ci: automate release process and harden test workflow

.github/release-drafter.yml

@@ -0,0 +1,41 @@
+name-template: 'v$RESOLVED_VERSION'
+tag-template: 'v$RESOLVED_VERSION'
+# Labels below match the existing labels in the pyinfra-dev/pyinfra repo,
+# except 'breaking' which needs creating before it can drive major bumps.
+categories:
+  - title: 'Core'
+    labels:
+      - 'API'
+  - title: 'Operations/Facts'
+    labels:
+      - 'operations'
+      - 'facts'
+  - title: 'Connectors'
+    labels:
+      - 'connectors'
+  - title: 'CLI'
+    labels:
+      - 'CLI'
+  - title: 'Docs/Meta'
+    labels:
+      - 'documentation'
+  - title: 'Dependencies'
+    labels:
+      - 'dependency issue'
+change-template: '- $TITLE (#$NUMBER)'
+change-title-escapes: '\<*_&'
+version-resolver:
+  major:
+    labels:
+      - 'breaking'
+  minor:
+    labels:
+      - 'new feature'
+  patch:
+    labels:
+      - 'bug'
+  default: patch
+template: |
+  ## Changes
+
+  $CHANGES

.github/workflows/release-drafter.yml

@@ -0,0 +1,20 @@
+name: Release Drafter
+
+on:
+  push:
+    branches:
+      - 3.x
+      - 2.x
+      - 1.x
+      - 0.x
+
+permissions:
+  contents: read
+
+jobs:
+  update_release_draft:
+    permissions:
+      contents: write
+    runs-on: ubuntu-latest
+    steps:
+      - uses: release-drafter/release-drafter@693d20e7c1ce1a81d3a41962f85914253b518449  # v7.3.1

.github/workflows/release.yml

@@ -0,0 +1,67 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - "v*"
+
+permissions:
+  contents: write
+  id-token: write
+
+jobs:
+  release:
+    runs-on: ubuntu-24.04
+    environment: release
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        with:
+          fetch-depth: 0
+
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
+        with:
+          python-version: "3.14"
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39  # v8.2.0
+
+      - name: Build
+        run: uv build
+
+      - name: Check built artifacts match tag
+        run: |
+          VERSION="${GITHUB_REF_NAME#v}"
+          ls "dist/pyinfra-${VERSION}-py3-none-any.whl" "dist/pyinfra-${VERSION}.tar.gz"
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b  # v1.14.0
+
+      - name: Extract changelog
+        id: changelog
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          VERSION="${GITHUB_REF_NAME}"
+          # HEAD is the tagged commit itself, so look for the previous tag from
+          # its parent - the script's own tag detection would find this tag and
+          # produce an empty range.
+          PREV_TAG="$(git describe --tags --abbrev=0 "${VERSION}^" 2>/dev/null || true)"
+          if [ -n "$PREV_TAG" ]; then
+            python scripts/generate_changelog.py "$PREV_TAG" > /tmp/changelog.txt || true
+          fi
+          echo "body<<CHANGELOG_EOF" >> "$GITHUB_OUTPUT"
+          if [ -s /tmp/changelog.txt ]; then
+            cat /tmp/changelog.txt >> "$GITHUB_OUTPUT"
+          else
+            echo "Release $VERSION" >> "$GITHUB_OUTPUT"
+          fi
+          echo "CHANGELOG_EOF" >> "$GITHUB_OUTPUT"
+
+      - name: Create GitHub Release
+        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda  # v3.0.0
+        with:
+          body: ${{ steps.changelog.outputs.body }}
+          generate_release_notes: false
+          files: |
+            dist/*.whl
+            dist/*.tar.gz

.github/workflows/test.yml

@@ -7,8 +7,16 @@ on:
       - 2.x
       - 1.x
       - 0.x
+    tags:
+      - "v*"
   pull_request:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  # Only cancel superseded runs for PRs - branch and tag pushes should always
+  # produce a full result (release tags especially).
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   # Linting
   #
@@ -55,6 +63,7 @@ jobs:
       - type-check
       - spell-check
     strategy:
+      fail-fast: false
       matrix:
         os: [macos-26, macos-15, macos-14, windows-2025, windows-2022, ubuntu-24.04, ubuntu-22.04]
         # Test every OS vs. the default Python version (the newest stable release), and only one for
@@ -92,6 +101,7 @@ jobs:
       - type-check
       - spell-check
     strategy:
+      fail-fast: false
       matrix:
         os: [ubuntu-22.04, ubuntu-24.04]
         test-name: [local, ssh, docker, podman]