ci: Move to Release Please and refactor overall CI approach

.github/dependabot.yml

@@ -10,8 +10,3 @@ updates:
     directory: /
     schedule:
       interval: monthly
-
-  - package-ecosystem: npm
-    directory: /node/
-    schedule:
-      interval: monthly

.github/workflows/codeql.yaml

@@ -0,0 +1,32 @@
+
+name: CodeQL
+
+#
+# Scan code with CodeQL on a scheduled basis.
+#
+# - <https://codeql.github.com/>
+# - <https://github.com/github/codeql-action>
+#
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: 1 6 8 * *
+
+jobs:
+  codeql:
+    name: CodeQL
+    runs-on: ubuntu-latest
+
+    permissions:
+      security-events: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v3
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v2
+
+      - name: Perform CodeQL analysis
+        uses: github/codeql-action/analyze@v2

.github/workflows/release-please.yaml

@@ -0,0 +1,63 @@
+name: Release Please
+
+#
+# Central release workflow.
+#
+# - Uses Google's Release Please for release management.
+# - Python Poetry used for publishing package to PyPI.
+# - Does not run any checks, tests, or scans.
+#
+
+on:
+  workflow_dispatch:
+  push:
+    branches: [trunk]
+
+jobs:
+  primary:
+    name: Primary
+    runs-on: ubuntu-latest
+    steps:
+      - name: Release Please
+        uses: google-github-actions/release-please-action@v3
+        id: release_please
+        with:
+          release-type: python
+          bump-minor-pre-major: true
+          changelog-types: |
+            [
+              { "type": "feat",      "section": "Features",     "hidden": false },
+              { "type": "fix",       "section": "Bug Fixes",    "hidden": false },
+              { "type": "revert",    "section": "Reverts",      "hidden": false },
+              { "type": "perf",      "section": "Performance",  "hidden": false },
+              { "type": "refactor",  "section": "Refactor",     "hidden": false },
+              { "type": "test",      "section": "Tests",        "hidden": false },
+              { "type": "docs",      "section": "Docs",         "hidden": false },
+              { "type": "build",     "section": "Build",        "hidden": false },
+              { "type": "ci",        "section": "CI/CD",        "hidden": false },
+              { "type": "style",     "section": "Styles",       "hidden": false },
+              { "type": "chore",     "section": "Chores",       "hidden": true }
+            ]
+
+      - name: Checkout
+        if: ${{ steps.release_please.outputs.release_created }}
+        uses: actions/checkout@v3
+
+      - name: Cache Poetry installation
+        if: ${{ steps.release_please.outputs.release_created }}
+        uses: actions/cache@v3
+        with:
+          path: |
+            ~/.local/bin/poetry
+            ~/.local/share/pypoetry
+          key: poetry-installation-0
+
+      - name: Install Poetry
+        if: ${{ steps.release_please.outputs.release_created }}
+        run: curl -sSL https://install.python-poetry.org | python -
+
+      - name: Publish to PyPI with Poetry
+        if: ${{ steps.release_please.outputs.release_created }}
+        run: poetry publish --build -n -u __token__ -p "$TOKEN"
+        env:
+          TOKEN: ${{ secrets.PYPI_TOKEN }}

.github/workflows/release-testpypi.yaml

@@ -0,0 +1,38 @@
+name: Release TestPyPI
+
+#
+# Build and release package to TestPyPI using Poetry.
+#
+# - Can be used safely on all branches (even PRs).
+# - Will fail if the the version is already available on TestPyPI.
+#
+
+on:
+  workflow_dispatch:
+
+jobs:
+  primary:
+    name: Primary
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+
+      - name: Cache Poetry installation
+        uses: actions/cache@v3
+        with:
+          path: |
+            ~/.local/bin/poetry
+            ~/.local/share/pypoetry
+          key: poetry-installation-0
+
+      - name: Install Poetry
+        run: curl -sSL https://install.python-poetry.org | python -
+
+      - name: Configure Poetry repo for TestPyPI
+        run: poetry config repositories.test-pypi https://test.pypi.org/legacy/
+
+      - name: Publish to TestPyPI with Poetry
+        run: poetry publish --build -n -r test-pypi -u __token__ -p "$TOKEN"
+        env:
+          TOKEN: ${{ secrets.TESTPYPI_TOKEN }}