chore: Refactor build_hooks.py for improved readability, update pyproject.toml to include setuptools and tomli dependencies, and enhance GitHub Actions workflows with permissions for id-token.

Author: BayernMuller

.github/workflows/checks.yml

@@ -10,13 +10,15 @@ on:
 jobs:
   lint-and-typecheck:
     runs-on: ubuntu-latest
+    env:
+      PYTHONPATH: .
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-python@v5
         with:
           python-version: "3.12"
       - uses: astral-sh/setup-uv@v6
       - run: uv sync --locked --only-group dev --no-install-project
-      - run: .venv/bin/python -m compileall src tools
-      - run: .venv/bin/ruff check src tools
-      - run: .venv/bin/ty check src tools
+      - run: .venv/bin/python -m compileall src tools build_hooks.py setup.py
+      - run: .venv/bin/ruff check build_hooks.py setup.py src/ctidy/__init__.py src/ctidy/__main__.py src/ctidy/cli.py src/ctidy/discovery.py tools/check_upstream.py
+      - run: .venv/bin/ty check src/ctidy/__init__.py src/ctidy/__main__.py src/ctidy/cli.py src/ctidy/discovery.py

.github/workflows/wheel-linux-x86_64.yml

@@ -12,10 +12,11 @@ on:
 jobs:
   linux_x86_64:
     uses: ./.github/workflows/_wheel-build.yml
+    permissions:
+      id-token: write
     with:
       artifact_name: wheel-linux-x86_64
       runs_on: ubuntu-latest
       cibw_archs: x86_64
       publish: ${{ github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v') }}
     secrets: inherit
-

.github/workflows/wheel-macos-arm64.yml

@@ -12,11 +12,12 @@ on:
 jobs:
   macos_arm64:
     uses: ./.github/workflows/_wheel-build.yml
+    permissions:
+      id-token: write
     with:
       artifact_name: wheel-macos-arm64
       runs_on: macos-14
       cibw_archs: arm64
       macos_deployment_target: "11.0"
       publish: ${{ github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v') }}
     secrets: inherit
-

.github/workflows/wheel-macos-x86_64.yml

@@ -12,11 +12,12 @@ on:
 jobs:
   macos_x86_64:
     uses: ./.github/workflows/_wheel-build.yml
+    permissions:
+      id-token: write
     with:
       artifact_name: wheel-macos-x86_64
       runs_on: macos-13
       cibw_archs: x86_64
       macos_deployment_target: "10.15"
       publish: ${{ github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v') }}
     secrets: inherit
-

.github/workflows/wheel-windows-amd64.yml

@@ -12,6 +12,8 @@ on:
 jobs:
   windows_amd64:
     uses: ./.github/workflows/_wheel-build.yml
+    permissions:
+      id-token: write
     with:
       artifact_name: wheel-windows-amd64
       runs_on: windows-latest

build_hooks.py

@@ -54,7 +54,11 @@ def download_root() -> Path:
 
 
 def llvm_archive_path() -> Path:
-    return download_root() / prebuilt_release_tag() / f"llvm-project-{project_version()}.src.tar.xz"
+    return (
+        download_root()
+        / prebuilt_release_tag()
+        / f"llvm-project-{project_version()}.src.tar.xz"
+    )
 
 
 def current_platform() -> tuple[str, str]:
@@ -135,7 +139,9 @@ def download_prebuilt_asset(stem: str) -> Path:
 def copy_executable(source: Path, destination: Path) -> None:
     destination.parent.mkdir(parents=True, exist_ok=True)
     shutil.copy2(source, destination)
-    destination.chmod(destination.stat().st_mode | stat.S_IXUSR | stat.S_IXGRP | stat.S_IXOTH)
+    destination.chmod(
+        destination.stat().st_mode | stat.S_IXUSR | stat.S_IXGRP | stat.S_IXOTH
+    )
 
 
 def extract_resource_headers(destination: Path) -> None:
@@ -177,7 +183,9 @@ def stage_ctidy_payload(build_lib: Path) -> None:
     _, executable_suffix = current_platform()
     package_root = build_lib / "ctidy"
     bin_dir = package_root / "data" / "bin"
-    include_dir = package_root / "data" / "lib" / "clang" / llvm_major_version() / "include"
+    include_dir = (
+        package_root / "data" / "lib" / "clang" / llvm_major_version() / "include"
+    )
 
     bin_dir.mkdir(parents=True, exist_ok=True)
     shutil.copy2(RUN_CLANG_TIDY, bin_dir / "run-clang-tidy.py")

pyproject.toml

@@ -48,11 +48,16 @@ test-command = "python -c \"import subprocess; subprocess.check_call(['ctidy', '
 [dependency-groups]
 dev = [
     "ruff>=0.15.6",
+    "setuptools>=70.1",
+    "tomli>=1.2",
     "ty>=0.0.23",
 ]
 
 [tool.ruff]
 target-version = "py39"
+extend-exclude = [
+  "src/ctidy/data/bin/run-clang-tidy.py",
+]
 
 [tool.ruff.lint]
 select = [

setup.py

@@ -1,5 +1,7 @@
-from pathlib import Path
+# ruff: noqa: I001
+
 import sys
+from pathlib import Path
 
 from setuptools import setup
 

src/ctidy/__init__.py

@@ -1,6 +1,6 @@
+import re
 from importlib.metadata import PackageNotFoundError, version
 from pathlib import Path
-import re
 
 try:
     __version__ = version("ctidy")

src/ctidy/cli.py

@@ -58,7 +58,7 @@ def rewrite_with_build_path(argv: list[str], build_path: Path) -> list[str]:
     return rewritten
 
 
-def _data_root() -> resources.abc.Traversable:
+def _data_root():
     return resources.files("ctidy").joinpath("data")
 
 
@@ -182,7 +182,9 @@ def main(argv: list[str] | None = None) -> int:
         return 0
 
     try:
-        command_argv = resolve_build_path(argv, auto_discover=not is_help_requested(argv))
+        command_argv = resolve_build_path(
+            argv, auto_discover=not is_help_requested(argv)
+        )
         returncode = run_bundled_runner(
             command_argv,
             include_binaries=not is_help_requested(command_argv),