Migrate release automation from scripts/release.py to reflex-release package

.github/scripts/publish/post_build.sh

@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+# Repository-specific artifact checks, run by publish.yml's collect job after
+# every build and before the approval gate. PACKAGE, VERSION, BUILD_DIR and
+# DIST_DIR are in the environment.
+set -euo pipefail
+
+: "${PACKAGE:?}"
+: "${DIST_DIR:?}"
+
+# The reflex wheel carries the generated .pyi stubs (scripts/hatch_build.py).
+# A build that silently produced none would ship a release with no type
+# information, so it must not reach the approver.
+if [ "$PACKAGE" = "reflex" ]; then
+  if unzip -l "$DIST_DIR"/*.whl | grep '\.pyi$'; then
+    echo "✓ .pyi files found in distribution"
+  else
+    echo "Error: No .pyi files found in wheel"
+    exit 1
+  fi
+fi

.github/workflows/auto_release_internal.yml

@@ -1,28 +1,27 @@
+# Generated by reflex-release; do not edit by hand.
+# Re-run `uv run --frozen --package reflex-release reflex-release sync` after changing [tool.reflex-release] in
+# pyproject.toml. `uv run --frozen --package reflex-release reflex-release sync --check` fails when this file drifts.
 name: Auto-release internal packages
 
-# Internal packages (no changelog, patch-bump versioning) release on every
-# push to main that touches them. Publishing goes through publish.yml with no
-# explicit version: the next patch version is computed from the newest tag
-# inside the per-package publish concurrency group, and the tag is only
-# pushed after a successful upload. Like every publish, the upload itself
-# waits for approval by the pypi environment's required reviewers.
+# Internal packages (no changelog, patch-bump versioning) release on every push
+# to main that touches them. Publishing goes through publish.yml
+# with no explicit version: the next patch version is computed from the newest
+# tag inside the per-package publish concurrency group, and the tag is only
+# pushed after a successful upload. Like every publish, the upload itself waits
+# for approval by the pypi environment's required reviewers.
 
 on:
   push:
-    branches: [main]
+    branches: ["main"]
     paths:
-      - "packages/reflex-components-internal/**"
-      - "packages/reflex-site-shared/**"
-      - ".github/workflows/auto_release_internal.yml"
+      - "packages/reflex-components-internal/src/**"
+      - "packages/reflex-site-shared/src/**"
   workflow_dispatch:
     inputs:
       package:
-        description: "Package to release"
+        description: "Internal package to release"
         required: true
-        type: choice
-        options:
-          - reflex-components-internal
-          - reflex-site-shared
+        type: string
 
 permissions:
   contents: read
@@ -35,15 +34,24 @@ jobs:
     outputs:
       packages: ${{ steps.detect.outputs.packages }}
     steps:
+      # The whole pushed range has to be reachable: the paths filter above
+      # matches every commit in the push, so detection must diff the same range
+      # rather than only the last commit.
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
-          fetch-depth: 2
+          fetch-depth: 0
           persist-credentials: false
+      - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        with:
+          version: "0.12.5"
+          python-version: "3.14.7"
       - id: detect
         env:
-          EVENT_NAME: ${{ github.event_name }}
           DISPATCH_PACKAGE: ${{ inputs.package }}
-        run: bash .github/scripts/auto_release_internal/detect.sh
+          BASE_SHA: ${{ github.event.before }}
+          HEAD_SHA: ${{ github.event.after }}
+        shell: bash
+        run: uv run --frozen --package reflex-release reflex-release detect-internal
 
   publish:
     needs: detect