Release pipeline

Maintainer workflow for publishing the eai-supmig wheel and sdist. Mirrors the pyswig release pipeline: curated changelog, bump_release.py, tag verification, wheel smoke tests, GitLab registry, TestPyPI gate, then manual production PyPI.

See also package-publishing.md for package layout and CI variables.

Prerequisites

• Protected refs (Settings → Repository → Protected branches and tags):
  • Branches: master, develop
  • Tags: v* (required so masked/protected CI variables are available on tag pipelines)
• CI variables (masked):
  • TWINE_PASSWORD_TESTPYPI — TestPyPI API token; not protected (needed on develop for manual publish:testpypi:branch)
  • TWINE_PASSWORD_PYPI — PyPI API token; protected (tag pipelines only)
• PyPI and TestPyPI projects registered for eai-supmig
• GitLab Package Registry enabled (publish:gitlab uses CI_JOB_TOKEN)

Changelog policy

CHANGELOG.md follows Keep a Changelog.

• Keep a single ## [Unreleased] section with ### Added / ### Changed / ### Fixed bullets as work lands on develop.
• Use - (nothing yet) when a subsection has no entries yet.
• Do not dump raw commit lists into the changelog; write user-facing notes.
• At release, python scripts/bump_release.py:
  • moves [Unreleased] notes into ## [X.Y.Z] - YYYY-MM-DD
  • resets [Unreleased] with placeholder bullets
  • updates footer compare/tag links ([Unreleased]: …, [X.Y.Z]: …)
• The bump script also sets src/eai_supmig/__init__.py __version__ and creates a chore(release): Bump version to X.Y.Z commit (add --tag to create the annotated tag locally).

Example unreleased section:

## [Unreleased]

### Added

- `eai-supmig doctor` reports missing Conan profiles

### Fixed

- Bootstrap skips ai-rules submodule when `tools/ai-rules/` is already a git repo

Release steps

1. Land features on develop; keep CHANGELOG.md [Unreleased] curated.
2. Wait for green CI on develop.
3. Run python scripts/bump_release.py (updates __version__, finalizes changelog, commits).
4. Push develop, ff-merge to master.
5. Tag and push from master: git push origin vX.Y.Z (or re-tag after bump with git tag -a vX.Y.Z if you did not use --tag during bump).

Optional pre-tag validation on develop or master: after a branch pipeline builds wheels (build:package), trigger manual publish:testpypi:branch.

Branch pipeline jobs

Job	When	Purpose
build:package	develop, master, MR	Build wheel/sdist; twine check
publish:testpypi:branch	manual on develop / master	Upload to TestPyPI (allow_failure: true)

Tag pipeline jobs

Job	When	Purpose
package:build	tag	verify_release_version.py; build; twine check
package:smoke	tag	Fresh venv: install wheel; eai-supmig --help
publish:gitlab	tag, automatic	Upload to GitLab PyPI registry
publish:testpypi	tag, automatic	Upload to TestPyPI
package:smoke-testpypi	after TestPyPI	pip install eai-supmig==X.Y.Z from TestPyPI
publish:pypi	tag, manual	Upload to production PyPI
package:smoke-pypi	after PyPI	pip install eai-supmig==X.Y.Z from PyPI

Local dry-run

pip install -e ".[dev]"
python -m build
python -m twine check dist/*
python scripts/smoke_install_package.py --dist dist --expected-version 0.1.0 --venv .smoke-venv
python scripts/bump_release.py --dry-run

On Windows, use the same commands from an activated .venv.

Version source of truth

• src/eai_supmig/__init__.py — __version__ (read by setuptools and CI verify)
• Git tag vX.Y.Z must match __version__ exactly before the tag pipeline publishes