ci: release automatically from conventional commits

.github/workflows/check-deployed-package.yml

@@ -1,28 +1,34 @@
 name: Check deployed package
 
+# CI runs it after each release, against the version just published; by hand it checks the latest version on PyPI.
 on:
+  workflow_call:
+    inputs:
+      version:
+        type: string
+        required: true
+    secrets:
+      LOGDASH_API_KEY:
+        required: true
+      LOGDASH_PERSONAL_API_KEY:
+        required: true
   workflow_dispatch:
-  workflow_run:
-    workflows: ['Publish Package to PyPI']
-    types:
-      - completed
-    branches:
-      - main
+
+permissions:
+  contents: read
 
 jobs:
   run-demo:
     name: Run LogDash Demo
     runs-on: ubuntu-latest
-    if: ${{ github.event.workflow_run.conclusion == 'success' }}
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3
-
-      - name: Make run script executable
-        run: chmod +x check-deployed-package/run.sh
+        uses: actions/checkout@v7
 
       - name: Run LogDash demo
         env:
           LOGDASH_API_KEY: ${{ secrets.LOGDASH_API_KEY }}
+          LOGDASH_PERSONAL_API_KEY: ${{ secrets.LOGDASH_PERSONAL_API_KEY }}
+          LOGDASH_VERSION: ${{ inputs.version }}
         run: ./check-deployed-package/run.sh

.github/workflows/ci.yml

@@ -0,0 +1,89 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  # A release in progress must finish; a newer merge waits and releases after it.
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+# The repository's default token can write; only the release job needs to.
+permissions:
+  contents: read
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
+        with:
+          python-version: 3.x
+      - uses: actions/setup-node@v7
+        with:
+          node-version: 24
+      - run: pip install build -e .
+      - run: python -m unittest discover -s tests
+      - run: python -m build
+      - run: node --test 'scripts/*.test.ts'
+
+  # The version the merged commits call for; empty when none of them is a feat, fix, perf, or breaking change.
+  version:
+    if: github.event_name == 'push'
+    runs-on: ubuntu-latest
+    outputs:
+      next: ${{ steps.next.outputs.version }}
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0 # the tags and commits since the last release
+      - uses: actions/setup-node@v7
+        with:
+          node-version: 24
+      # Two lines, so a failing script fails the job instead of releasing nothing.
+      - id: next
+        run: |
+          version=$(node scripts/version.ts)
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+
+  # Publishes the merge to PyPI as that version.
+  release:
+    needs: [test, version]
+    if: needs.version.outputs.next != ''
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    env:
+      V: ${{ needs.version.outputs.next }}
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
+        with:
+          python-version: 3.x
+      # setup.py reads the version from here.
+      - run: sed -i "s/^__version__ = .*/__version__ = \"$V\"/" logdash/__init__.py
+      - run: pip install build twine && python -m build
+      # Fails before the upload when the version did not reach the packages.
+      - run: ls "dist/logdash-$V.tar.gz" "dist/logdash-$V-py3-none-any.whl"
+      # --skip-existing, so a rerun after a failed release step just tags.
+      - run: twine upload --skip-existing dist/*
+        env:
+          TWINE_USERNAME: __token__
+          TWINE_PASSWORD: ${{ secrets.PYPI_API_TOKEN }}
+      # Last, since it creates the v$V tag the next release counts from.
+      - run: gh release create "v$V" --generate-notes --target "$GITHUB_SHA"
+        env:
+          GH_TOKEN: ${{ github.token }}
+
+  # Installs the version just published and reads back what it sends.
+  smoke:
+    needs: [version, release]
+    uses: ./.github/workflows/check-deployed-package.yml
+    with:
+      version: ${{ needs.version.outputs.next }}
+    secrets:
+      LOGDASH_API_KEY: ${{ secrets.LOGDASH_API_KEY }}
+      LOGDASH_PERSONAL_API_KEY: ${{ secrets.LOGDASH_PERSONAL_API_KEY }}

.github/workflows/pr-title.yml

@@ -0,0 +1,20 @@
+name: PR title
+
+# Squash merges use the PR title as the commit subject, and scripts/version.ts reads it to pick the next version.
+on:
+  pull_request:
+    types: [opened, edited, reopened, synchronize]
+
+permissions: {}
+
+jobs:
+  conventional:
+    runs-on: ubuntu-latest
+    steps:
+      - env:
+          TITLE: ${{ github.event.pull_request.title }}
+        run: |
+          printf '%s' "$TITLE" | grep -qE '^(feat|fix|perf|refactor|docs|test|build|ci|chore|style|revert)(\(.+\))?!?: .+' || {
+            echo "::error::PR title \"$TITLE\" is not a Conventional Commit, e.g. \"feat(metrics): histograms\" or \"fix(logger): colors on Windows\". feat releases a minor, fix/perf a patch, ! a major; other types do not release."
+            exit 1
+          }

check-deployed-package/Dockerfile

@@ -2,7 +2,9 @@ FROM python:3.9-alpine
 
 WORKDIR /app
 
-RUN pip install logdash
+# The version to check, the latest when empty; PyPI can take a few minutes to serve one just published
+ARG LOGDASH_VERSION
+RUN for _ in $(seq 30); do pip install --no-cache-dir "logdash${LOGDASH_VERSION:+==$LOGDASH_VERSION}" && exit 0; sleep 10; done; exit 1
 
 COPY check-deployed-package/check.py /app/
 

check-deployed-package/README.md

@@ -3,5 +3,10 @@
 Use command below to test if the published SDK works:
 
 ```
-LOGDASH_API_KEY=<your-api-key> ./check-deployed-package/run.sh
+LOGDASH_API_KEY=<your-api-key> LOGDASH_PERSONAL_API_KEY=<your-personal-api-key> ./check-deployed-package/run.sh
 ```
+
+`LOGDASH_API_KEY` sends the logs and metrics: the ingest key of the shared "SDK smoke tests" domain, from its Settings page.
+They arrive as the `python-sdk` app on that domain.
+`LOGDASH_PERSONAL_API_KEY` reads them back: a personal API key (`ldp_`) with logs:read and metrics:read, restricted to that domain.
+It checks the latest version on PyPI; set `LOGDASH_VERSION` to check another one.

check-deployed-package/check.py

@@ -3,28 +3,26 @@
 
 import os
 import time
-import pkg_resources
+from importlib.metadata import version
 
 from logdash import create_logdash
 
 print('=== LogDash SDK Demo ===')
 
-try:
-    logdash_version = pkg_resources.get_distribution("logdash").version
-except Exception:
-    logdash_version = "unknown"
-print(f"Using logdash package version: {logdash_version}")
+print(f"Using logdash package version: {version('logdash')}")
 print()
 
 api_key = os.environ.get('LOGDASH_API_KEY')
 logs_seed = os.environ.get('LOGS_SEED', 'default')
 metrics_seed = os.environ.get('METRICS_SEED', '1')
-print(f"Using API Key: {api_key}")
+app = os.environ.get('LOGDASH_APP', 'python-sdk')
+print(f"Using App: {app}")
 print(f"Using Logs Seed: {logs_seed}")
 print(f"Using Metrics Seed: {metrics_seed}")
 
 logdash = create_logdash({
-    "api_key": api_key, 
+    "api_key": api_key,
+    "app": app,
 })
 
 # Get the logger instance