redis-iris 0.1.0a1__tar.gz

redis_iris-0.1.0a1/.autorc

@@ -0,0 +1,90 @@
+{
+  "plugins": [
+    "git-tag",
+    "conventional-commits",
+    "released"
+  ],
+  "owner": "redis",
+  "repo": "redis-iris",
+  "onlyPublishWithReleaseLabel": true,
+  "labels": [
+    {
+      "name": "auto:major",
+      "changelogTitle": "💥 Breaking Change",
+      "description": "Increment the major version when merged",
+      "releaseType": "major",
+      "color": "#C5000B",
+      "overwrite": true
+    },
+    {
+      "name": "auto:minor",
+      "changelogTitle": "🚀 Enhancement",
+      "description": "Increment the minor version when merged",
+      "releaseType": "minor",
+      "color": "#F1A60E",
+      "overwrite": true
+    },
+    {
+      "name": "auto:patch",
+      "changelogTitle": "🐛 Bug Fix",
+      "description": "Increment the patch version when merged",
+      "releaseType": "patch",
+      "color": "#870048",
+      "overwrite": true
+    },
+    {
+      "name": "auto:skip-release",
+      "description": "Preserve the current version when merged",
+      "releaseType": "skip",
+      "color": "#bf5416",
+      "overwrite": true
+    },
+    {
+      "name": "auto:release",
+      "description": "Create a release when this PR is merged",
+      "releaseType": "release",
+      "color": "#007f70",
+      "overwrite": true
+    },
+    {
+      "name": "auto:internal",
+      "changelogTitle": "🏠 Internal",
+      "description": "Changes only affect the internal API",
+      "releaseType": "none",
+      "color": "#696969",
+      "overwrite": true
+    },
+    {
+      "name": "auto:documentation",
+      "changelogTitle": "📝 Documentation",
+      "description": "Changes only affect the documentation",
+      "releaseType": "none",
+      "color": "#cfd3d7",
+      "overwrite": true
+    },
+    {
+      "name": "auto:tests",
+      "changelogTitle": "🧪 Tests",
+      "description": "Add or improve existing tests",
+      "releaseType": "none",
+      "color": "#ffd3cc",
+      "overwrite": true
+    },
+    {
+      "name": "auto:dependencies",
+      "changelogTitle": "🔩 Dependency Updates",
+      "description": "Update one or more dependencies version",
+      "releaseType": "none",
+      "color": "#8732bc",
+      "overwrite": true
+    },
+    {
+      "name": "auto:ci",
+      "changelogTitle": "CI/CD Changes",
+      "description": "Updates to CI/CD workflows and processes",
+      "releaseType": "none",
+      "color": "#E5A3DD",
+      "overwrite": true
+    }
+  ]
+}

redis_iris-0.1.0a1/.github/dependabot.yml

@@ -0,0 +1,20 @@
+# Opens a PR here whenever an Iris product SDK publishes a new version to PyPI.
+# Dependabot bumps the exact pin in pyproject.toml and regenerates uv.lock.
+# Scoped to the product SDKs only; one grouped PR per day covers all of them.
+# ponytail: daily polling, not a push from iris-sdks; add a repository_dispatch
+# receiver if same-hour bumps ever matter (releases here are manual anyway).
+version: 2
+updates:
+  - package-ecosystem: uv
+    directory: /
+    schedule:
+      interval: daily
+    allow:
+      - dependency-name: redis-agent-*
+      - dependency-name: langcache
+      - dependency-name: redis-context-retriever
+    groups:
+      iris-sdks:
+        patterns: ["*"]
+    # Changelog grouping for the Auto Release workflow; does not trigger a release.
+    labels: ["auto:dependencies"]

redis_iris-0.1.0a1/.github/workflows/auto-release.yml

@@ -0,0 +1,257 @@
+name: Auto Release
+
+# BOILERPLATE, NOT YET ACTIVE. Ported from redis-developer/sql-redis so the
+# label-driven release is ready when the alpha series ends. Until then releases
+# are manual through publish.yml, and this workflow runs only on dispatch.
+#
+# To activate: add `push: { branches: [main] }` under `on:`, delete publish.yml,
+# and make sure [project].version is semver (`0.1.0`, not `0.1.0a1`; `auto`
+# bumps semver and cannot parse PEP 440 suffixes).
+#
+# How it works once active: every push to main runs the gate; the release job
+# runs only when the merged PR carries the `auto:release` label. Intuit `auto`
+# picks the bump from the `auto:major` / `auto:minor` / `auto:patch` labels
+# (see .autorc), writes it into pyproject.toml and uv.lock, commits with
+# [skip ci], tags, and writes GitHub release notes. The built distribution is
+# then checked with twine and uploaded to PyPI with REDIS_IRIS_PYPI_TOKEN.
+# `first_release=true` publishes the committed version as-is (bootstrap, recovery).
+
+on:
+  workflow_dispatch:
+    inputs:
+      first_release:
+        description: "Bootstrap: publish the version currently in pyproject.toml. Bypasses the auto:release label gate and skips version bumping. Use only for the first release or manual recovery."
+        type: boolean
+        default: false
+
+permissions:
+  contents: write
+  issues: write
+  pull-requests: write
+
+concurrency:
+  group: auto-release-${{ github.ref }}
+  cancel-in-progress: false
+
+env:
+  PYTHON_VERSION: "3.11"
+  AUTO_VERSION: "11.3.6"
+  RELEASE_BOT_NAME: "github-actions[bot]"
+  RELEASE_BOT_EMAIL: "41898282+github-actions[bot]@users.noreply.github.com"
+
+jobs:
+  gate:
+    name: Gate on merged PR label
+    runs-on: ubuntu-latest
+    # Prevent infinite loops from the bot's "chore(release)" commit.
+    if: github.actor != 'github-actions[bot]'
+    outputs:
+      should_release: ${{ steps.find_pr.outputs.should_release }}
+      pr_number: ${{ steps.find_pr.outputs.pr_number }}
+    steps:
+      - name: Find merged PR and check labels
+        id: find_pr
+        uses: actions/github-script@v7
+        env:
+          FIRST_RELEASE: ${{ github.event.inputs.first_release }}
+        with:
+          script: |
+            // Manual bootstrap: bypass the PR label check entirely.
+            if (context.eventName === 'workflow_dispatch' && process.env.FIRST_RELEASE === 'true') {
+              core.notice('Manual first_release=true; bypassing PR label check.');
+              core.setOutput('should_release', 'true');
+              core.setOutput('pr_number', '');
+              return;
+            }
+            const { owner, repo } = context.repo;
+            const sha = context.sha;
+            const maxAttempts = 6;
+            let pulls;
+            // GitHub can briefly lag in associating a merge commit with its PR, so retry.
+            for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+              pulls = await github.rest.repos.listPullRequestsAssociatedWithCommit({
+                owner, repo, commit_sha: sha,
+              });
+              if (pulls.data.length) break;
+              if (attempt < maxAttempts) {
+                await new Promise((r) => setTimeout(r, 10000));
+              }
+            }
+            if (!pulls.data || !pulls.data.length) {
+              core.notice(`No PR associated with ${sha}. Not releasing.`);
+              core.setOutput('should_release', 'false');
+              core.setOutput('pr_number', '');
+              return;
+            }
+            const pr = pulls.data.find((p) => p.merged_at && p.base?.ref === 'main') ?? pulls.data[0];
+            const labels = (pr.labels || []).map((l) => l.name);
+            const should = labels.includes('auto:release');
+            core.setOutput('pr_number', String(pr.number));
+            core.setOutput('should_release', should ? 'true' : 'false');
+            core.notice(`PR #${pr.number} labels: ${labels.join(', ')}`);
+            core.notice(`should_release=${should}`);
+
+  release:
+    name: Tag, release, and publish
+    runs-on: ubuntu-latest
+    needs: gate
+    if: needs.gate.outputs.should_release == 'true'
+    env:
+      # 'true' for manual bootstrap runs; 'false' or empty otherwise.
+      FIRST_RELEASE: ${{ github.event.inputs.first_release || 'false' }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          ref: main
+          fetch-depth: 0
+          fetch-tags: true
+          # RELEASE_PAT (a PAT with repo + workflow scopes) lets the bot push to
+          # protected branches and trigger other workflows. Falls back to
+          # GITHUB_TOKEN for repos without branch protection.
+          token: ${{ secrets.RELEASE_PAT || secrets.GITHUB_TOKEN }}
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v6
+        with:
+          enable-cache: true
+          python-version: ${{ env.PYTHON_VERSION }}
+
+      - name: Install auto
+        run: |
+          set -euo pipefail
+          curl -L "https://github.com/intuit/auto/releases/download/v${AUTO_VERSION}/auto-linux.gz" -o auto-linux.gz
+          gunzip auto-linux.gz
+          chmod +x auto-linux
+          sudo mv auto-linux /usr/local/bin/auto
+          auto --version
+
+      - name: Check publishing token is configured
+        env:
+          PYPI_TOKEN: ${{ secrets.REDIS_IRIS_PYPI_TOKEN }}
+        run: |
+          if [ -z "$PYPI_TOKEN" ]; then
+            echo "::error::Configure the REDIS_IRIS_PYPI_TOKEN Actions secret."
+            exit 1
+          fi
+
+      - name: Install locked environment
+        run: uv sync --locked --all-groups
+
+      - name: Sanity build (pre-tag)
+        run: uv build --no-sources
+
+      - name: Capture previous tag
+        id: previous_tag
+        run: |
+          set -euo pipefail
+          echo "tag=$(git describe --tags --abbrev=0 2>/dev/null || echo '')" >> "$GITHUB_OUTPUT"
+
+      - name: Resolve next version (auto)
+        id: resolve_version
+        if: env.FIRST_RELEASE != 'true'
+        env:
+          GH_TOKEN: ${{ secrets.RELEASE_PAT || secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          RAW_VERSION="$(auto shipit --name "${RELEASE_BOT_NAME}" --email "${RELEASE_BOT_EMAIL}" --dry-run --quiet | tail -n1 | tr -d '\r')"
+          VERSION="${RAW_VERSION#v}"
+          if [ -z "$VERSION" ]; then
+            echo "Could not resolve release version from auto."
+            exit 1
+          fi
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          echo "Resolved version: $VERSION"
+
+      - name: Apply version to pyproject.toml and uv.lock
+        if: env.FIRST_RELEASE != 'true'
+        run: |
+          set -euo pipefail
+          VERSION="${{ steps.resolve_version.outputs.version }}"
+          sed -i "s/^version = \".*\"$/version = \"${VERSION}\"/" pyproject.toml
+          grep '^version = ' pyproject.toml
+          # uv.lock records the project's own version; CI syncs with --locked.
+          uv lock
+
+      - name: Commit version bump
+        if: env.FIRST_RELEASE != 'true'
+        env:
+          GH_TOKEN: ${{ secrets.RELEASE_PAT || secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          if git diff --quiet -- pyproject.toml uv.lock; then
+            echo "No version change to commit."
+          else
+            git config user.name "${RELEASE_BOT_NAME}"
+            git config user.email "${RELEASE_BOT_EMAIL}"
+            git add pyproject.toml uv.lock
+            # [skip ci] avoids re-running this workflow on the bot's own commit.
+            git commit -m "chore(release): v${{ steps.resolve_version.outputs.version }} [skip ci]"
+            git push origin HEAD:main
+          fi
+
+      - name: Read final version from pyproject.toml
+        id: final_version
+        run: |
+          set -euo pipefail
+          VERSION="$(grep -E '^version = ' pyproject.toml | head -1 | sed -E 's/version = "([^"]+)".*/\1/')"
+          if [ -z "$VERSION" ]; then
+            echo "Could not read version from pyproject.toml"
+            exit 1
+          fi
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          echo "Final version: $VERSION"
+
+      - name: Capture release commit SHA
+        id: release_commit
+        run: |
+          set -euo pipefail
+          echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
+
+      - name: Create labels (idempotent)
+        env:
+          GH_TOKEN: ${{ secrets.RELEASE_PAT || secrets.GITHUB_TOKEN }}
+        run: auto create-labels
+
+      - name: Create and push tag
+        run: |
+          set -euo pipefail
+          TAG="v${{ steps.final_version.outputs.version }}"
+          TARGET_SHA="${{ steps.release_commit.outputs.sha }}"
+          if git rev-parse -q --verify "refs/tags/$TAG" >/dev/null; then
+            EXISTING_SHA="$(git rev-list -n1 "$TAG")"
+            if [ "$EXISTING_SHA" = "$TARGET_SHA" ]; then
+              echo "Tag $TAG already exists at $TARGET_SHA. Skipping."
+              exit 0
+            fi
+            echo "Tag $TAG exists at $EXISTING_SHA but expected $TARGET_SHA."
+            exit 1
+          fi
+          git tag "$TAG" "$TARGET_SHA"
+          git push origin "$TAG"
+
+      - name: Build final artifacts
+        run: |
+          set -euo pipefail
+          rm -rf dist
+          uv build --no-sources
+          uv run --no-sync twine check --strict dist/*
+
+      - name: Create GitHub release with auto notes
+        env:
+          GH_TOKEN: ${{ secrets.RELEASE_PAT || secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          args=(--to "${{ steps.release_commit.outputs.sha }}" --use-version "v${{ steps.final_version.outputs.version }}")
+          if [ -n "${{ steps.previous_tag.outputs.tag }}" ]; then
+            args=(--from "${{ steps.previous_tag.outputs.tag }}" "${args[@]}")
+          fi
+          auto release "${args[@]}"
+          gh release upload "v${{ steps.final_version.outputs.version }}" dist/* --clobber
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1 # maintainer-recommended rolling ref: a SHA pin has no prebuilt ghcr image (manifest unknown)
+        with:
+          user: __token__
+          password: ${{ secrets.REDIS_IRIS_PYPI_TOKEN }}
+          attestations: false

redis_iris-0.1.0a1/.github/workflows/ci.yml

@@ -0,0 +1,107 @@
+name: CI
+
+on:
+  workflow_call:
+    outputs:
+      version:
+        description: Validated distribution version
+        value: ${{ jobs.build-and-install.outputs.version }}
+      prerelease:
+        description: Whether the distribution is a prerelease
+        value: ${{ jobs.build-and-install.outputs.prerelease }}
+  workflow_dispatch:
+  pull_request:
+  push:
+    branches: [main]
+
+concurrency:
+  # A reusable workflow inherits its caller's github.workflow. Keep this
+  # distinct from the publish workflow's concurrency group.
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  quality:
+    name: Quality (Python ${{ matrix.python-version }})
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.11", "3.12", "3.13"]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v6
+        with:
+          enable-cache: true
+          python-version: ${{ matrix.python-version }}
+      - run: uv sync --locked --all-groups --python ${{ matrix.python-version }}
+      - run: uv run ruff format --check .
+      - run: uv run ruff check .
+      - run: uv run mypy
+      - run: uv run pytest -m "not integration"
+
+  build-and-install:
+    name: Build and install distribution
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    outputs:
+      version: ${{ steps.metadata.outputs.version }}
+      prerelease: ${{ steps.metadata.outputs.prerelease }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v6
+        with:
+          python-version: "3.11"
+      - run: uv sync --locked --all-groups
+      - name: Validate release metadata
+        id: metadata
+        run: |
+          uv run --locked python - <<'PY'
+          import os
+          import tomllib
+          from packaging.version import Version
+
+          with open("pyproject.toml", "rb") as source:
+              project = tomllib.load(source)["project"]
+          version = Version(project["version"])
+          assert project["name"] == "redis-iris", "Unexpected distribution name"
+          assert str(version) == project["version"], "Use a canonical Python version"
+          assert version.local is None, "Local versions cannot be published to PyPI"
+          with open(os.environ["GITHUB_OUTPUT"], "a") as output:
+              output.write(f"version={version}\n")
+              output.write(f"prerelease={str(version.is_prerelease).lower()}\n")
+          PY
+      - run: uv build --no-sources
+      - run: uv run --locked twine check --strict dist/*
+      - run: uv venv --python 3.11 /tmp/iris-cli-venv
+      - run: uv pip install --python /tmp/iris-cli-venv/bin/python dist/*.whl
+      - run: uv pip check --python /tmp/iris-cli-venv/bin/python
+      - name: Verify installed distribution version
+        env:
+          EXPECTED_VERSION: ${{ steps.metadata.outputs.version }}
+        run: |
+          cd "$RUNNER_TEMP"
+          /tmp/iris-cli-venv/bin/python - <<'PY'
+          import os
+          import subprocess
+          from importlib.metadata import version
+          assert version("redis-iris") == os.environ["EXPECTED_VERSION"]
+          actual = subprocess.check_output(
+              ["/tmp/iris-cli-venv/bin/iris", "--version"], text=True
+          ).strip()
+          assert actual == f"iris, version {os.environ['EXPECTED_VERSION']}"
+          PY
+      - run: /tmp/iris-cli-venv/bin/iris --help
+      - run: /tmp/iris-cli-venv/bin/iris playbook --help
+      - run: /tmp/iris-cli-venv/bin/python -m redis_iris --help
+      - run: /tmp/iris-cli-venv/bin/python -m redis_iris.cli --help
+      - uses: actions/upload-artifact@v4
+        with:
+          name: redis-iris-dist
+          path: dist/*
+          if-no-files-found: error
+          overwrite: true

redis_iris-0.1.0a1/.github/workflows/docs.yml

@@ -0,0 +1,49 @@
+name: Deploy docs to GitHub Pages
+
+on:
+  push:
+    branches: [main]
+    paths: ["docs/**", "mkdocs.yml", "src/redis_iris/**"]
+  pull_request:
+    paths: ["docs/**", "mkdocs.yml", "src/redis_iris/**"]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: pages-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  DISABLE_MKDOCS_2_WARNING: "true"
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v6
+        with:
+          python-version: "3.12"
+      # Docs tooling only: mkdocstrings reads src/ statically, so product SDKs
+      # (including the path-sourced Context Retriever client) are not installed.
+      - run: uv sync --only-group docs
+      - run: uv run --no-sync mkdocs build --strict
+      - uses: actions/upload-pages-artifact@v3
+        with:
+          path: site
+
+  deploy:
+    if: github.event_name != 'pull_request' && github.ref == 'refs/heads/main'
+    needs: build
+    runs-on: ubuntu-latest
+    permissions:
+      pages: write
+      id-token: write
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    steps:
+      - id: deployment
+        uses: actions/deploy-pages@v4

redis_iris-0.1.0a1/.github/workflows/integration.yml

@@ -0,0 +1,60 @@
+name: Manual integration
+
+on:
+  workflow_dispatch:
+
+# The suite creates and deletes shared remote resources. Serialize runs so that
+# two manually requested runs cannot interfere with each other.
+concurrency:
+  group: playbook-integration
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+
+jobs:
+  playbook:
+    name: Playbook lifecycle
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    environment: playbook-integration
+    env:
+      IRIS_PLAYBOOK_TEST_CONTROL_URL: ${{ vars.IRIS_PLAYBOOK_TEST_CONTROL_URL }}
+      IRIS_PLAYBOOK_TEST_DATA_URL: ${{ vars.IRIS_PLAYBOOK_TEST_DATA_URL }}
+      IRIS_PLAYBOOK_TEST_IDENTITY_URL: ${{ vars.IRIS_PLAYBOOK_TEST_IDENTITY_URL }}
+      IRIS_PLAYBOOK_TEST_CONTROL_TOKEN: ${{ secrets.IRIS_PLAYBOOK_TEST_CONTROL_TOKEN }}
+      IRIS_PLAYBOOK_TEST_IDENTITY_TOKEN: ${{ secrets.IRIS_PLAYBOOK_TEST_IDENTITY_TOKEN }}
+      IRIS_PLAYBOOK_TEST_EMBEDDING_PROVIDER: ${{ vars.IRIS_PLAYBOOK_TEST_EMBEDDING_PROVIDER }}
+      IRIS_PLAYBOOK_TEST_EMBEDDING_MODEL: ${{ vars.IRIS_PLAYBOOK_TEST_EMBEDDING_MODEL }}
+      IRIS_PLAYBOOK_TEST_EMBEDDING_DIMENSIONS: ${{ vars.IRIS_PLAYBOOK_TEST_EMBEDDING_DIMENSIONS }}
+    steps:
+      - name: Validate integration configuration
+        shell: bash
+        run: |
+          required=(
+            IRIS_PLAYBOOK_TEST_CONTROL_URL
+            IRIS_PLAYBOOK_TEST_DATA_URL
+            IRIS_PLAYBOOK_TEST_IDENTITY_URL
+            IRIS_PLAYBOOK_TEST_CONTROL_TOKEN
+            IRIS_PLAYBOOK_TEST_IDENTITY_TOKEN
+            IRIS_PLAYBOOK_TEST_EMBEDDING_PROVIDER
+            IRIS_PLAYBOOK_TEST_EMBEDDING_MODEL
+            IRIS_PLAYBOOK_TEST_EMBEDDING_DIMENSIONS
+          )
+          missing=()
+          for name in "${required[@]}"; do
+            if [[ -z "${!name:-}" ]]; then
+              missing+=("$name")
+            fi
+          done
+          if (( ${#missing[@]} )); then
+            printf 'Missing integration configuration: %s\n' "${missing[*]}" >&2
+            exit 1
+          fi
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v6
+        with:
+          enable-cache: true
+          python-version: "3.13"
+      - run: uv sync --locked --all-groups --python 3.13
+      - run: task test:integration

redis_iris-0.1.0a1/.github/workflows/publish.yml

@@ -0,0 +1,82 @@
+name: Publish Redis Iris
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: publish-redis-iris
+  cancel-in-progress: false
+
+jobs:
+  check:
+    if: github.ref == 'refs/heads/main'
+    uses: ./.github/workflows/ci.yml
+
+  publish:
+    name: Publish to PyPI
+    needs: check
+    if: github.ref == 'refs/heads/main'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.sha }}
+          fetch-depth: 0
+          persist-credentials: false
+      - name: Reject an existing release tag
+        env:
+          RELEASE_TAG: v${{ needs.check.outputs.version }}
+        run: |
+          if git show-ref --verify --quiet "refs/tags/$RELEASE_TAG"; then
+            echo "::error::Release tag already exists. Bump the version before publishing."
+            exit 1
+          fi
+      - name: Check publishing token is configured
+        env:
+          PYPI_TOKEN: ${{ secrets.REDIS_IRIS_PYPI_TOKEN }}
+        run: |
+          if [ -z "$PYPI_TOKEN" ]; then
+            echo "::error::Configure the REDIS_IRIS_PYPI_TOKEN Actions secret."
+            exit 1
+          fi
+      - uses: actions/download-artifact@v4
+        with:
+          name: redis-iris-dist
+          path: dist
+      - name: Publish tested distributions
+        uses: pypa/gh-action-pypi-publish@release/v1 # maintainer-recommended rolling ref: a SHA pin has no prebuilt ghcr image (manifest unknown)
+        with:
+          user: __token__
+          password: ${{ secrets.REDIS_IRIS_PYPI_TOKEN }}
+          attestations: false
+
+  release:
+    name: Create GitHub Release
+    needs: [check, publish]
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: redis-iris-dist
+          path: dist
+      - name: Create tag and release at the tested commit
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+          RELEASE_TAG: v${{ needs.check.outputs.version }}
+          PRERELEASE: ${{ needs.check.outputs.prerelease }}
+          RELEASE_COMMIT: ${{ github.sha }}
+        run: |
+          args=(--repo "$GH_REPO" --target "$RELEASE_COMMIT"
+                --title "Redis Iris $RELEASE_TAG" --generate-notes)
+          if [ "$PRERELEASE" = true ]; then
+            args+=(--prerelease --latest=false)
+          fi
+          gh release create "$RELEASE_TAG" dist/* "${args[@]}"