feat: align and enhance GitHub Actions workflows

- Replace bump2version with bump-my-version
- Migrate .bumpversion.cfg to pyproject.toml
- Remove CHANGELOG.md (use GitHub release notes instead)
- Remove @semantic-release/changelog plugin
- Change checkout depth from 0 to 1 in all workflows
- Rename publish.yaml to publish.yml for consistency
- Improve workflow structure and error handling
- Ensure publish only runs on successful release

Signed-off-by: Rohit Kumar <Rohit.Kumar64@ibm.com>

Author: Rohit Kumar

.bumpversion.cfg

@@ -36,6 +36,8 @@ jobs:
     steps:
     - name: Checkout repository
       uses: actions/checkout@v6
+      with:
+        fetch-depth: 1
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL

.github/workflows/codeql-analysis.yml

@@ -5,37 +5,39 @@ on:
   push:
     branches:
       - main
+
 jobs:
   release:
     runs-on: ubuntu-latest
-    permissions: 
+    permissions:
       contents: write
     steps:
       - name: Checkout code
         uses: actions/checkout@v6
         with:
-          fetch-depth: 0
+          fetch-depth: 1
           token: ${{ secrets.ADMIN_TOKEN }}
 
-      - name: setup nodejs
+      - name: Setup Node.js
         uses: actions/setup-node@v6
         with:
           node-version: '24'
 
-      - name: release using semantic-release
+      - name: Setup Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: '3.9'
+
+      - name: Install dependencies
+        run: |
+          pip install --user bump-my-version
+          npm install
+
+      - name: Release using semantic-release
         env:
           GITHUB_TOKEN: ${{ secrets.ADMIN_TOKEN }}
           GIT_AUTHOR_NAME: secrets.automation.dev
           GIT_AUTHOR_EMAIL: secrets.automation.dev@il.ibm.com
           GIT_COMMITTER_NAME: secrets.automation.dev
           GIT_COMMITTER_EMAIL: secrets.automation.dev@il.ibm.com
-        run: |
-          sudo apt-get update
-          sudo apt-get install python3
-          pip install --user bumpversion
-          npm install @semantic-release/changelog
-          npm install @semantic-release/exec
-          npm install @semantic-release/git
-          npm install @semantic-release/github
-          npm install @semantic-release/release-notes-generator -D
-          npx semantic-release
+        run: npx semantic-release

.github/workflows/create-release.yml

@@ -1,4 +1,5 @@
-name: publish artifact
+name: Publish artifact
+
 on:
   workflow_dispatch:
   release:
@@ -10,20 +11,26 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v6
+      - name: Checkout code
+        uses: actions/checkout@v6
         with:
+          fetch-depth: 1
           token: ${{ secrets.ADMIN_TOKEN }}
-      - name: Set up Python 3.9
+
+      - name: Set up Python
         uses: actions/setup-python@v6
         with:
-          python-version: 3.14
+          python-version: '3.9'
+
       - name: Install build dependencies
         run: |
           python -m pip install --upgrade pip
           python -m pip install hatchling build --user
-      - name: Build a binary wheel and a source tarball
+
+      - name: Build distribution
         run: |
           python -m build --sdist --wheel --outdir dist/ .
+
       - name: Publish distribution to PyPI
         uses: pypa/gh-action-pypi-publish@release/v1
         with:

.github/workflows/publish.yaml .github/workflows/publish.yml.github/workflows/publish.yaml renamed to .github/workflows/publish.yml

@@ -11,19 +11,27 @@
             {"type": "patch","release": "patch"}
     ]}],
     "@semantic-release/release-notes-generator",
-    "@semantic-release/changelog",
     [
       "@semantic-release/exec",
       {
-        "prepareCmd": "bump2version --allow-dirty --current-version ${lastRelease.version} --new-version ${nextRelease.version} patch"
+        "verifyReleaseCmd": "echo \"Verifying release ${nextRelease.version}\"",
+        "prepareCmd": "bump-my-version bump ${nextRelease.type} --allow-dirty --new-version ${nextRelease.version}"
       }
     ],
     [
       "@semantic-release/git",
       {
-        "message": "chore(release): ${nextRelease.version} [skip ci] release notes\n\n${nextRelease.notes}"
+        "message": "chore(release): ${nextRelease.version} [skip ci]\n\n${nextRelease.notes}",
+        "assets": ["pyproject.toml", "ibm_secrets_manager_sdk/version.py"]
       }
     ],
-    "@semantic-release/github"
+    [
+      "@semantic-release/github",
+      {
+        "successComment": false,
+        "failComment": false,
+        "releasedLabels": false
+      }
+    ]
   ]
 }

.releaserc

@@ -1,6 +1,5 @@
 {
   "devDependencies": {
-    "@semantic-release/changelog": "^6.0.3",
     "@semantic-release/exec": "^7.1.0",
     "@semantic-release/git": "^10.0.1",
     "@semantic-release/github": "^12.0.6",

CHANGELOG.md

@@ -34,7 +34,6 @@ dependencies = [
 Repository = "https://github.com/IBM/secrets-manager-python-sdk"
 Documentation = "https://cloud.ibm.com/apidocs/secrets-manager"
 Issues = "https://github.com/IBM/secrets-manager-python-sdk/issues"
-Changelog = "https://github.com/IBM/secrets-manager-python-sdk/blob/main/CHANGELOG.md"
 
 [project.optional-dependencies]
 dev = [
@@ -57,3 +56,18 @@ packages = ["ibm_secrets_manager_sdk"]
 [tool.black]
 line-length = 120
 skip-string-normalization = true
+
+[tool.bumpversion]
+current_version = "2.1.19"
+commit = true
+message = "Update version {current_version} -> {new_version}"
+
+[[tool.bumpversion.files]]
+filename = "ibm_secrets_manager_sdk/version.py"
+search = "__version__ = '{current_version}'"
+replace = "__version__ = '{new_version}'"
+
+[[tool.bumpversion.files]]
+filename = "pyproject.toml"
+search = "version = \"{current_version}\""
+replace = "version = \"{new_version}\""