Update release workflow

.github/workflows/code-quality.yml

@@ -0,0 +1,39 @@
+name: "Code quality"
+
+on:
+  workflow_call:
+    inputs:
+      branch:
+        description: "Choose the branch to check"
+        type: string
+        default: "main"
+      repository:
+        description: "Choose the repository to check, when using a fork"
+        type: string
+        default: "dbt-labs/dbt-athena"
+  workflow_dispatch:
+    inputs:
+      branch:
+        description: "Choose the branch to check"
+        type: string
+        default: "main"
+      repository:
+        description: "Choose the repository to check, when using a fork"
+        type: string
+        default: "dbt-labs/dbt-athena"
+
+permissions:
+  contents: read
+
+jobs:
+  code-quality:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.branch }}
+          repository: ${{ inputs.repository }}
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ vars.DEFAULT_PYTHON_VERSION }}
+      - uses: pre-commit/[email protected]

.github/workflows/integration-tests.yml

@@ -0,0 +1,64 @@
+name: "Integration tests"
+
+on:
+  workflow_call:
+    inputs:
+      package:
+        description: "Choose the package to test"
+        type: string
+        default: "dbt-athena"
+      branch:
+        description: "Choose the branch to test"
+        type: string
+        default: "main"
+      repository:
+        description: "Choose the repository to test, when using a fork"
+        type: string
+        default: "dbt-labs/dbt-athena"
+  workflow_dispatch:
+    inputs:
+      package:
+        description: "Choose the package to test"
+        type: choice
+        options: ["dbt-athena", "dbt-athena-community"]
+      branch:
+        description: "Choose the branch to test"
+        type: string
+        default: "main"
+      repository:
+        description: "Choose the repository to test, when using a fork"
+        type: string
+        default: "dbt-labs/dbt-athena"
+
+permissions:
+  id-token: write
+  contents: read
+
+jobs:
+  integration-tests:
+    runs-on: ubuntu-latest
+    env:
+      DBT_TEST_ATHENA_S3_STAGING_DIR: ${{ vars.DBT_TEST_ATHENA_S3_BUCKET }}/staging/
+      DBT_TEST_ATHENA_S3_TMP_TABLE_DIR: ${{ vars.DBT_TEST_ATHENA_S3_BUCKET }}/tmp_tables/
+      DBT_TEST_ATHENA_REGION_NAME: ${{ vars.DBT_TEST_ATHENA_REGION_NAME }}
+      DBT_TEST_ATHENA_DATABASE: awsdatacatalog
+      DBT_TEST_ATHENA_SCHEMA: dbt-tests
+      DBT_TEST_ATHENA_WORK_GROUP: athena-dbt-tests
+      DBT_TEST_ATHENA_THREADS: 16
+      DBT_TEST_ATHENA_POLL_INTERVAL: 0.5
+      DBT_TEST_ATHENA_NUM_RETRIES: 3
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.branch }}
+          repository: ${{ inputs.repository }}
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ vars.DEFAULT_PYTHON_VERSION }}
+      - uses: pypa/hatch@install
+      - uses: aws-actions/configure-aws-credentials@v2
+        with:
+          role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/${{ secrets.ASSUMABLE_ROLE_NAME }}
+          aws-region: ${{ vars.DBT_TEST_ATHENA_REGION_NAME }}
+      - run: hatch run integration-tests
+        working-directory: ./${{ inputs.package }}

.github/workflows/merge-checks.yml

@@ -0,0 +1,26 @@
+name: "Merge checks"
+
+on:
+  push:
+    branches: "main"
+
+# only run this once per branch at a time
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref_name }}
+  cancel-in-progress: true
+
+jobs:
+  integration-tests-dbt-athena:
+    uses: ./.github/workflows/integration-tests.yml
+    with:
+      branch: ${{ github.ref }}
+    secrets: inherit
+
+  # integration test runs can't run in parallel for now, so run them in serial
+  integration-tests-dbt-athena-community:
+    needs: integration-tests-dbt-athena
+    uses: ./.github/workflows/integration-tests.yml
+    with:
+      package: "dbt-athena-community"
+      branch: ${{ github.ref }}
+    secrets: inherit

.github/workflows/publish-pypi.yml

@@ -0,0 +1,71 @@
+name: "Publish to PyPI"
+
+on:
+  workflow_call:
+    inputs:
+      package:
+        description: "Choose the package to publish"
+        type: string
+        default: "dbt-athena"
+      deploy-to:
+        description: "Choose whether to publish to test or prod"
+        type: string
+        default: "prod"
+      branch:
+        description: "Choose the branch to publish"
+        type: string
+        default: "main"
+
+permissions:
+  contents: read
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    environment:
+      name: ${{ inputs.deploy-to }}
+      url: ${{ vars.PYPI_PROJECT_URL }}/${{ inputs.package }}
+    permissions:
+      # this permission is required for trusted publishing
+      # see https://github.com/marketplace/actions/pypi-publish
+      id-token: write
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.branch }}
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ vars.DEFAULT_PYTHON_VERSION }}
+      - uses: pypa/hatch@install
+      # hatch will build using test PyPI first and fall back to prod PyPI when deploying to test
+      # this is done via environment variables in the test environment in GitHub
+      - run: hatch build && hatch run build:check-all
+        working-directory: ./${{ inputs.package }}
+      - uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          repository-url: ${{ vars.PYPI_REPOSITORY_URL }}
+          packages-dir: ${{ inputs.package }}/dist/
+
+  verify:
+    runs-on: ubuntu-latest
+    needs: publish
+    # check the correct index
+    environment:
+      name: ${{ inputs.deploy-to }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.branch }}
+      - id: version
+        run: echo "version=$(hatch version)" >> $GITHUB_OUTPUT
+        working-directory: ./${{ inputs.package }}
+      - uses: nick-fields/retry@v3
+        with:
+          timeout_seconds: 10
+          retry_wait_seconds: 10
+          max_attempts: 15  # 5 minutes: (10s timeout + 10s delay) * 15 attempts
+          command: wget ${{ vars.PYPI_PROJECT_URL }}/${{ inputs.package }}/${{ steps.version.outputs.version }}

.github/workflows/publish.yml

@@ -0,0 +1,48 @@
+name: "Publish"
+
+on:
+  workflow_dispatch:
+    inputs:
+      deploy-to:
+        description: "Choose whether to deploy to test or prod"
+        type: environment
+        default: "prod"
+      branch:
+        description: "Choose the branch to release from"
+        type: string
+        default: "main"
+
+# don't attempt to release the same target in parallel
+concurrency:
+  group: ${{ github.workflow }}-${{ inputs.deploy-to }}
+  cancel-in-progress: true
+
+jobs:
+  unit-tests:
+    uses: ./.github/workflows/unit-tests.yml
+    with:
+      branch: ${{ inputs.branch }}
+
+  integration-tests:
+    uses: ./.github/workflows/integration-tests.yml
+    with:
+      branch: ${{ inputs.branch }}
+      repository: ${{ github.repository }}
+    secrets: inherit
+
+  publish-dbt-athena:
+    needs: [unit-tests, integration-tests]
+    uses: ./.github/workflows/publish-pypi.yml
+    with:
+      deploy-to: ${{ inputs.deploy-to }}
+      branch: ${{ inputs.branch }}
+
+  publish-dbt-athena-community:
+    # dbt-athena-community is hard pinned to dbt-athena to ensure they are the same
+    # this means we need to finish publishing dbt-athena before starting to build dbt-athena-community
+    needs: publish-dbt-athena
+    uses: ./.github/workflows/publish-pypi.yml
+    with:
+      package: "dbt-athena-community"
+      deploy-to: ${{ inputs.deploy-to }}
+      branch: ${{ inputs.branch }}