fix: complete semantic-release workflow with yq-free build process (#100)

* fix: complete semantic-release workflow with asset uploads and yq fallbacks

- Add fallback values for yq-dependent variables in makefiles/common.mk to prevent errors in containers without yq
- Fix changelog configuration with proper exclude patterns and template structure
- Replace manual semantic-release setup with official GitHub Actions for better reliability
- Add python-semantic-release/publish-action to upload wheel and tarball assets to GitHub releases
- Ensure dist files are properly uploaded to releases for distribution

* fix: add .nojekyll to disable Jekyll processing for GitHub Pages

GitHub Pages was attempting to build the site with Jekyll instead of using
the MkDocs-generated static files, causing deployment failures. The .nojekyll
file tells GitHub Pages to serve the pre-built static files directly.

* fix: remove broken src/orb symlink directory

The src/orb directory contained broken symlinks that were causing Jekyll
to fail when trying to process documentation. This directory appears to
be an obsolete compatibility layer that's no longer needed.

* fix: add semantic-release-build target for yq-free builds

- Add semantic-release-build target that bypasses yq-dependent steps
- Update pyproject.toml to use make semantic-release-build instead of make build
- The new target directly calls build.sh without generate-pyproject or get-version
- Semantic-release provides VERSION env var and handles pyproject.toml version updates

Fixes semantic-release build failures due to missing yq dependency in GitHub Actions.

Author: fgogolli

.github/workflows/semantic-release.yml

@@ -42,36 +42,17 @@ jobs:
           fetch-depth: 0
           token: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Setup Python and UV
-        uses: ./.github/actions/setup-python-uv
+      - name: Python Semantic Release
+        id: release
+        uses: python-semantic-release/python-semantic-release@v10.5.3
         with:
-          python-version: '3.11'
-
-      - name: Install semantic-release
-        run: |
-          source .venv/bin/activate
-          pip install python-semantic-release
-
-      - name: Run semantic release
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          RELEASE_MODE: ${{ inputs.mode || 'forward' }}
-          RELEASE_COMMIT: ${{ inputs.commit }}
-          RELEASE_VERSION: ${{ inputs.version }}
-        run: |
-          source .venv/bin/activate
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          git_committer_name: "github-actions[bot]"
+          git_committer_email: "github-actions[bot]@users.noreply.github.com"
 
-          if [ "${{ inputs.mode }}" = "historical" ]; then
-            if [ -z "${{ inputs.commit }}" ] || [ -z "${{ inputs.version }}" ]; then
-              echo "ERROR: Historical releases require both commit and version"
-              exit 1
-            fi
-            echo "Creating historical release ${{ inputs.version }} from commit ${{ inputs.commit }}"
-            RELEASE_MODE=historical RELEASE_COMMIT=${{ inputs.commit }} RELEASE_VERSION=${{ inputs.version }} semantic-release version
-          elif [ "${{ inputs.mode }}" = "analysis" ]; then
-            echo "Running release analysis"
-            RELEASE_MODE=analysis ./dev-tools/release/analyze_rc_readiness.sh
-          else
-            echo "Running forward release with semantic-release"
-            semantic-release version
-          fi
+      - name: Publish to GitHub Release Assets
+        uses: python-semantic-release/publish-action@v10.5.3
+        if: steps.release.outputs.released == 'true'
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          tag: ${{ steps.release.outputs.tag }}

.gitignore

@@ -37,6 +37,7 @@ security-report.md
 *-sbom-*.json
 *-sbom-*.spdx
 *-sbom-*.cyclonedx
+sbom-vulnerabilities.json
 
 # Python
 __pycache__/

.nojekyll

@@ -0,0 +1 @@
+

:wq!

@@ -14,21 +14,21 @@ TEST_ARGS ?=
 BUILD_ARGS ?=
 DOCS_ARGS ?=
 
-# Python version settings (loaded from project config)
-PYTHON_VERSIONS := $(shell yq '.python.versions | join(" ")' $(PROJECT_CONFIG))
-DEFAULT_PYTHON_VERSION := $(shell yq '.python.default_version' $(PROJECT_CONFIG))
+# Python version settings (loaded from project config, with fallbacks)
+PYTHON_VERSIONS := $(shell yq '.python.versions | join(" ")' $(PROJECT_CONFIG) 2>/dev/null || echo "3.10 3.11 3.12 3.13")
+DEFAULT_PYTHON_VERSION := $(shell yq '.python.default_version' $(PROJECT_CONFIG) 2>/dev/null || echo "3.12")
 
 # Package information (loaded from project config, but respect environment VERSION for CI)
-PACKAGE_NAME := $(shell yq '.project.name' $(PROJECT_CONFIG))
-PACKAGE_NAME_SHORT := $(shell yq '.project.short_name' $(PROJECT_CONFIG))
-VERSION ?= $(shell yq '.project.version' $(PROJECT_CONFIG))
-AUTHOR := $(shell yq '.project.author' $(PROJECT_CONFIG))
-LICENSE := $(shell yq '.project.license' $(PROJECT_CONFIG))
+PACKAGE_NAME := $(shell yq '.project.name' $(PROJECT_CONFIG) 2>/dev/null || echo "open-resource-broker")
+PACKAGE_NAME_SHORT := $(shell yq '.project.short_name' $(PROJECT_CONFIG) 2>/dev/null || echo "orb")
+VERSION ?= $(shell yq '.project.version' $(PROJECT_CONFIG) 2>/dev/null || echo "0.0.0")
+AUTHOR := $(shell yq '.project.author' $(PROJECT_CONFIG) 2>/dev/null || echo "AWS Labs")
+LICENSE := $(shell yq '.project.license' $(PROJECT_CONFIG) 2>/dev/null || echo "Apache-2.0")
 
 # Repository information (loaded from project config)
-REPO_ORG := $(shell yq '.repository.org' $(PROJECT_CONFIG))
+REPO_ORG := $(shell yq '.repository.org' $(PROJECT_CONFIG) 2>/dev/null || echo "awslabs")
 REPO_URL := https://github.com/$(REPO_ORG)/$(PACKAGE_NAME)
-CONTAINER_REGISTRY := $(shell yq '.repository.registry' $(PROJECT_CONFIG))/$(REPO_ORG)
+CONTAINER_REGISTRY := $(shell yq '.repository.registry' $(PROJECT_CONFIG) 2>/dev/null || echo "ghcr.io")/$(REPO_ORG)
 CONTAINER_IMAGE := $(PACKAGE_NAME)
 DOCS_URL := https://$(REPO_ORG).github.io/$(PACKAGE_NAME)
 

makefiles/common.mk

@@ -65,6 +65,9 @@ build: clean dev-install  ## Build package
 	VERSION=$${VERSION:-$$(make -s get-version)} $(MAKE) generate-pyproject && \
 	VERSION=$${VERSION:-$$(make -s get-version)} BUILD_ARGS="$(BUILD_ARGS)" ./dev-tools/package/build.sh
 
+semantic-release-build:  ## Build package for semantic-release (minimal dependencies)
+	./dev-tools/package/build.sh
+
 build-test: build  ## Build and test package installation
 	@echo "Testing package installation..."
 	make test-install

makefiles/deploy.mk

@@ -110,6 +110,8 @@ ci = [
     "cyclonedx-bom>=4.0.0,<8.0.0",
     # Security override for safety's vulnerable peewee dependency
     "peewee>=3.18.3",
+    # Security override for safety's vulnerable marshmallow dependency (CVE-2025-68480)
+    "marshmallow>=4.1.2",
 
     # Documentation
     "mkdocs>=1.5.0,<2.0.0",
@@ -285,8 +287,9 @@ explicit_package_bases = true
 namespace_packages = true
 
 [tool.semantic_release]
-version_variables = [".project.yml:project.version"]
-build_command = "make build"
+version_toml = ["pyproject.toml:project.version"]
+version_variables = [".project.yml:version"]
+build_command = "make semantic-release-build"
 major_on_zero = true
 allow_zero_version = true
 tag_format = "v{version}"
@@ -307,8 +310,20 @@ match = "fix/.*|feature/.*"
 prerelease_token = "alpha"
 prerelease = true
 
+[tool.semantic_release.changelog]
+exclude_commit_patterns = [
+    '''chore(?:\([^)]*?\))?:.+''',
+    '''ci(?:\([^)]*?\))?:.+''',
+    '''refactor(?:\([^)]*?\))?:.+''',
+    '''style(?:\([^)]*?\))?:.+''',
+    '''test(?:\([^)]*?\))?:.+''',
+    '''build\((?!deps\):.+)''',
+    '''Initial [Cc]ommit.*''',
+]
+
 [tool.semantic_release.changelog.default_templates]
 changelog_file = "CHANGELOG.md"
+output_format = "md"
 
 [tool.semantic_release.commit_parser_options]
 minor_tags = ["feat"]