ci: release prep

.github/CODEOWNERS

@@ -1,3 +1 @@
-* @dylanm-ansys
-* @lukequeenan-ansys
-* @gregbaethge
+* @dylanm-ansys @lukequeenan-ansys @gregbaethge

.github/dependabot.yml

@@ -0,0 +1,33 @@
+version: 2
+updates:
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "daily"
+    cooldown:
+      default-days: 5 # Fallback cooldown if no specific rule applies
+      semver-major-days: 30 # Cooldown for major version updates
+      semver-minor-days: 7 # Cooldown for minor version updates
+      semver-patch-days: 3 # Cooldown for patch updates
+    labels:
+      - "maintenance"
+      - "dependencies"
+    commit-message:
+      prefix: "build"
+    groups:
+      pip-deps:
+        patterns:
+          - "*"
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    labels:
+      - "maintenance"
+    commit-message:
+      prefix: "ci"
+    groups:
+      actions:
+        patterns:
+          - "*"

.github/workflows/ci_cd_main.yml

@@ -0,0 +1,59 @@
+name: main
+
+on:
+  push:
+    branches:
+      - main
+
+env:
+  MAIN_PYTHON_VERSION: '3.13'
+  LIBRARY_NAME: 'ansys-lumerical-core'
+  DOCUMENTATION_CNAME: 'lumerical.docs.pyansys.com'
+
+permissions:
+  contents: read
+  pull-requests: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  # vulnerabilities:
+  #   name: Vulnerabilities
+  #   runs-on: ubuntu-latest
+  #   steps:
+  #     - name: PyAnsys Vulnerability check (on main)
+  #       uses: ansys/actions/check-vulnerabilities@v10
+  #       with:
+  #         python-version: ${{ env.MAIN_PYTHON_VERSION }}
+  #         python-package-name: ${{ env.LIBRARY_NAME }}
+  #         token: ${{ secrets.PYANSYS_CI_BOT_TOKEN }}
+  #         dev-mode: false
+
+  doc-build:
+    name: "Doc build"
+    runs-on: ubuntu-latest
+    steps:
+      - uses: ansys/actions/doc-build@v10
+        with:
+          skip-install: true
+          python-version: ${{ env.MAIN_PYTHON_VERSION }}
+          use-python-cache: false
+          needs-quarto: true
+
+  doc-deploy-dev:
+    name: Upload dev documentation
+    if: github.ref == 'refs/heads/main'
+    needs: doc-build
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - name: Deploy the latest documentation
+        uses: ansys/actions/doc-deploy-dev@v10
+        with:
+          cname: ${{ env.DOCUMENTATION_CNAME }}
+          token: ${{ secrets.PYANSYS_CI_BOT_TOKEN }}
+          bot-user: ${{ secrets.PYANSYS_CI_BOT_USERNAME }}
+          bot-email: ${{ secrets.PYANSYS_CI_BOT_EMAIL }}

.github/workflows/ci_cd_pr.yml

@@ -6,7 +6,6 @@ on:
 env:
   MAIN_PYTHON_VERSION: '3.13'
   LIBRARY_NAME: 'ansys-lumerical-core'
-  PIP_EXTRA_INDEX_URL: 'https://${{ secrets.PYANSYS_PYPI_PRIVATE_PAT }}@pkgs.dev.azure.com/pyansys/_packaging/pyansys/pypi/simple/'
   DOCUMENTATION_CNAME: 'lumerical.docs.pyansys.com'
 
 permissions:
@@ -23,24 +22,24 @@ jobs:
     name: "Actions Security"
     runs-on: ubuntu-latest
     steps:
-      - uses: ansys/actions/check-actions-security@c2fa7c93f6883114e0e643599431b33d29f0b13f # v10.1.4
+      - uses: ansys/actions/check-actions-security@v10
         with:
           generate-summary: true
           token: ${{ secrets.GITHUB_TOKEN }}
           auditing-level: "high"
+          trust-ansys-actions: true
 
   # vulnerabilities:
   #   name: Vulnerabilities
   #   runs-on: ubuntu-latest
   #   steps:
-  #     - name: PyAnsys Vulnerability check (on main)
-  #       if: github.ref == 'refs/heads/main'
-  #       uses: ansys/actions/check-vulnerabilities@v10.1
+  #     - name: PyAnsys Vulnerability check (on PR)
+  #       uses: ansys/actions/check-vulnerabilities@v10
   #       with:
   #         python-version: ${{ env.MAIN_PYTHON_VERSION }}
   #         python-package-name: ${{ env.LIBRARY_NAME }}
   #         token: ${{ secrets.PYANSYS_CI_BOT_TOKEN }}
-  #         dev-mode: ${{ github.ref != 'refs/heads/main' }}
+  #         dev-mode: true
 
   update-changelog:
     name: "Update CHANGELOG (on release)"
@@ -50,7 +49,7 @@ jobs:
       contents: write
       pull-requests: write
     steps:
-      - uses: ansys/actions/doc-deploy-changelog@v10.1
+      - uses: ansys/actions/doc-deploy-changelog@v10
         with:
           bot-user: ${{ secrets.PYANSYS_CI_BOT_USERNAME }}
           bot-email: ${{ secrets.PYANSYS_CI_BOT_EMAIL }}
@@ -109,7 +108,7 @@ jobs:
     name: "Run commit style checks"
     runs-on: ubuntu-latest
     steps:
-      - uses: ansys/actions/check-pr-title@v10.1
+      - uses: ansys/actions/check-pr-title@v10
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
 
@@ -128,7 +127,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: doc-style
     steps:
-      - uses: ansys/actions/doc-build@v10.1
+      - uses: ansys/actions/doc-build@v10
         with:
           skip-install: true
           python-version: ${{ env.MAIN_PYTHON_VERSION }}
@@ -141,7 +140,7 @@ jobs:
     needs: doc-build
     if: always() && (needs.doc-build.result == 'success' || needs.doc-build.result == 'skipped')
     steps:
-      - uses: ansys/actions/doc-deploy-pr@v10.1
+      - uses: ansys/actions/doc-deploy-pr@v10
         with:
           cname: ${{ env.DOCUMENTATION_CNAME }}
           token: ${{ secrets.PYANSYS_CI_BOT_TOKEN }}
@@ -275,3 +274,20 @@ jobs:
           docker stop ${DOCKER_CONTAINER_LUMERICAL_UNIFIED_NAME}
           docker logs ${DOCKER_CONTAINER_LUMERICAL_UNIFIED_NAME}
           docker rm ${DOCKER_CONTAINER_LUMERICAL_UNIFIED_NAME}
+
+  package:
+    name: Package library
+    needs: [tests, doc-build]
+    runs-on: ubuntu-latest
+    permissions:
+      attestations: write
+      contents: read
+      id-token: write
+    steps:
+      - name: Build library source and wheel artifacts
+        uses: ansys/actions/build-library@v10
+        with:
+          library-name: ${{ env.LIBRARY_NAME }}
+          python-version: ${{ env.MAIN_PYTHON_VERSION }}
+          attest-provenance: true
+