dependabot|renovate\[bot\]|dependabot\[bot\]|Renovate Bot)
-        body_path: CHANGELOG.md
+        filter: '[R|r]elease[d]\s+[v|V]\d(\.\d+){0,2}'
-        draft: false
+        template: |
-        prerelease: false
+          ## Bugs
+          {{fix}}
+          ## Feature
+          {{feat}}
+          ## Improve
+          {{refactor,perf,clean}}
+          ## Misc
+          {{chore,style,ci||🔶 Nothing change}}
+          ## Unknown
+          {{__unknown__}}
+          
+    - uses: ncipollo/release-action@v1
+      with:
+        artifacts: "dist/*"
+        token: ${{ secrets.PERSONAL_ACCESS_TOKEN }}
+        body: |
+          Comparing Changes: ${{ steps.changelog.outputs.compareurl }}
+
+          ${{ steps.changelog.outputs.changelog }}

.github/workflows/test.yml

@@ -5,6 +5,7 @@ on:
     branches: [ main, develop ]
   pull_request:
     branches: [ main, develop ]
+  workflow_call:
 
 jobs:
   test:
@@ -68,9 +69,9 @@ jobs:
 
     - name: Upload coverage to Codecov
       if: matrix.os == 'ubuntu-latest' && matrix.python-version == '3.11'
-      uses: codecov/codecov-action@v5
+      uses: codecov/codecov-action@v4
       with:
-        file: ./coverage.xml
+        files: ./coverage.xml
         flags: unittests
         name: codecov-umbrella
         fail_ci_if_error: false