Enable CI/CD: dependabot.yml + tag-and-release

Author: ric-evans

.github/dependabot.yml

@@ -0,0 +1,10 @@
+version: 2
+updates:
+- package-ecosystem: pip
+  directory: /
+  schedule:
+    interval: weekly
+- package-ecosystem: github-actions
+  directory: /
+  schedule:
+    interval: weekly

.github/workflows/tests.yml

@@ -1,6 +1,10 @@
-name: tests
+name: ci/cd
 
-on: [ push ]
+on:
+  push:
+    # only on branch pushes
+    branches: [ '**' ]
+    tags-ignore: [ '**' ]
 
 jobs:
 
@@ -31,7 +35,7 @@ jobs:
         uses: actions/checkout@v4
         with:
           token: ${{ secrets.PERSONAL_ACCESS_TOKEN }}  # fyi, dependabot can't access normal secrets
-          ref: ${{ github.sha }}  # lock to triggered commit (github.ref is dynamic)
+          ref: ${{ github.ref }}  # dont lock to sha (action needs to push)
       - if: github.actor != 'dependabot[bot]'
         name: format and push
         run: |
@@ -70,3 +74,24 @@ jobs:
         run: |
           set -euo pipefail; echo "now: $(date -u +"%Y-%m-%dT%H:%M:%S.%3N")"
           pytest . -vvv --maxfail=1
+
+
+  ############################################################################
+  # TAG + RELEASE
+  #############################################################################
+
+  tag-and-release:
+    # only run on main/default
+    if: format('refs/heads/{0}', github.event.repository.default_branch) == github.ref
+    needs: [
+      mypy,
+      flake8,
+      code-format,
+      test,
+    ]
+    uses: WIPACrepo/wipac-dev-workflows/.github/workflows/tag-and-release.yml@main  # main -> dogfooding
+    permissions: # for GITHUB_TOKEN
+      contents: write
+    with:
+      project-type: gha-package
+      version-style: 'X.Y'