Add release workflows

.editorconfig

@@ -0,0 +1,15 @@
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+indent_size = 4
+indent_style = space
+insert_final_newline = true
+trim_trailing_whitespace = true
+
+[{*.json,*.yaml,*.yml}]
+indent_size = 2
+
+[{README.rst,docs/*.rst}]
+indent_size = unset

.github/workflows/_prep-release.yaml

@@ -0,0 +1,31 @@
+name: "✨ Prep release"
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "The new version"
+        type: "string"
+        required: true
+
+jobs:
+  prep-release:
+    name: "Prep release v${{ inputs.version }}"
+
+    permissions:
+      contents: "write"
+      pull-requests: "write"
+
+    strategy:
+      matrix:
+        include:
+          - tox-label-create-changes: "prep-release"
+            branch-name: "release/$VERSION"
+            commit-title: "Update project metadata"
+            pr-base: "releases"
+            pr-title: "Release v$VERSION"
+
+    uses: "./.github/workflows/create-pr.yaml"
+    with:
+      config: "${{ toJSON(matrix) }}"
+      version: "${{ inputs.version }}"

.github/workflows/_test.yaml

@@ -0,0 +1,40 @@
+name: "🧪 Test"
+
+on:
+  pull_request:
+    types:
+      # These are the default on:pull_request types.
+      - "opened"
+      - "reopened"
+      - "synchronize"
+      # Release automation opens PRs as drafts without triggering CI;
+      # clicking "Ready for review" in the UI will trigger test runs.
+      - "ready_for_review"
+  push:
+    branches:
+      - "main"
+      - "releases"
+
+permissions:
+  contents: "read"
+
+jobs:
+  test:
+    name: "${{ matrix.name }}"
+    strategy:
+      matrix:
+        include:
+          - name: "Linux"
+            runner: "ubuntu-24.04"
+            cpythons:
+              - "3.13"
+            cache-key-hash-files:
+              - "requirements/*/*.txt"
+            cache-paths:
+              - ".mypy_cache/"
+            tox-skip-environments:
+              - "coverage-html"
+
+    uses: "./.github/workflows/tox.yaml"
+    with:
+      config: "${{ toJSON(matrix) }}"

.github/workflows/build-python-package.jinja.yaml

@@ -0,0 +1,99 @@
+# This file is a part of the Globus GitHub Workflows project.
+# https://github.com/globus/workflows
+# Copyright 2021-2026 Globus <support@globus.org>
+# Copyright 2024-2026 Kurt McKee <contactme@kurtmckee.org>
+# SPDX-License-Identifier: MIT
+
+on:
+  workflow_call:
+    outputs:
+      artifact-id:
+        description: "The artifact ID that can be subsequently downloaded"
+        value: "${{ jobs.build.outputs.artifact-id }}"
+      packages-path:
+        description: "The path to the Python packages"
+        value: "${{ jobs.build.outputs.packages-path }}"
+
+env:
+  PYTHON_VERSION: "[[ PYTHON_VERSION ]]"
+  UV_VERSION: "[[ UV_VERSION ]]"
+  ARTIFACT_NAME: "build-python-package-${{ github.run_id }}"
+  PACKAGES_PATH: "./dist"
+  BUILD_REQUIREMENTS: |
+    [[ include_requirements("build") | indent(4) ]]
+
+jobs:
+  #[#-
+  # Halt execution if an attempt is made to run the template directly.
+  # This block is enclosed in a Jinja comment and will not be rendered.
+  halt:
+    name: "Halt"
+    runs-on: "ubuntu-slim"
+    steps:
+      - name: "Halt"
+        run: |
+          echo "::error::⚠️ Do not run the workflow template directly."
+          exit 1
+  #]#
+  build:
+    #[#-
+    # The `needs` key is in a Jinja comment and will not be rendered.
+    needs: ["halt"]
+    #]#
+    name: "Build"
+    runs-on: "ubuntu-24.04"
+    permissions:
+      contents: "read"
+    outputs:
+      artifact-id: "${{ steps.upload-packages.outputs.artifact-id }}"
+      packages-path: "${{ steps.packages-path.outputs.packages-path }}"
+    steps:
+      - name: "Setup Python"
+        uses: "actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405" # v6.2.0
+        with:
+          python-version: "${{ env.PYTHON_VERSION }}"
+
+      - name: "Install uv"
+        uses: "astral-sh/setup-uv@681c641aba71e4a1c380be3ab5e12ad51f415867" # v7.1.6
+        with:
+          version: "${{ env.UV_VERSION }}"
+          enable-cache: "false"
+          ignore-empty-workdir: "true"
+
+      - name: "Checkout the repository"
+        uses: "actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd" # v6.0.2
+        with:
+          ref: "${{ github.sha }}"
+          persist-credentials: "false"
+
+      - name: "Build the package"
+        env:
+          PIP_DISABLE_PIP_VERSION_CHECK: "1"
+        run: |
+          REQUIREMENTS_PATH="$(mktemp)"
+          echo "${BUILD_REQUIREMENTS}" > "${REQUIREMENTS_PATH}"
+
+          uv run \
+            --no-managed-python \
+            --no-project \
+            --with-requirements="${REQUIREMENTS_PATH}" \
+            --module build --installer=uv --outdir="${PACKAGES_PATH}"
+
+      - name: "Show checksums"
+        run: |
+          sha256sum "${PACKAGES_PATH}"/*
+
+      - name: "Upload the built packages"
+        id: "upload-packages"
+        uses: "actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f" # v7.0.0
+        with:
+          name: "${{ env.ARTIFACT_NAME }}"
+          path: "${{ env.PACKAGES_PATH }}"
+          if-no-files-found: "error"
+          retention-days: "1"
+          overwrite: "false"
+
+      - name: "Create packages-path output"
+        id: "packages-path"
+        run: |
+          echo "packages-path=${PACKAGES_PATH}" >> "${GITHUB_OUTPUT}"

.github/workflows/build-python-package.yaml

@@ -0,0 +1,88 @@
+# DO NOT EDIT THIS FILE! EDIT 'build-python-package.jinja.yaml'.
+
+# This file is a part of the Globus GitHub Workflows project.
+# https://github.com/globus/workflows
+# Copyright 2021-2026 Globus <support@globus.org>
+# Copyright 2024-2026 Kurt McKee <contactme@kurtmckee.org>
+# SPDX-License-Identifier: MIT
+
+on:
+  workflow_call:
+    outputs:
+      artifact-id:
+        description: "The artifact ID that can be subsequently downloaded"
+        value: "${{ jobs.build.outputs.artifact-id }}"
+      packages-path:
+        description: "The path to the Python packages"
+        value: "${{ jobs.build.outputs.packages-path }}"
+
+env:
+  PYTHON_VERSION: "3.13"
+  UV_VERSION: "0.11.2"
+  ARTIFACT_NAME: "build-python-package-${{ github.run_id }}"
+  PACKAGES_PATH: "./dist"
+  BUILD_REQUIREMENTS: |
+    build==1.4.2 ; python_version == "3.13"
+    colorama==0.4.6 ; python_version == "3.13" and os_name == "nt"
+    packaging==26.0 ; python_version == "3.13"
+    pyproject-hooks==1.2.0 ; python_version == "3.13"
+
+jobs:
+  build:
+    name: "Build"
+    runs-on: "ubuntu-24.04"
+    permissions:
+      contents: "read"
+    outputs:
+      artifact-id: "${{ steps.upload-packages.outputs.artifact-id }}"
+      packages-path: "${{ steps.packages-path.outputs.packages-path }}"
+    steps:
+      - name: "Setup Python"
+        uses: "actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405" # v6.2.0
+        with:
+          python-version: "${{ env.PYTHON_VERSION }}"
+
+      - name: "Install uv"
+        uses: "astral-sh/setup-uv@681c641aba71e4a1c380be3ab5e12ad51f415867" # v7.1.6
+        with:
+          version: "${{ env.UV_VERSION }}"
+          enable-cache: "false"
+          ignore-empty-workdir: "true"
+
+      - name: "Checkout the repository"
+        uses: "actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd" # v6.0.2
+        with:
+          ref: "${{ github.sha }}"
+          persist-credentials: "false"
+
+      - name: "Build the package"
+        env:
+          PIP_DISABLE_PIP_VERSION_CHECK: "1"
+        run: |
+          REQUIREMENTS_PATH="$(mktemp)"
+          echo "${BUILD_REQUIREMENTS}" > "${REQUIREMENTS_PATH}"
+
+          uv run \
+            --no-managed-python \
+            --no-project \
+            --with-requirements="${REQUIREMENTS_PATH}" \
+            --module build --installer=uv --outdir="${PACKAGES_PATH}"
+
+      - name: "Show checksums"
+        run: |
+          sha256sum "${PACKAGES_PATH}"/*
+
+      - name: "Upload the built packages"
+        id: "upload-packages"
+        uses: "actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f" # v7.0.0
+        with:
+          name: "${{ env.ARTIFACT_NAME }}"
+          path: "${{ env.PACKAGES_PATH }}"
+          if-no-files-found: "error"
+          retention-days: "1"
+          overwrite: "false"
+
+      - name: "Create packages-path output"
+        id: "packages-path"
+        run: |
+          echo "packages-path=${PACKAGES_PATH}" >> "${GITHUB_OUTPUT}"