add changeset tooling

.github/actions/setup-python/action.yml

@@ -0,0 +1,45 @@
+name: "Setup Python"
+description: "Install Python toolchain and dependencies"
+
+inputs:
+  python-version:
+    description: "Python version to use"
+    required: false
+    default: "3.10"
+
+runs:
+  using: "composite"
+
+  steps:
+    # https://github.com/actions/setup-python
+    - name: Install Python
+      uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
+      with:
+        python-version: ${{ inputs.python-version }}
+
+    - name: Upgrade pip
+      run: python -m pip install --upgrade pip
+      shell: bash
+
+    - name: Get pip cache directory
+      id: pip-cache-dir
+      run: |
+        echo "dir=$(pip cache dir)" >> $GITHUB_OUTPUT
+      shell: bash
+
+    # https://github.com/actions/cache
+    - name: Setup pip cache
+      uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+      with:
+        path: ${{ steps.pip-cache-dir.outputs.dir }}
+        key: ${{ runner.os }}-pip-${{ hashFiles('**/pyproject.toml') }}
+        restore-keys: |
+          ${{ runner.os }}-pip-
+
+    - name: Install dependencies
+      run: |
+        pip install -e .[dev]
+        pip install -e ./packages/sdk-types[dev]
+        pip install -e ./packages/api-key-stamper[dev]
+        pip install -e ./packages/http[dev]
+      shell: bash

.github/workflows/python-build.yml

@@ -0,0 +1,37 @@
+name: Python Build
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - main
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  build:
+    name: Build & Test
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python-version: ["3.10", "3.11", "3.12"]
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: Setup Python
+        uses: ./.github/actions/setup-python
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: Check formatting
+        run: make format-check
+
+      - name: Run type checking
+        run: make typecheck

.github/workflows/version-and-publish.yml

@@ -0,0 +1,196 @@
+name: Version and Publish
+
+on:
+  workflow_dispatch: # allows manual invocation
+  push:
+    tags:
+      - "v*.*.*" # e.g. v1.2.3
+
+permissions:
+  contents: write
+  id-token: write
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  build:
+    name: Build
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          fetch-depth: 0
+          ref: ${{ github.event.repository.default_branch }}
+
+      - name: Setup Python
+        uses: ./.github/actions/setup-python
+
+      - name: Check for pending releases
+        run: |
+          echo "Checking for pending changesets..."
+          CHANGES_STATUS=$(make changeset-status 2>&1)
+          echo "$CHANGES_STATUS"
+          if echo "$CHANGES_STATUS" | grep -qi "pending"; then
+            echo "Changesets found, continuing"
+          else
+            echo "No unreleased changesets found, exiting"
+            exit 1
+          fi
+
+      - name: Check formatting
+        run: make format-check
+
+      - name: Run type checking
+        run: make typecheck
+
+  version-and-rebuild:
+    name: Version and Rebuild
+    runs-on: ubuntu-latest
+    needs: build
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          fetch-depth: 0
+          ref: ${{ github.event.repository.default_branch }}
+
+      - name: Setup Python
+        uses: ./.github/actions/setup-python
+
+      - name: Configure Git User
+        run: |
+          git config user.name "tkhq-deploy"
+          git config user.email "github@turnkey.engineering"
+
+      - name: Create and switch to release branch
+        run: |
+          git fetch origin
+          git checkout -B release/${{ github.ref_name }} origin/release/${{ github.ref_name }} || \
+          git checkout -B release/${{ github.ref_name }}
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Version packages
+        run: |
+          make changeset-version
+          make changeset-changelog
+          make format-check
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Commit versioned changes
+        run: |
+          git add -A
+          git commit -m "chore: release packages" || echo "No changes to commit"
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Push changes to release branch
+        run: |
+          git push -u origin release/${{ github.ref_name }}
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build packages
+        run: make build
+
+      - name: Upload release artifacts
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: release-artifacts-${{ github.ref_name }}
+          path: |
+            packages/*/dist/
+            .changeset/**
+          retention-days: 7
+
+  prepare-release:
+    name: Prepare Release
+    runs-on: ubuntu-latest
+    needs: version-and-rebuild
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          fetch-depth: 0
+          ref: release/${{ github.ref_name }}
+
+      - name: Create GitHub Release
+        uses: softprops/action-gh-release@da05d552573ad5aba039eaac05058a918a7bf631 # v2.2.2
+        with:
+          tag_name: ${{ github.ref_name }}
+          name: Release ${{ github.ref_name }}
+          generate_release_notes: true
+          draft: true
+          prerelease: false
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+  publish:
+    name: Publish to PyPI
+    needs: prepare-release
+    runs-on:
+      group: package-deploy
+    environment: production # require manual approval for production deployments
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          fetch-depth: 0
+          ref: release/${{ github.ref_name }}
+
+      - name: Download release artifacts
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          name: release-artifacts-${{ github.ref_name }}
+          path: .
+
+      - name: Prepare packages for publishing
+        run: |
+          mkdir -p dist-to-publish
+
+          if [ ! -f .changeset/.last_bumped_modules ]; then
+            echo "No .last_bumped_modules file found, nothing to publish"
+            exit 1
+          fi
+
+          echo "Packages to publish:"
+          cat .changeset/.last_bumped_modules
+
+          while IFS= read -r module || [ -n "$module" ]; do
+            # Skip empty lines
+            [ -z "$module" ] && continue
+
+            dist_dir="packages/${module}/dist"
+            if [ -d "$dist_dir" ]; then
+              echo "Copying ${module} artifacts..."
+              cp "${dist_dir}"/* dist-to-publish/
+            else
+              echo "Warning: dist directory not found for ${module}"
+            fi
+          done < .changeset/.last_bumped_modules
+
+          echo "Artifacts to publish:"
+          ls -la dist-to-publish/
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0
+        with:
+          packages-dir: dist-to-publish/
+
+      - name: Success
+        run: |
+          echo -e "\033[0;32m"
+          echo "░██████╗██╗░░░██╗░█████╗░░█████╗░███████╗░██████╗░██████╗"
+          echo "██╔════╝██║░░░██║██╔══██╗██╔══██╗██╔════╝██╔════╝██╔════╝"
+          echo "╚█████╗░██║░░░██║██║░░╚═╝██║░░╚═╝█████╗░░╚█████╗░╚█████╗░"
+          echo "░╚═══██╗██║░░░██║██║░░██╗██║░░██╗██╔══╝░░░╚═══██╗░╚═══██╗"
+          echo "██████╔╝╚██████╔╝╚█████╔╝╚█████╔╝███████╗██████╔╝██████╔╝"
+          echo "╚═════╝░░╚═════╝░░╚════╝░░╚════╝░╚══════╝╚═════╝░╚═════╝░"
+          echo -e "\033[0m"