PYTHON-5956 Add python/setup action for shared uv+just CI setup

.github/workflows/ci.yml

@@ -69,8 +69,10 @@ jobs:
         with:
           persist-credentials: false
 
-      - name: Install uv
-        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+      # The tests below need uv, which the python/setup action installs. Using it
+      # here also exercises the action itself on every run.
+      - name: Install Python tooling
+        uses: $/python/setup
 
       - name: Run uv lock update tests
         run: |

README.md

@@ -422,218 +422,11 @@ jobs:
           token: ${{ github.token }}
 ```
 
-## Python Helper Scripts
+## Python Actions
 
-These scripts are opinionated helper scripts for Python releases.
+Python helper actions have their own READMEs:
 
-### Pre-Publish
-
-Bump the version and create a new tag.  Verify the tag.
-Push the commit and tag to the source branch unless `dry_run` is set.
-
-```yaml
-- name: Setup
-  uses: mongodb-labs/drivers-github-tools/setup@v3
-  with:
-    ...
-
-- uses: mongodb-labs/drivers-github-tools/python/pre-publishv2
-  with:
-    version: ${{ inputs.version }}
-    version_bump_script: ./.github/scripts/bump-version.sh
-    dry_run: ${{ inputs.dry_run }}
-```
-
-### Post-publish
-
-To be run after separately publishing the [Python package](https://github.com/pypa/gh-action-pypi-publish#trusted-publishing).
-Handles follow-up tasks related to publishing Python packages, including
-signing `dist` files and uploading report assets to S3.
-It will also push the following (dev) version to the source branch.
-It will create a draft GitHub release and attach the signature files.
-If `dry_run` is set, nothing will be pushed.
-
-The jobs should look something like:
-
-```yaml
-publish:
-  name: Upload release to PyPI
-  runs-on: ubuntu-latest
-  environment: release
-  permissions:
-    id-token: write
-  steps:
-    - name: Download all the dists
-      uses: actions/download-artifact@v4
-      with:
-        name: all-dist-${{ github.run_id }}
-        path: dist/
-    - name: Publish package distributions to PyPI
-      if: inputs.dry_run == 'false'
-      uses: pypa/gh-action-pypi-publish@release/v1
-
-post-publish:
-  needs: [publish]
-  name: Handle post-publish actions
-  runs-on: ubuntu-latest
-  environment: release
-  permissions:
-    id-token: write
-    contents: write
-    attestations: write
-    security-events: write
-  steps:
-  - name: Setup
-    uses: mongodb-labs/drivers-github-tools/setup@v3
-    with:
-      ...
-
-  - uses: mongodb-labs/drivers-github-tools/python/post-publish@v3
-    with:
-      version: ${{ inputs.version }}
-      following_version: ${{ inputs.following_version }}
-      version_bump_script: ./.github/scripts/bump-version.sh
-      product_name: winkerberos
-      token: ${{ github.token }}
-      dry_run: ${{ inputs.dry_run }}
-```
-
-### uv Lock Update
-
-This action runs `uv lock --upgrade` and opens a pull request with the resulting
-lock file changes. It maintains a single open pull request: a subsequent run
-updates the existing one rather than opening a second.
-
-The caller checks out the repository and puts `uv` on `PATH`.
-
-```yaml
-name: Update uv.lock
-
-on:
-  schedule:
-    - cron: "0 7 * * 1"
-  workflow_dispatch:
-
-# Runs must serialize: two at once would force push the same branch and race on
-# the pull request. Keep the group static rather than keying it on the ref.
-concurrency:
-  group: uv-lock-update
-  cancel-in-progress: false
-
-jobs:
-  update-lock:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          persist-credentials: false
-      - uses: astral-sh/setup-uv@v8
-      - uses: mongodb-labs/drivers-github-tools/python/uv-lock-update@v3
-        with:
-          app_id: ${{ vars.APP_ID }}
-          private_key: ${{ secrets.APP_PRIVATE_KEY }}
-```
-
-`app_id` and `private_key` are required unless `dry_run` is true.
-
-`base` defaults to the ref the workflow ran on, which is what a checkout with no
-`ref` takes. If you check out a different ref, set `base` to match it, or the
-pull request will contain every unrelated commit between the two branches.
-
-Every label named in `labels` must already exist in the repository, because
-GitHub rejects a pull request that asks for an unknown one.
-
-Set `dry_run: true` to log the branch and pull request the action would have
-created, without pushing or opening anything.
-
-The upgrade skips releases published within the last 7 days, so a broken or
-compromised release has time to be yanked before it can land in the lock file.
-Change the cutoff with `exclude_newer`, which takes anything uv's
-`--exclude-newer` accepts: a date, an RFC 3339 timestamp, a duration such as
-`30 days`, or `false` to upgrade to the newest releases with no cutoff at all.
-It reaches uv as `UV_EXCLUDE_NEWER`, so it overrides an `exclude-newer` the
-repository sets in `pyproject.toml` or `uv.toml`. Pass `exclude_newer: ""` to
-leave that setting in charge instead.
-
-```yaml
-      - uses: mongodb-labs/drivers-github-tools/python/uv-lock-update@v3
-        with:
-          app_id: ${{ vars.APP_ID }}
-          private_key: ${{ secrets.APP_PRIVATE_KEY }}
-          exclude_newer: 14 days
-```
-
-## Python Labs Helper Scripts
-
-These scripts are opinionated helper scripts for Python releases in MongoDB Labs.
-In contrast to the regulare Python scripts, it does not generate the
-SSDLC compliance assets or upload anything to S3.
-
-### Pre-Publish
-
-Create a new tag.  Verify the tag.
-Push the commit and tag to the source branch unless `dry_run` is set.
-
-```yaml
-- name: Setup
-  uses: mongodb-labs/drivers-github-tools/setup@v3
-  with:
-    ...
-
-- uses: mongodb-labs/drivers-github-tools/python-labs/pre-publishv2
-  with:
-    version_bump_script: ./.github/scripts/bump-version.sh
-    dry_run: ${{ inputs.dry_run }}
-```
-
-### Post-publish
-
-To be run after separately publishing the [Python package](https://github.com/pypa/gh-action-pypi-publish#trusted-publishing).
-Handles follow-up tasks related to publishing Python packages.
-It will push the following (dev) version to the source branch.
-It will create a draft GitHub release with generated release notes.
-If `dry_run` is set, nothing will be pushed.
-
-The jobs should look something like:
-
-```yaml
-publish:
-  name: Upload release to PyPI
-  runs-on: ubuntu-latest
-  environment: release
-  permissions:
-    id-token: write
-  steps:
-    - name: Download all the dists
-      uses: actions/download-artifact@v4
-      with:
-        name: all-dist-${{ github.run_id }}
-        path: dist/
-    - name: Publish package distributions to PyPI
-      if: inputs.dry_run == 'false'
-      uses: pypa/gh-action-pypi-publish@release/v1
-
-post-publish:
-  needs: [publish]
-  name: Handle post-publish actions
-  runs-on: ubuntu-latest
-  environment: release
-  permissions:
-    id-token: write
-    contents: write
-    attestations: write
-    security-events: write
-  steps:
-  - name: Setup
-    uses: mongodb-labs/drivers-github-tools/setup@v3
-    with:
-      ...
-
-  - uses: mongodb-labs/drivers-github-tools/python-labs/post-publish@v3
-    with:
-      following_version: ${{ inputs.following_version }}
-      version_bump_script: ./.github/scripts/bump-version.sh
-      product_name: python-bsonjs
-      token: ${{ github.token }}
-      dry_run: ${{ inputs.dry_run }}
-```
+- [`python/`](python/README.md) covers setup, pre-publish, post-publish, and uv
+  lock updates for the Python drivers.
+- [`python-labs/`](python-labs/README.md) covers pre-publish and post-publish for
+  MongoDB Labs projects, without the SSDLC assets and S3 upload.

python-labs/README.md

@@ -0,0 +1,74 @@
+# Python Labs Actions
+
+Opinionated helper actions for Python releases in MongoDB Labs. Unlike the
+[regular Python actions](../python/README.md), these do not generate the SSDLC
+compliance assets or upload anything to S3.
+
+## Pre-Publish
+
+Create a new tag.  Verify the tag.
+Push the commit and tag to the source branch unless `dry_run` is set.
+
+```yaml
+- name: Setup
+  uses: mongodb-labs/drivers-github-tools/setup@v3
+  with:
+    ...
+
+- uses: mongodb-labs/drivers-github-tools/python-labs/pre-publish@v3
+  with:
+    version_bump_script: ./.github/scripts/bump-version.sh
+    dry_run: ${{ inputs.dry_run }}
+```
+
+## Post-publish
+
+To be run after separately publishing the [Python package](https://github.com/pypa/gh-action-pypi-publish#trusted-publishing).
+Handles follow-up tasks related to publishing Python packages.
+It will push the following (dev) version to the source branch.
+It will create a draft GitHub release with generated release notes.
+If `dry_run` is set, nothing will be pushed.
+
+The jobs should look something like:
+
+```yaml
+publish:
+  name: Upload release to PyPI
+  runs-on: ubuntu-latest
+  environment: release
+  permissions:
+    id-token: write
+  steps:
+    - name: Download all the dists
+      uses: actions/download-artifact@v4
+      with:
+        name: all-dist-${{ github.run_id }}
+        path: dist/
+    - name: Publish package distributions to PyPI
+      if: inputs.dry_run == 'false'
+      uses: pypa/gh-action-pypi-publish@release/v1
+
+post-publish:
+  needs: [publish]
+  name: Handle post-publish actions
+  runs-on: ubuntu-latest
+  environment: release
+  permissions:
+    id-token: write
+    contents: write
+    attestations: write
+    security-events: write
+  steps:
+  - name: Setup
+    uses: mongodb-labs/drivers-github-tools/setup@v3
+    with:
+      ...
+
+  - uses: mongodb-labs/drivers-github-tools/python-labs/post-publish@v3
+    with:
+      following_version: ${{ inputs.following_version }}
+      version_bump_script: ./.github/scripts/bump-version.sh
+      product_name: python-bsonjs
+      token: ${{ github.token }}
+      dry_run: ${{ inputs.dry_run }}
+```