chore: add python-semantic-release and commitlint workflows

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: salman2013

.github/workflows/python-tests.yml

@@ -1,11 +1,11 @@
 name: Python Tests
 
 on:
-  push:
-    branches: [main]
   pull_request:
     branches:
       - "**"
+  # Called from release.yml before publishing on push to main.
+  workflow_call:
 
 jobs:
   python-tests:

.github/workflows/release.yml

@@ -5,48 +5,31 @@ on:
     branches: [main]
 
 jobs:
-  ci:
-    name: Run CI
-    runs-on: ubuntu-latest
-    strategy:
-      fail-fast: true
-      matrix:
-        toxenv: [quality, docs, django42, django52]
-
-    steps:
-      - name: Check out repository
-        uses: actions/checkout@v6
-
-      - name: Set up Python
-        uses: actions/setup-python@v6
-        with:
-          python-version: "3.12"
-
-      - name: Install uv
-        uses: astral-sh/setup-uv@v6
-
-      - name: Install CI dependencies
-        run: uv sync --group ci
-
-      - name: Run tests (${{ matrix.toxenv }})
-        env:
-          TOXENV: ${{ matrix.toxenv }}
-        run: uv run tox
+  run_tests:
+    uses: ./.github/workflows/python-tests.yml
 
   release:
-    name: Semantic Release
+    needs: run_tests
     runs-on: ubuntu-latest
-    needs: ci
-    concurrency: release
+    if: github.ref_name == 'main'
+    concurrency:
+      group: ${{ github.workflow }}-release-${{ github.ref_name }}
+      cancel-in-progress: false
+
     permissions:
-      id-token: write   # for PyPI trusted publisher (OIDC)
-      contents: write   # to push tags and create GitHub releases
+      contents: write
 
     steps:
-      - name: Check out repository
+      # Checkout at the branch that triggered the workflow, then force-reset to
+      # the exact sha so we don't accidentally release commits that arrived
+      # while this workflow was running.
+      - name: Setup | Checkout Repository on Release Branch
         uses: actions/checkout@v6
         with:
-          fetch-depth: 0
+          ref: ${{ github.ref_name }}
+
+      - name: Setup | Force release branch to workflow sha
+        run: git reset --hard ${{ github.sha }}
 
       - name: Set up Python
         uses: actions/setup-python@v6
@@ -66,12 +49,51 @@ jobs:
           npm ci
           npm run build
 
-      - name: Python Semantic Release
+      - name: Action | Semantic Version Release
         id: release
-        uses: python-semantic-release/python-semantic-release@v9
+        uses: python-semantic-release/python-semantic-release@v10.5.3
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
+          git_committer_name: "github-actions"
+          git_committer_email: "actions@users.noreply.github.com"
+          changelog: "false"
 
-      - name: Publish to PyPI
+      - name: Publish | Upload to GitHub Release Assets
+        uses: python-semantic-release/publish-action@v10.5.3
+        if: steps.release.outputs.released == 'true'
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          tag: ${{ steps.release.outputs.tag }}
+
+      - name: Upload | Distribution Artifacts
+        uses: actions/upload-artifact@v4
         if: steps.release.outputs.released == 'true'
+        with:
+          name: distribution-artifacts
+          path: dist/
+          if-no-files-found: error
+
+    outputs:
+      released: ${{ steps.release.outputs.released || 'false' }}
+      version: ${{ steps.release.outputs.version }}
+
+  publish_to_pypi:
+    # Separate from the release job for least privilege and retry-ability:
+    # publishing can fail independently and shouldn't require reversing the release.
+    runs-on: ubuntu-latest
+    needs: release
+    if: github.ref_name == 'main' && needs.release.outputs.released == 'true'
+
+    permissions:
+      contents: read
+      id-token: write   # for PyPI OIDC trusted publisher
+
+    steps:
+      - name: Download Distribution Artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: distribution-artifacts
+          path: dist/
+
+      - name: Publish to PyPI
         uses: pypa/gh-action-pypi-publish@release/v1

.github/workflows/upgrade-python-requirements.yml

@@ -11,36 +11,17 @@ on:
         default: 'main'
 
 jobs:
-  upgrade:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Check out repository
-        uses: actions/checkout@v6
-        with:
-          ref: ${{ github.event.inputs.branch || 'main' }}
-
-      - name: Set up Python
-        uses: actions/setup-python@v6
-        with:
-          python-version: "3.12"
-
-      - name: Install uv
-        uses: astral-sh/setup-uv@v6
-
-      - name: Install edx-lint
-        run: uv pip install edx-lint --system
-
-      - name: Upgrade lockfile
-        run: make upgrade
-
-      - name: Create pull request
-        uses: peter-evans/create-pull-request@v7
-        with:
-          token: ${{ secrets.REQUIREMENTS_BOT_GITHUB_TOKEN }}
-          commit-message: "chore: upgrade Python requirements"
-          branch: upgrade/python-requirements
-          delete-branch: true
-          title: "chore: upgrade Python requirements"
-          body: |
-            Automated upgrade of `uv.lock` via `make upgrade`.
-          reviewers: axim-aximprovements
+  call-upgrade-python-requirements-workflow:
+    uses: openedx/.github/.github/workflows/upgrade-python-requirements.yml@master
+    with:
+      branch: ${{ github.event.inputs.branch || 'main' }}
+      # optional parameters below; fill in if you'd like github or email notifications
+      # user_reviewers: ""
+      team_reviewers: "axim-aximprovements"
+      email_address: "aximimprovements@axim.org"
+      send_success_notification: false
+    secrets:
+      requirements_bot_github_token: ${{ secrets.REQUIREMENTS_BOT_GITHUB_TOKEN }}
+      requirements_bot_github_email: ${{ secrets.REQUIREMENTS_BOT_GITHUB_EMAIL }}
+      edx_smtp_username: ${{ secrets.EDX_SMTP_USERNAME }}
+      edx_smtp_password: ${{ secrets.EDX_SMTP_PASSWORD }}

README.rst

@@ -31,7 +31,7 @@ The possible XBlock statuses are:
 
 * In Development: We're building and testing this block.
 * Ready to Use: You can try this on your site using the Waffle flag.
-* Done: The built-in block has been removed. The setup.py entrypoint has been removed from edx-platform and added to xblock-contrib.
+* Done: The built-in block has been removed. The ``pyproject.toml`` entry-point has been removed from edx-platform and added to xblock-contrib.
 
 
 Additional XBlocks that belong here
@@ -51,6 +51,29 @@ Over time, more XBlocks may be moved here. An XBlock belongs here if and only if
 Installation and Development Guide
 **********************************
 
+Python Setup
+^^^^^^^^^^^^
+
+This project uses `uv <https://docs.astral.sh/uv/>`_ for dependency management.
+
+1. `Install uv <https://docs.astral.sh/uv/getting-started/installation/>`_.
+2. Install all development dependencies::
+
+    $ make requirements
+
+   This runs ``uv sync --group dev`` and installs the package in editable mode.
+
+3. Run the test suite::
+
+    $ uv run tox
+
+4. To upgrade all dependencies::
+
+    $ make upgrade
+
+Frontend Setup
+^^^^^^^^^^^^^^
+
 Study scripts in the ``package.json`` file to understand the available commands.
 
 1. Install this repository into your runtime (for example ``openedx-platform``) as an editable dependency. For Tutor, you can mount this repository for local development.

pyproject.toml

@@ -184,5 +184,6 @@ constraint-dependencies = [
 ]
 
 [tool.semantic_release]
-tag_format = "v{version}"
+# We use SETUPTOOLS_SCM_PRETEND_VERSION to pull the version from python-semantic-release
+# instead of from version control because the build step happens before the repo gets tagged.
 build_command = "SETUPTOOLS_SCM_PRETEND_VERSION=$NEW_VERSION uv build"