Migrate CI to new-generation compas-actions

Replace compas-actions.build / .docs / .publish and the legacy
changelog-checker with the narrow actions from the compas-dev/compas-actions
monorepo, following compas_pb.

- build/coverage/docs/pr-checks now use ci, setup-python, docs, pr-checks
  and release-check.
- Releases move to the release-PR flow: prepare-release.yml opens a
  release/vX.Y.Z pull request, and merging it to main drives release.yml
  (release-check, ci, prepare-release, OIDC publish, github-release,
  versioned docs deploy). Tag pushes no longer publish.
- bump-my-version no longer commits or tags and no longer parses
  pre-release versions; the release actions accept stable semver only.
- Drop the release and prepare-changelog invoke tasks, now owned by the
  release actions.
- Python 3.9 is Rhino 8's Python, so it keeps a dedicated build-py39 job.
  The ci action installs interpreters with actions/setup-python, which has
  no darwin-arm64 build for 3.9, so that job uses a uv-managed interpreter
  the way the previous workflow did.
- publish_yak becomes a guarded stub. Its components and invoke tasks moved
  to timber_design, but a workflow_dispatch workflow must exist on the
  default branch to be runnable, and LTS-1.x.x still dispatches it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: chenkasirer

.github/workflows/build.yml

@@ -8,32 +8,71 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 jobs:
-  Build:
-    if: "!contains(github.event.pull_request.labels.*.name, 'docs-only')"
+  release-change:
+    name: Detect release merge
+    runs-on: ubuntu-latest
+    outputs:
+      is-release: ${{ steps.release.outputs.is-release }}
+    steps:
+      - uses: compas-dev/compas-actions/release-check@v1
+        id: release
+
+  build:
+    needs: release-change
+    if: >-
+      !contains(github.event.pull_request.labels.*.name, 'docs-only') &&
+      (github.event_name == 'pull_request' || needs.release-change.outputs.is-release != 'true')
     runs-on: ${{ matrix.os }}
     strategy:
+      fail-fast: false
       matrix:
         os: [macos-latest, windows-latest]
-        python: ['3.9', '3.12', '3.14']
+        python: ['3.12', '3.14']
 
     steps:
-      - uses: actions/checkout@v5
-      
-      - uses: astral-sh/setup-uv@v7
+      - uses: compas-dev/compas-actions/ci@v1
         with:
           python-version: ${{ matrix.python }}
+          management-tool: uv
+          extras: dev
+          run-prebuild: true
+          invoke-tasks: lint test
+
+  # Rhino 8 ships Python 3.9, so it has to stay covered. The ci action installs
+  # the interpreter with actions/setup-python, which has no darwin-arm64 build
+  # for 3.9, so this job uses a uv-managed interpreter instead. Tests that need
+  # the OCC Brep backend are marked `requires_occ` and skipped here, because
+  # compas_brep[occ] has no 3.9 wheels.
+  build-py39:
+    needs: release-change
+    if: >-
+      !contains(github.event.pull_request.labels.*.name, 'docs-only') &&
+      (github.event_name == 'pull_request' || needs.release-change.outputs.is-release != 'true')
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [macos-latest, windows-latest]
+
+    steps:
+      - uses: actions/checkout@v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: astral-sh/setup-uv@v10.0.1
+        with:
+          python-version: '3.9'
           activate-environment: true
-      
-      - name: Install dependencies
-        run: |
-          uv pip install -e ".[dev]"
+
+      - name: Install project
+        run: uv pip install -e ".[dev]"
 
       - name: Run pre-build
-        run: |
-          invoke pre-build
+        run: invoke pre-build
 
-      - name: Run tests
-        run: |
-          invoke lint
-          invoke test
+      - name: Run checks
+        run: invoke lint test

.github/workflows/coverage.yml

@@ -8,33 +8,33 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 jobs:
   coverage:
     if: "!contains(github.event.pull_request.labels.*.name, 'docs-only')"
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v5
-      
-      - uses: astral-sh/setup-uv@v7
+      - uses: actions/checkout@v7.0.1
         with:
-          python-version: "3.12"
-          activate-environment: true
+          persist-credentials: false
 
-      - name: Install dependencies
-        run: |
-          uv pip install -e ".[dev]"
+      - uses: compas-dev/compas-actions/setup-python@v1
+        with:
+          python-version: '3.12'
+          management-tool: uv
+          extras: dev
 
       - name: Run pre-build
-        run: |
-          invoke pre-build
+        run: invoke pre-build
 
       - name: Run tests collecting coverage reports
-        run: |
-          pytest --cov src/compas_timber --cov-report=html
+      - name: Run tests collecting coverage reports
+        run: pytest --cov src/compas_timber --cov-report=xml --cov-report=term
 
       - name: Upload coverage reports to Codecov
         uses: codecov/codecov-action@v5
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
-    

.github/workflows/docs.yml

@@ -4,18 +4,21 @@ on:
   push:
     branches:
       - main
-    tags:
-      - 'v*'
   pull_request:
     branches:
       - main
 
+permissions:
+  contents: read
+
 jobs:
-  docs:
+  build:
     runs-on: ubuntu-latest
     steps:
-      - uses: compas-dev/compas-actions.docs@v5
+      - uses: compas-dev/compas-actions/docs@v1
         with:
-          github_token: ${{ secrets.GITHUB_TOKEN }}
-          generator: mkdocs
-          extras: dev,mkdocs
+          python-version: '3.12'
+          extras: dev
+          config-file: mkdocs.yml
+          # griffe reports pre-existing docstring/signature mismatches as warnings
+          strict: false

.github/workflows/pr-checks.yml

@@ -1,20 +1,26 @@
 name: verify-pr-checklist
+
 on:
   pull_request:
     types: [assigned, opened, synchronize, reopened, labeled, unlabeled]
     branches:
       - main
 
+permissions:
+  contents: read
+
 jobs:
-  build:
-    name: Check Actions
+  release:
+    name: Validate release metadata
+    runs-on: ubuntu-latest
+    steps:
+      - uses: compas-dev/compas-actions/release-check@v1
+
+  changelog:
+    name: Check changelog
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - name: Changelog check
-        uses: Zomzog/changelog-checker@v1.2.0
+      - uses: compas-dev/compas-actions/pr-checks@v1
         with:
-          fileName: CHANGELOG.md
-          checkNotification: Simple
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          changelog-path: CHANGELOG.md
+          skip-label: no changelog

.github/workflows/prepare-release.yml

@@ -0,0 +1,26 @@
+name: prepare release
+
+on:
+  workflow_dispatch:
+    inputs:
+      release-type:
+        description: Semantic version component to bump
+        required: true
+        type: choice
+        options:
+          - patch
+          - minor
+          - major
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  release-pr:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: compas-dev/compas-actions/release-pr@v1
+        with:
+          release-type: ${{ inputs.release-type }}
+          github-token: ${{ github.token }}

.github/workflows/release.yml

@@ -2,35 +2,127 @@ name: release
 
 on:
   push:
-    tags:
-      - 'v*'
+    branches:
+      - main
+
+permissions:
+  contents: read
 
 jobs:
-  Build:
+  release:
+    name: Detect release merge
+    runs-on: ubuntu-latest
+    outputs:
+      is-release: ${{ steps.release.outputs.is-release }}
+      version: ${{ steps.release.outputs.version }}
+      tag: ${{ steps.release.outputs.tag }}
+    steps:
+      - uses: compas-dev/compas-actions/release-check@v1
+        id: release
+
+  build:
+    needs: release
+    if: needs.release.outputs.is-release == 'true'
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+        python: ['3.12', '3.14']
+    steps:
+      - uses: compas-dev/compas-actions/ci@v1
+        with:
+          python-version: ${{ matrix.python }}
+          management-tool: uv
+          extras: dev
+          run-prebuild: true
+          invoke-tasks: lint test
+
+  # See build.yml: 3.9 is Rhino 8's Python and needs a uv-managed interpreter.
+  build-py39:
+    needs: release
+    if: needs.release.outputs.is-release == 'true'
     runs-on: ${{ matrix.os }}
     strategy:
+      fail-fast: false
       matrix:
-        os: [ubuntu-latest]
-        python: ['3.12']
+        os: [ubuntu-latest, macos-latest, windows-latest]
+    steps:
+      - uses: actions/checkout@v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: astral-sh/setup-uv@v10.0.1
+        with:
+          python-version: '3.9'
+          activate-environment: true
 
+      - name: Install project
+        run: uv pip install -e ".[dev]"
+
+      - name: Run pre-build
+        run: invoke pre-build
+
+      - name: Run checks
+        run: invoke lint test
+
+  prepare:
+    needs: [release, build, build-py39]
+    if: needs.release.outputs.is-release == 'true'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: compas-dev/compas-actions/prepare-release@v1
+        with:
+          python-version: '3.12'
+          management-tool: uv
+          extras: dev
+          run-prebuild: true
+
+  publish:
+    needs: [release, prepare]
+    if: needs.release.outputs.is-release == 'true'
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/p/compas-timber
+    permissions:
+      contents: read
+      id-token: write
     steps:
-      - uses: compas-dev/compas-actions.build@v5
+      - name: Download package distributions
+        uses: actions/download-artifact@v8.0.1
         with:
-          invoke_lint: true
-          check_import: false
-          use_conda: false
-          invoke_test: true
-          python: ${{ matrix.python }}
-          run_prebuild: true
-
-  Publish:
-    needs: Build
+          name: python-package-distributions
+          path: dist
+
+      - name: Publish package distributions to PyPI
+        uses: pypa/gh-action-pypi-publish@v1.14.2
+
+  create-release:
+    needs: [release, publish]
+    if: needs.release.outputs.is-release == 'true'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: compas-dev/compas-actions/github-release@v1
+        with:
+          github-token: ${{ github.token }}
+          tag-name: ${{ needs.release.outputs.tag }}
+          target: ${{ github.sha }}
+
+  docs:
+    needs: [release, create-release]
+    if: needs.release.outputs.is-release == 'true'
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     steps:
-      - uses: compas-dev/compas-actions.publish@prebuild_v2  # will be replaced with the new gen build actions in a following PR
+      - uses: compas-dev/compas-actions/docs@v1
         with:
-          publish_to_pypi: true
-          pypi_token: ${{ secrets.PYPI }}
-          github_token: ${{ secrets.GITHUB_TOKEN }}
-          python: '3.12'
-          run_prebuild: true
+          deploy: true
+          version: ${{ needs.release.outputs.version }}
+          python-version: '3.12'
+          extras: dev
+          config-file: mkdocs.yml
+          strict: false