ci: Create scorecard.yml #729

	# This workflow will install Python dependencies, run tests and lint with a variety of Python versions
	# For more information see: https://docs.github.com/en/actions/automating-builds-and-tests/building-and-testing-python

	name: Python package
	permissions:
	contents: read

	on:
	push:
	branches: [ main ]
	pull_request:
	branches: [ main ]

	jobs:
	build:

	runs-on: ubuntu-latest
	strategy:
	fail-fast: false
	matrix:
	python-version: ["3.11", "3.12", "3.13", "3.14"]

	steps:
	- uses: actions/checkout@v5
	- name: Set up Python ${{ matrix.python-version }}
	uses: actions/setup-python@v6
	with:
	python-version: ${{ matrix.python-version }}
	- name: Install Hatch
	run: \|
	python -m pip install hatch==1.15.0
	- uses: webfactory/[email protected]
	with:
	ssh-private-key: ${{ secrets.SDK_KEY }}
	- name: Check for Python Language SDK branch override in PR
	if: github.event_name == 'pull_request'
	run: \|
	OVERRIDE=$(echo "${{ github.event.pull_request.body }}" \| grep -o 'PYTHON_LANGUAGE_SDK_BRANCH: [^[:space:]]*' \| cut -d' ' -f2 \|\| true)
	if [ ! -z "$OVERRIDE" ]; then
	echo "AWS_DURABLE_SDK_URL=git+ssh://[email protected]/aws/aws-durable-execution-sdk-python.git@$OVERRIDE" >> $GITHUB_ENV
	echo "Using Python Language SDK branch override: $OVERRIDE"
	else
	echo "Using default Python Language SDK (main branch)"
	fi
	- name: static analysis
	run: hatch fmt --check
	- name: type checking
	run: hatch run types:check
	- name: Run tests + coverage
	run: hatch run test:cov
	- name: Build distribution
	run: hatch build

Provide feedback