ci: Release please

.github/CONTRIBUTING.md

@@ -18,3 +18,34 @@ for contributing to the repository :**
 ## Testing
 
 * Please make sure that github actions are passing
+
+## Commit messages / PR titles
+
+Releases are managed by [release-please](https://github.com/googleapis/release-please),
+which computes version bumps and changelog entries from
+[Conventional Commits](https://www.conventionalcommits.org/). PRs are squash-merged with
+the commit message set to the PR title + the branch's individual commit messages, so
+**the PR title itself must follow the Conventional Commits format** — that's the line
+release-please actually parses:
+
+```
+<type>: <description>
+
+feat: add --foo option to bamCoverage
+fix: computeMatrix no longer crashes on empty bed files
+docs: clarify --normalizeUsing options
+test: add coverage for gzipped blacklist files
+chore: bump ruff to 0.14
+```
+
+Common types: `feat` (new feature, bumps minor), `fix` (bug fix, bumps patch), `docs`,
+`test`, `refactor`, `perf`, `chore`, `ci`. For a breaking change, add `!` after the type
+in the PR title (e.g. `feat!: remove --exactScaling`) — this is what triggers a major
+version bump, so use it deliberately. Prefer the `!` marker over a `BREAKING CHANGE:`
+footer buried in one of the branch's individual commits, since the title is what's
+guaranteed to be checked.
+
+`CHANGELOG.md` from the `## 4.0.0` entry onward is generated by release-please's
+release PRs — don't hand-edit those sections; anything above `## 4.0.0` gets
+inserted automatically. Entries `## 4.0.0` and below are the pre-release-please
+historical record and stay frozen.

.github/PULL_REQUEST_TEMPLATE.md

@@ -6,3 +6,7 @@ your pull request :**
  - [ ] Does the PR contain bugfix?
  - [ ] Does the PR contain documentation changes?
  - [ ] Does the PR contain changes to the galaxy wrapper?
+ - [ ] **Does the PR title follow [Conventional Commits](https://www.conventionalcommits.org/)
+       (e.g. `feat: ...`, `fix: ...`)?** This PR is squash-merged using the title as the
+       commit summary, which release-please parses to determine the next version and
+       changelog entry — see CONTRIBUTING.md.

.github/workflows/release-please.yml

@@ -0,0 +1,24 @@
+name: release-please
+on:
+    push:
+        branches:
+            - master
+
+permissions:
+    contents: write
+    pull-requests: write
+
+jobs:
+    release-please:
+        runs-on: ubuntu-latest
+        steps:
+            - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+              id: app-token
+              with:
+                  app-id: ${{ vars.RELEASE_PLEASE_APP_ID }}
+                  private-key: ${{ secrets.RELEASE_PLEASE_APP_PRIVATE_KEY }}
+            - uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0
+              with:
+                  token: ${{ steps.app-token.outputs.token }}
+                  config-file: release-please-config.json
+                  manifest-file: .release-please-manifest.json

.github/workflows/wheels-preview.yml

@@ -0,0 +1,214 @@
+name: build_wheels_preview
+
+on:
+    pull_request:
+        types: [opened, synchronize, reopened]
+        branches:
+            - master
+
+permissions:
+    contents: read
+
+jobs:
+    linux:
+        if: github.event.pull_request.head.repo.full_name == github.repository
+        runs-on: ${{ matrix.platform.runner }}
+        strategy:
+            matrix:
+                platform:
+                    - runner: ubuntu-22.04
+                      target: x86_64
+                    - runner: ubuntu-22.04
+                      target: aarch64
+        steps:
+            - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+              with:
+                persist-credentials: false
+            - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+              with:
+                  python-version: 3.x
+            - name: Set preview version
+              env:
+                  RUN_ID: ${{ github.run_id }}
+              run: |
+                  python3 <<'PYEOF'
+                  import os, re
+                  path = "pyproject.toml"
+                  text = open(path).read()
+                  m = re.search(r'^version = "(.*)"', text, flags=re.M)
+                  preview = f'{m.group(1)}.dev{os.environ["RUN_ID"]}'
+                  text = text[: m.start()] + f'version = "{preview}"' + text[m.end() :]
+                  open(path, "w").write(text)
+                  print("preview version:", preview)
+                  PYEOF
+            - name: Build wheels
+              uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
+              with:
+                  target: ${{ matrix.platform.target }}
+                  args: --release --out dist --find-interpreter
+                  manylinux: 2_28
+                  before-script-linux: |
+                      set -ex
+                      cat /etc/*release*
+                      if [ "${{ matrix.platform.target }}" = "x86_64" ]; then
+                        # maturin-action's manylinux switches to AlmaLinux 8
+                        dnf install -y epel-release && dnf update -y
+                        dnf install -y gcc gcc-c++ make perl curl clang xz-devel pkgconfig
+                        ## we've vendored openssl via Cargo.toml anyway, so this part is no longer used...
+                      elif [ "${{ matrix.platform.target }}" = "aarch64" ]; then
+                        # cross-compiling on Ubuntu 22.04
+                        ## We're vendoring openssl because libssl-dev:aarch64 is not available!
+                        apt-get update
+                        apt-get install -y build-essential perl curl clang liblzma-dev pkg-config \
+                          gcc-aarch64-linux-gnu g++-aarch64-linux-gnu libc6-dev-arm64-cross crossbuild-essential-arm64
+                      fi
+            - name: Upload wheels
+              uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+              with:
+                  name: wheels-linux-${{ matrix.platform.target }}
+                  path: dist
+
+    musllinux:
+        if: github.event.pull_request.head.repo.full_name == github.repository
+        runs-on: ${{ matrix.platform.runner }}
+        strategy:
+            matrix:
+                platform:
+                    - runner: ubuntu-22.04
+                      target: x86_64
+                    - runner: ubuntu-22.04
+                      target: aarch64
+        steps:
+            - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+              with:
+                persist-credentials: false
+            - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+              with:
+                  python-version: 3.x
+            - name: Set preview version
+              env:
+                  RUN_ID: ${{ github.run_id }}
+              run: |
+                  python3 <<'PYEOF'
+                  import os, re
+                  path = "pyproject.toml"
+                  text = open(path).read()
+                  m = re.search(r'^version = "(.*)"', text, flags=re.M)
+                  preview = f'{m.group(1)}.dev{os.environ["RUN_ID"]}'
+                  text = text[: m.start()] + f'version = "{preview}"' + text[m.end() :]
+                  open(path, "w").write(text)
+                  print("preview version:", preview)
+                  PYEOF
+            - name: Build wheels
+              uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
+              with:
+                  target: ${{ matrix.platform.target }}
+                  args: --release --out dist --find-interpreter
+                  manylinux: musllinux_1_2
+                  before-script-linux: |
+                      apt-get update
+                      apt-get install -y musl-tools musl-dev
+                      if [ "${{ matrix.platform.target }}" = "aarch64" ]; then
+                        apt-get install -y gcc-aarch64-linux-gnu g++-aarch64-linux-gnu
+                      fi
+            - name: Upload wheels
+              uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+              with:
+                  name: wheels-musllinux-${{ matrix.platform.target }}
+                  path: dist
+
+    macos:
+        if: github.event.pull_request.head.repo.full_name == github.repository
+        runs-on: ${{ matrix.platform.runner }}
+        strategy:
+            matrix:
+                platform:
+                    - runner: macos-latest
+                      target: x86_64
+                    - runner: macos-latest
+                      target: aarch64
+        steps:
+            - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+              with:
+                persist-credentials: false
+            - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+              with:
+                  python-version: 3.x
+            - name: Set preview version
+              env:
+                  RUN_ID: ${{ github.run_id }}
+              run: |
+                  python3 <<'PYEOF'
+                  import os, re
+                  path = "pyproject.toml"
+                  text = open(path).read()
+                  m = re.search(r'^version = "(.*)"', text, flags=re.M)
+                  preview = f'{m.group(1)}.dev{os.environ["RUN_ID"]}'
+                  text = text[: m.start()] + f'version = "{preview}"' + text[m.end() :]
+                  open(path, "w").write(text)
+                  print("preview version:", preview)
+                  PYEOF
+            - name: Build wheels
+              uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
+              with:
+                  target: ${{ matrix.platform.target }}
+                  args: --release --out dist --find-interpreter
+            - name: Upload wheels
+              uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+              with:
+                  name: wheels-macos-${{ matrix.platform.target }}
+                  path: dist
+
+    sdist:
+        if: github.event.pull_request.head.repo.full_name == github.repository
+        runs-on: ubuntu-latest
+        steps:
+            - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+              with:
+                persist-credentials: false
+            - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+              with:
+                  python-version: 3.x
+            - name: Set preview version
+              env:
+                  RUN_ID: ${{ github.run_id }}
+              run: |
+                  python3 <<'PYEOF'
+                  import os, re
+                  path = "pyproject.toml"
+                  text = open(path).read()
+                  m = re.search(r'^version = "(.*)"', text, flags=re.M)
+                  preview = f'{m.group(1)}.dev{os.environ["RUN_ID"]}'
+                  text = text[: m.start()] + f'version = "{preview}"' + text[m.end() :]
+                  open(path, "w").write(text)
+                  print("preview version:", preview)
+                  PYEOF
+            - name: Build sdist
+              uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
+              with:
+                  command: sdist
+                  args: --out dist
+            - name: Upload sdist
+              uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+              with:
+                  name: wheels-sdist
+                  path: dist
+
+    publish-testpypi:
+        name: Publish preview to TestPyPI
+        runs-on: ubuntu-latest
+        if: github.event.pull_request.head.repo.full_name == github.repository
+        needs: [linux, musllinux, macos, sdist]
+        steps:
+            - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+              with:
+                  pattern: wheels-*
+                  path: dist
+                  merge-multiple: true
+            - name: Publish to TestPyPI
+              uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
+              with:
+                  repository-url: https://test.pypi.org/legacy/
+                  password: ${{ secrets.TESTPYPI_API_TOKEN }}
+                  packages-dir: dist
+                  skip-existing: true

.github/workflows/wheels.yml

@@ -156,15 +156,18 @@ jobs:
             attestations: write
         steps:
             - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+              with:
+                  pattern: wheels-*
+                  path: dist
+                  merge-multiple: true
             - name: Generate artifact attestation
               uses: actions/attest-build-provenance@ef244123eb79f2f7a7e75d99086184180e6d0018 # v1.4.4
               with:
-                  subject-path: "wheels-*/*"
+                  subject-path: "dist/*"
             - name: Publish to PyPI
               if: ${{ startsWith(github.ref, 'refs/tags/') }}
-              uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
-              env:
-                  MATURIN_PYPI_TOKEN: ${{ secrets.PYPI_API_TOKEN }}
+              uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
               with:
-                  command: upload
-                  args: --non-interactive --skip-existing wheels-*/*
+                  password: ${{ secrets.PYPI_API_TOKEN }}
+                  packages-dir: dist
+                  skip-existing: true

.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "4.0.0"
+}