ci: adjust the release process to handle publishing ops and ops-scena…

…rio (#1432)

Adds new publish workflows for ops-scenario (one for main PyPI, one for
test.pypi.org), modelled on the ops workflows. These differ
significantly from the old ops-scenario publish workflow (now deleted),
which would automatically create a GitHub release and tag and publish to
PyPI (with API credentials) on a push to main.

To avoid confusion, the publish workflows for `ops` are renamed (and
while this is being done, the extension is changed from `yml` to `yaml`
to match all the other files).

The publish workflows are trigged by new tags - `2.*` for `ops` (rather
than a release being published) and `scenario-7.*` for `ops-scenario`.
This allows releases that only include publishing one of the packages
(for example, in a month that had no changes to one, or when a patch
release is required).

The HACKING.md documentation is updated to reflect the changes in the
release process.

A CHANGES.md is added for Scenario, backdated to 7.0.0 (although 7.0.0
is not entirely complete, but it does list the main changes).

Once this is merged, trusted publishing will need to be configured for
the `ops-scenario` package, and the config for `ops` will need to be
adjusted to refer to the new workflow filename.

Drive-bys:
* The smoke test workflow had incorrect indentation for the `schedule`
trigger.
* Clarify when `(testing)` and `(harness)` scopes are used in
conventional commits, now that we have Scenario in the repo.
 * Note the use of the various `.. juju` directives in documentation.
* Minor clarifications in the release process based on comments from
@james-garner-canonical when he did his first release.

.github/workflows/publish.yml → .github/workflows/publish-ops-scenario.yaml

@@ -1,8 +1,8 @@
 name: Publish
 on:
-  release:
-    types:
-      - published
+  push:
+    tags:
+      - 'scenario-7.*'
 
 jobs:
   framework-tests:
@@ -12,7 +12,7 @@ jobs:
   hello-charm-tests:
     uses: ./.github/workflows/hello-charm-tests.yaml
   build-n-publish:
-    name: Build and Publish to PyPI
+    name: Build and Publish ops-scenario to PyPI
     runs-on: ubuntu-latest
     permissions:
       id-token: write
@@ -27,9 +27,10 @@ jobs:
         run: pip install wheel build
       - name: Build
         run: python -m build
+        working-directory: ./testing
       - name: Attest build provenance
         uses: actions/[email protected]
         with:
-          subject-path: 'dist/*'
+          subject-path: 'testing/dist/*'
       - name: Publish
         uses: pypa/gh-action-pypi-publish@release/v1

.github/workflows/publish-ops.yaml

@@ -0,0 +1,39 @@
+name: Publish
+on:
+  push:
+    tags:
+      # TODO: When we come to ops v3.x we will need to reconsider what to do
+      # here (we might want to start prefixing with 'v' for one thing), and we
+      # will likely be publishing at least three packages: ops, ops-scenario,
+      # and ops-harness.
+      - '2.*'
+
+jobs:
+  framework-tests:
+    uses: ./.github/workflows/framework-tests.yaml
+  observability-charm-tests:
+    uses: ./.github/workflows/observability-charm-tests.yaml
+  hello-charm-tests:
+    uses: ./.github/workflows/hello-charm-tests.yaml
+  build-n-publish:
+    name: Build and Publish ops to PyPI
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      attestations: write
+      contents: read
+    needs: [framework-tests, observability-charm-tests, hello-charm-tests]
+    steps:
+      - uses: actions/checkout@v4
+      - name: Setup Python
+        uses: actions/setup-python@v5
+      - name: Install build dependencies
+        run: pip install wheel build
+      - name: Build
+        run: python -m build
+      - name: Attest build provenance
+        uses: actions/[email protected]
+        with:
+          subject-path: 'dist/*'
+      - name: Publish
+        uses: pypa/gh-action-pypi-publish@release/v1

.github/workflows/smoke.yaml

@@ -2,8 +2,8 @@ name: ops Smoke Tests
 
 on:
   workflow_dispatch:
-    schedule:
-      - cron:  '0 7 25 * *'
+  schedule:
+    - cron:  '0 7 25 * *'
 
 jobs:
   test:

.github/workflows/test-publish-ops-scenario.yaml

@@ -0,0 +1,35 @@
+name: Test Publish
+on: [workflow_dispatch, workflow_call]
+
+jobs:
+  framework-tests:
+    uses: ./.github/workflows/framework-tests.yaml
+  observability-charm-tests:
+    uses: ./.github/workflows/observability-charm-tests.yaml
+  hello-charm-tests:
+    uses: ./.github/workflows/hello-charm-tests.yaml
+  build-n-publish:
+    name: Build and Publish ops-scenario to Test PyPI
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      attestations: write
+      contents: read
+    needs: [framework-tests, observability-charm-tests, hello-charm-tests]
+    steps:
+      - uses: actions/checkout@v4
+      - name: Setup Python
+        uses: actions/setup-python@v5
+      - name: Install build dependencies
+        run: pip install wheel build
+      - name: Build
+        run: python -m build
+        working-directory: ./testing
+      - name: Attest build provenance
+        uses: actions/[email protected]
+        with:
+          subject-path: 'testing/dist/*'
+      - name: Publish to test.pypi.org
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          repository-url: https://test.pypi.org/legacy/

.github/workflows/test-publish.yml → .github/workflows/test-publish-ops.yaml

@@ -9,7 +9,7 @@ jobs:
   hello-charm-tests:
     uses: ./.github/workflows/hello-charm-tests.yaml
   build-n-publish:
-    name: Build and Publish to Test PyPI
+    name: Build and Publish ops to Test PyPI
     runs-on: ubuntu-latest
     permissions:
       id-token: write