Automate drafting releases

.github/workflows/create-release.yml

@@ -0,0 +1,69 @@
+# This workflow will install Python dependencies, run tests and lint with a variety of Python versions.
+# After doing that, it will draft a release with the most up to date version
+
+name: Create New Release
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Release version (must be in format <MAJOR>.<MINOR>.<PATCH>, e.g. 1.1.1)'
+        required: true
+        type: string
+
+jobs:
+  verify-input:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+      - name: Verify input
+        env:
+          VERSION: ${{ inputs.version }}
+        run: |
+          # Make sure the input matches the intended format
+          SEMVER_REGEX="^([0-9]+)\.([0-9]+)\.([0-9]+)$"
+          if [[ ! "$VERSION" =~ $SEMVER_REGEX ]]; then
+            echo "::error::Invalid version format '$VERSION'. Must match X.Y.Z (e.g., 1.0.4)"
+            exit 1
+          fi
+
+          TAG="v$VERSION"
+
+          # Fail if the tag already exists
+          if git ls-remote --tags origin | grep -q "refs/tags/$TAG"; then
+            echo "Error: Tag $TAG already exists. Aborting."
+            exit 1
+          fi
+
+          echo "Creating Tag $TAG ..."
+
+  run-test:
+    permissions:
+      contents: read
+      id-token: write
+    needs: verify-input
+    # Calls the Pull Request workflow and ensure all tests pass before moving on
+    uses: ./.github/workflows/python-package.yml
+
+  draft-release:
+    needs: run-test
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    environment: release
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+      - name: Draft release v${{ inputs.version }}
+        env:
+          GH_TOKEN: ${{ github.token }}
+          VERSION: ${{ inputs.version }}
+        run: |
+          gh release create "v$VERSION" \
+            --title "v$VERSION" \
+            --generate-notes \
+            --target "$GITHUB_SHA"
+
+          echo "Drafted release v$VERSION"
+

.github/workflows/python-package.yml

@@ -8,6 +8,7 @@ on:
     branches: [master]
   pull_request:
     branches: [master]
+  workflow_call:
 
 permissions:
   contents: read
@@ -22,9 +23,9 @@ jobs:
         python-version: ["3.9", "3.10", "3.11", "3.12", "3.13"]
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
         with:
           python-version: ${{ matrix.python-version }}
       - name: Install dependencies
@@ -41,14 +42,14 @@ jobs:
       - name: Lint with PyLint
         run: pylint --rcfile=.pylintrc src/aws_secretsmanager_caching
       - name: Check formatting with Ruff
-        uses: astral-sh/ruff-action@v3
+        uses: astral-sh/ruff-action@4919ec5cf1f49eff0871dbcea0da843445b837e6
         with:
           version: "0.15.22"
       - name: Test with pytest
         run: |
           pytest test/unit/
       - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@v5
+        uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac
         with:
           fail_ci_if_error: true
           use_oidc: true