chore(ci): Align GitHub workflows across Python projects

.github/workflows/_check_code.yaml

@@ -0,0 +1,30 @@
+name: Code checks
+
+on:
+  # Runs when manually triggered from the GitHub UI.
+  workflow_dispatch:
+
+  # Runs when invoked by another workflow.
+  workflow_call:
+
+jobs:
+  actions_lint_check:
+    name: Actions lint check
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+      - name: Run actionlint
+        uses: rhysd/[email protected]
+
+  lint_check:
+    name: Lint check
+    uses: apify/workflows/.github/workflows/python_lint_check.yaml@main
+    with:
+      python-versions: '["3.10", "3.11", "3.12", "3.13", "3.14"]'
+
+  type_check:
+    name: Type check
+    uses: apify/workflows/.github/workflows/python_type_check.yaml@main
+    with:
+      python-versions: '["3.10", "3.11", "3.12", "3.13", "3.14"]'

.github/workflows/_check_docs.yaml

@@ -0,0 +1,13 @@
+name: Doc checks
+
+on:
+  # Runs when manually triggered from the GitHub UI.
+  workflow_dispatch:
+
+  # Runs when invoked by another workflow.
+  workflow_call:
+
+jobs:
+  doc_checks:
+    name: Doc checks
+    uses: apify/workflows/.github/workflows/python_docs_check.yaml@main

.github/workflows/_async_docstrings_check.yaml → .github/workflows/_check_docstrings.yaml

@@ -1,14 +1,18 @@
-name: Async docstrings check
+name: Docstrings checks
 
 on:
+  # Runs when manually triggered from the GitHub UI.
+  workflow_dispatch:
+
+  # Runs when invoked by another workflow.
   workflow_call:
 
 env:
   PYTHON_VERSION: 3.14
 
 jobs:
-  async_docstring_check:
-    name: Async docstrings check
+  docstrings_checks:
+    name: Docstrings checks
     runs-on: ubuntu-latest
 
     steps:
@@ -28,5 +32,5 @@ jobs:
       - name: Install dependencies
         run: make install-dev
 
-      - name: Run async docstrings check
+      - name: Async docstrings check
         run: make check-async-docstrings

.github/workflows/build_and_deploy_docs.yaml → .github/workflows/_release_docs.yaml

@@ -1,17 +1,24 @@
-name: Build and deploy docs
+name: Doc release
 
 on:
-  push:
-    branches:
-      - master
+  # Runs when manually triggered from the GitHub UI.
   workflow_dispatch:
 
+  # Runs when invoked by another workflow.
+  workflow_call:
+    inputs:
+      ref:
+        required: true
+        type: string
+
 env:
-  NODE_VERSION: 20
+  NODE_VERSION: 22
   PYTHON_VERSION: 3.14
+  CHECKOUT_REF: ${{ github.event_name == 'workflow_call' && inputs.ref || github.ref }}
 
 jobs:
-  build_and_deploy_docs:
+  release_docs:
+    name: Doc release
     environment:
       name: github-pages
     permissions:
@@ -25,6 +32,7 @@ jobs:
         uses: actions/checkout@v6
         with:
           token: ${{ secrets.APIFY_SERVICE_ACCOUNT_GITHUB_TOKEN }}
+          ref: ${{ env.CHECKOUT_REF }}
 
       - name: Set up Node
         uses: actions/setup-node@v6
@@ -67,6 +75,8 @@ jobs:
 
       - name: Build Docusaurus docs
         run: make build-docs
+        env:
+          APIFY_SIGNING_TOKEN: ${{ secrets.APIFY_SIGNING_TOKEN }}
 
       - name: Set up GitHub Pages
         uses: actions/configure-pages@v5

.github/workflows/_tests.yaml

@@ -0,0 +1,29 @@
+name: Tests
+
+on:
+  # Runs when manually triggered from the GitHub UI.
+  workflow_dispatch:
+
+  # Runs when invoked by another workflow.
+  workflow_call:
+
+jobs:
+  unit_tests:
+    name: Unit tests
+    uses: apify/workflows/.github/workflows/python_unit_tests.yaml@main
+    secrets: inherit
+    with:
+      python-versions: '["3.10", "3.11", "3.12", "3.13", "3.14"]'
+      operating-systems: '["ubuntu-latest", "windows-latest"]'
+      python-version-for-codecov: "3.14"
+      operating-system-for-codecov: ubuntu-latest
+
+  integration_tests:
+    name: Integration tests
+    uses: apify/workflows/.github/workflows/python_integration_tests.yaml@main
+    secrets: inherit
+    with:
+      python-versions: '["3.10", "3.14"]'
+      operating-systems: '["ubuntu-latest"]'
+      python-version-for-codecov: "3.14"
+      operating-system-for-codecov: ubuntu-latest

.github/workflows/manual_release_stable.yaml

@@ -0,0 +1,96 @@
+name: Stable release
+
+on:
+  # Runs when manually triggered from the GitHub UI, with options to specify the type of release.
+  workflow_dispatch:
+    inputs:
+      release_type:
+        description: Release type
+        required: true
+        type: choice
+        default: auto
+        options:
+          - auto
+          - custom
+          - patch
+          - minor
+          - major
+      custom_version:
+        description: The custom version to bump to (only for "custom" type)
+        required: false
+        type: string
+        default: ""
+
+concurrency:
+  group: release
+  cancel-in-progress: false
+
+jobs:
+  code_checks:
+    name: Code checks
+    uses: ./.github/workflows/_check_code.yaml
+
+  release_prepare:
+    name: Release prepare
+    needs: [code_checks]
+    runs-on: ubuntu-latest
+    outputs:
+      version_number: ${{ steps.release_prepare.outputs.version_number }}
+      tag_name: ${{ steps.release_prepare.outputs.tag_name }}
+      changelog: ${{ steps.release_prepare.outputs.changelog }}
+      release_notes: ${{ steps.release_prepare.outputs.release_notes }}
+    steps:
+      - uses: apify/workflows/git-cliff-release@main
+        name: Release prepare
+        id: release_prepare
+        with:
+          release_type: ${{ inputs.release_type }}
+          custom_version: ${{ inputs.custom_version }}
+          existing_changelog_path: CHANGELOG.md
+
+  changelog_update:
+    name: Changelog update
+    needs: [release_prepare]
+    uses: apify/workflows/.github/workflows/python_bump_and_update_changelog.yaml@main
+    with:
+      version_number: ${{ needs.release_prepare.outputs.version_number }}
+      changelog: ${{ needs.release_prepare.outputs.changelog }}
+    secrets: inherit
+
+  github_release:
+    name: GitHub release
+    needs: [release_prepare, changelog_update]
+    runs-on: ubuntu-latest
+    env:
+      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+    steps:
+      - name: GitHub release
+        uses: softprops/action-gh-release@v2
+        with:
+          tag_name: ${{ needs.release_prepare.outputs.tag_name }}
+          name: ${{ needs.release_prepare.outputs.version_number }}
+          target_commitish: ${{ needs.changelog_update.outputs.changelog_commitish }}
+          body: ${{ needs.release_prepare.outputs.release_notes }}
+
+  pypi_publish:
+    name: PyPI publish
+    needs: [release_prepare, changelog_update]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      id-token: write # Required for OIDC authentication.
+    environment:
+      name: pypi
+      url: https://pypi.org/project/apify-client
+    steps:
+      - name: Prepare distribution
+        uses: apify/workflows/prepare-pypi-distribution@main
+        with:
+          package_name: apify-client
+          is_prerelease: ""
+          version_number: ${{ needs.release_prepare.outputs.version_number }}
+          ref: ${{ needs.changelog_update.outputs.changelog_commitish }}
+
+      # Publishes the package to PyPI using PyPA official GitHub action with OIDC authentication.
+      - name: Publish package to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1

.github/workflows/update_new_issue.yaml → .github/workflows/on_issue.yaml

@@ -1,13 +1,14 @@
-name: Update new issue
+name: CI (issue)
 
 on:
+  # Runs when a new issue is opened.
   issues:
     types:
       - opened
 
 jobs:
   label_issues:
-    name: Label issues
+    name: Add labels
     runs-on: ubuntu-latest
     permissions:
       issues: write

.github/workflows/on_master.yaml

@@ -0,0 +1,101 @@
+name: CI (master)
+
+on:
+  push:
+    branches:
+      - master
+    tags-ignore:
+      - "**" # Ignore all tags to avoid duplicate executions triggered by tag pushes.
+
+concurrency:
+  group: release
+  cancel-in-progress: false
+
+jobs:
+  doc_checks:
+    name: Doc checks
+    uses: ./.github/workflows/_check_docs.yaml
+
+  doc_release:
+    # Skip this for non-docs commits and forks.
+    if: "startsWith(github.event.head_commit.message, 'docs') && startsWith(github.repository, 'apify/')"
+    name: Doc release
+    needs: [doc_checks]
+    uses: ./.github/workflows/_release_docs.yaml
+    with:
+      # Use the same ref as the one that triggered the workflow.
+      ref: ${{ github.ref }}
+    secrets: inherit
+
+  code_checks:
+    name: Code checks
+    uses: ./.github/workflows/_check_code.yaml
+
+  docstrings_checks:
+    name: Docstrings checks
+    uses: ./.github/workflows/_check_docstrings.yaml
+
+  tests:
+    # Skip this for "ci" and "docs" commits.
+    if: "!startsWith(github.event.head_commit.message, 'ci') && !startsWith(github.event.head_commit.message, 'docs')"
+    name: Tests
+    uses: ./.github/workflows/_tests.yaml
+    secrets: inherit
+
+  release_prepare:
+    # Skip this for "ci", "docs" and "test" commits and for forks.
+    if: "!startsWith(github.event.head_commit.message, 'ci') && !startsWith(github.event.head_commit.message, 'docs') && !startsWith(github.event.head_commit.message, 'test') && startsWith(github.repository, 'apify/')"
+    name: Release prepare
+    needs: [code_checks, docstrings_checks, tests]
+    runs-on: ubuntu-latest
+    outputs:
+      version_number: ${{ steps.release_prepare.outputs.version_number }}
+      tag_name: ${{ steps.release_prepare.outputs.tag_name }}
+      changelog: ${{ steps.release_prepare.outputs.changelog }}
+    steps:
+      - uses: apify/workflows/git-cliff-release@main
+        id: release_prepare
+        name: Release prepare
+        with:
+          release_type: prerelease
+          existing_changelog_path: CHANGELOG.md
+
+  changelog_update:
+    name: Changelog update
+    needs: [release_prepare]
+    uses: apify/workflows/.github/workflows/python_bump_and_update_changelog.yaml@main
+    with:
+      version_number: ${{ needs.release_prepare.outputs.version_number }}
+      changelog: ${{ needs.release_prepare.outputs.changelog }}
+    secrets: inherit
+
+  pypi_publish:
+    name: PyPI publish
+    needs: [release_prepare, changelog_update]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      id-token: write # Required for OIDC authentication.
+    environment:
+      name: pypi
+      url: https://pypi.org/project/apify-client
+    steps:
+      - name: Prepare distribution
+        uses: apify/workflows/prepare-pypi-distribution@main
+        with:
+          package_name: apify-client
+          is_prerelease: "yes"
+          version_number: ${{ needs.release_prepare.outputs.version_number }}
+          ref: ${{ needs.changelog_update.outputs.changelog_commitish }}
+
+      - name: Publish package to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+
+  doc_release_post_publish:
+    name: Doc release post publish
+    needs: [changelog_update, pypi_publish]
+    uses: ./.github/workflows/_release_docs.yaml
+    with:
+      # Use the ref from the changelog update to include the updated changelog.
+      ref: ${{ needs.changelog_update.outputs.changelog_commitish }}
+    secrets: inherit