ci: move to uv, shared tests and tag-only publish

.github/workflows/cla.yml

@@ -0,0 +1,16 @@
+name: CLA
+
+on:
+  issue_comment:
+    types: [created]
+  pull_request_target:
+    types: [opened, closed, synchronize]
+
+permissions:
+  pull-requests: write
+  statuses: write
+
+jobs:
+  cla:
+    uses: blacklanternsecurity/CLA/.github/workflows/cla-reusable.yml@40c6e18c0a6e32116eea4f89fc826f53c70889dc # 2026-10-07
+    secrets: inherit

.github/workflows/publish.yml

@@ -0,0 +1,45 @@
+name: publish
+
+on:
+  push:
+    tags: ["v*"]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: publish-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  check:
+    uses: blacklanternsecurity/CLA/.github/workflows/release-check.yml@40c6e18c0a6e32116eea4f89fc826f53c70889dc # 2026-10-07
+
+  tests:
+    needs: check
+    uses: ./.github/workflows/tests.yml
+    secrets: inherit
+
+  pypi:
+    needs: tests
+    environment: pypi
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+      - run: uv build
+      - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
+
+  release:
+    needs: [check, pypi]
+    permissions:
+      contents: write
+    uses: blacklanternsecurity/CLA/.github/workflows/publish.yml@40c6e18c0a6e32116eea4f89fc826f53c70889dc # 2026-10-07
+    with:
+      version: ${{ needs.check.outputs.version }}
+      prerelease: ${{ needs.check.outputs.prerelease }}

.github/workflows/tests.yml

@@ -5,111 +5,20 @@ on:
       - master
       - dev
   pull_request:
+  workflow_call:
+
+permissions:
+  contents: read
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
+  group: tests-${{ github.event_name }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
-  lint:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - run: |
-          pipx install ruff
-          ruff check
-          ruff format
-  test:
-    needs: lint
-    runs-on: ubuntu-latest
-    strategy:
-      # if one python version fails, let the others finish
-      fail-fast: false
-      matrix:
-        python-version: ["3.9", "3.10", "3.11", "3.12", "3.13"]
-    steps:
-      - uses: actions/checkout@v4
-      - name: Set up Python
-        uses: actions/setup-python@v5
-        with:
-          python-version: ${{ matrix.python-version }}
-      - name: Install dependencies
-        run: |
-          sudo apt update
-          sudo apt install -y tesseract-ocr chromium-browser
-          pip install poetry
-          poetry install
-      - name: Run tests
-        env:
-          CHROME_DEVEL_SANDBOX: /usr/lib/chromium/chrome-sandbox
-        run: |
-          poetry run pytest -s -vv --disable-warnings --cov-report xml:cov.xml --cov=webcap .
-      - name: Upload Code Coverage
-        uses: codecov/codecov-action@v5
-        with:
-          token: ${{ secrets.CODECOV_TOKEN }}
-          files: ./cov.xml
-          verbose: true
-
-  publish:
-    runs-on: ubuntu-latest
-    needs: test
-    if: github.event_name == 'push' && github.ref == 'refs/heads/master'
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-      - name: Set up Python
-        uses: actions/setup-python@v5
-        with:
-          python-version: "3.12"
-      - name: Install dependencies
-        run: |
-          python -m pip install --upgrade pip
-          pip install poetry build
-          poetry self add "poetry-dynamic-versioning[plugin]"
-      - name: Get current version from Poetry
-        id: get_version
-        run: |
-          VERSION=$(poetry version --short)
-          echo "VERSION=$VERSION" | tee -a $GITHUB_ENV
-      - name: Fetch latest tag
-        run: |
-          git fetch --tags
-          LATEST_TAG=$(git describe --tags $(git rev-list --tags --max-count=1) 2>/dev/null || echo "v0.0.0")
-          echo "LATEST_TAG=$LATEST_TAG" | tee -a $GITHUB_ENV
-      - name: Detect version change
-        run: |
-          # Retrieve and strip "v" prefix if present
-          PREVIOUS_VERSION="${{ env.LATEST_TAG }}"
-          CURRENT_VERSION="${{ env.VERSION }}"
-
-          echo "PREVIOUS_VERSION=$PREVIOUS_VERSION"
-          echo "CURRENT_VERSION=$CURRENT_VERSION"
-
-          # Extract major.minor for comparison
-          CURRENT_MAJOR_MINOR=$(echo "${CURRENT_VERSION#v}" | cut -d '.' -f 1-2)
-          PREVIOUS_MAJOR_MINOR=$(echo "${PREVIOUS_VERSION#v}" | cut -d '.' -f 1-2)
-
-          # Compare versions
-          if [ "$CURRENT_MAJOR_MINOR" == "$PREVIOUS_MAJOR_MINOR" ]; then
-            echo "VERSION_CHANGE=false" | tee -a $GITHUB_ENV
-          else
-            echo "VERSION_CHANGE=true" | tee -a $GITHUB_ENV
-          fi
-        shell: bash
-      - name: Build PyPi package
-        if: github.ref == 'refs/heads/master'
-        run: poetry build
-      - name: Publish PyPi package
-        if: github.ref == 'refs/heads/master'
-        uses: pypa/gh-action-pypi-publish@release/v1.12
-        with:
-          password: ${{ secrets.PYPI_API_TOKEN }}
-      - name: Tag the release
-        if: github.ref == 'refs/heads/master' && env.VERSION_CHANGE == 'true'
-        run: |
-          git config user.name "github-actions[bot]"
-          git config user.email "github-actions[bot]@users.noreply.github.com"
-          git tag -a "${{ env.VERSION }}" -m "Release ${{ env.VERSION }}"
-          git push origin "refs/tags/${{ env.VERSION }}"
+  python:
+    uses: blacklanternsecurity/CLA/.github/workflows/python-tests.yml@40c6e18c0a6e32116eea4f89fc826f53c70889dc # 2026-10-07
+    with:
+      setup-script: scripts/ci-setup.sh
+      pytest-args: -s -vv --disable-warnings --cov-report xml:cov.xml --cov=webcap .
+      coverage: true
+    secrets: inherit