Migrate to cava-devops centralised CI/CD

[nicoloesch]

This PR is a draft. Do not merge until all steps below are complete and all checks are green.

Before merging

Step 1 - Review the code

Review all file changes in this PR while it is still in draft state. Confirm the deleted workflows, new workflow files, pyproject.toml changes, and template additions look correct before proceeding.

Step 2 - Set up labels

Go to github.com/AustralianCancerDataNetwork/omop-graph/labels. Delete every existing label, then create these five in order:

Name	Color	Description
breaking	B60205	Incompatible API change. MAJOR: x+1.y.z
feature	0E8A16	New backwards-compatible functionality. MINOR: x.y+1.z
fix	0075CA	Bug fix, backwards-compatible. PATCH: x.y.z+1
dependencies	6F42C1	Dependency update. PATCH: x.y.z+1
chore	FEF2C0	Maintenance, refactoring, or housekeeping. Excluded from changelog, no version bump.

chore must exist before step 3.

Step 3 - Apply the chore label to this PR

Step 4 - Update merge settings

Settings > General > Pull Requests:

• Allow squash merging: enabled, default commit message: Pull request title
• Allow merge commits: disabled
• Allow rebase merging: disabled

Step 5 - Update branch protection ruleset on main

Settings > Rules > Rulesets. Edit or create a ruleset targeting main:

• Require a pull request before merging: enabled (0 approvals)
• Required status checks: remove any old check names, then add exactly:
  • label-gate / check
  • build-test / test
• Require linear history: enabled
• Block force pushes: enabled
• Bypass: Repository admin (for this setup only)

These check names match the job IDs in ci.yml. If they do not appear in the autocomplete dropdown, type them in manually.

Step 6 - Set up the pypi deployment environment

If the pypi environment does not exist: Settings > Environments > New environment, name it pypi, no protection rules needed. If it already exists, confirm the name is exactly pypi.

Step 7 - Set up PyPI trusted publisher

On pypi.org/manage/account/publishing:

• If no trusted publisher exists for this repo: add a pending publisher with owner AustralianCancerDataNetwork, repository omop-graph, workflow filename publish.yml, environment pypi.
• If a trusted publisher already exists (e.g. pointing to python-publish.yml): edit it and change the workflow filename to publish.yml. Confirm the environment name is pypi.

Step 8 - Mark PR ready for review

Click "Ready for review". This triggers ci.yml.

Step 9 - Confirm all checks pass

• label-gate / check
• build-test / test

Do not bypass with admin if either fails, diagnose first.

Step 10 - Merge

Squash-merge. Leave the extended description box empty.

---

After merging

Step 1 - Verify merge.yml ran

Actions tab: Release Update workflow should show two green jobs.

Step 2 - Check the release draft

Go to Releases. The draft body will be empty (chore) and the suggested version will be the next patch after v1.3.0, so v1.3.1. Leave unpublished until the next feature or fix PR.

---

Changes in this PR

• Deleted: release.yml, lint-pr.yml, python-publish.yml, .releaserc.json

• Added: ci.yml, merge.yml, publish.yml, .github/release-drafter.yml, issue/PR templates

• Updated: docs.yml trigger to push: tags: ['v*'], pyproject.toml to hatch-vcs

• Frozen: CHANGELOG.md (header pointing to GitHub Releases)

• Fixes Migrate to cava-devops centralised CI/CD #14

Checklist

• Label: chore
• Tests pass (uv run pytest -q)
• Lint passes (uv run ruff check .)