Improve workflows and linting.

.devcontainer/dev/devcontainer.json

@@ -16,7 +16,8 @@
   "overrideCommand": true,
   "mounts": [
     "source=/tmp/.X11-unix,target=/tmp/.X11-unix,type=bind,consistency=cached",
-    "source=/dev,target=/dev,type=bind,consistency=cached"
+    "source=/dev,target=/dev,type=bind,consistency=cached",
+    "source=${localEnv:HOME}/.ssh/signing.pub,target=${localEnv:HOME}/.ssh/signing.pub,type=bind,consistency=cached"
   ],
   "runArgs": [
     "--rm",

.github/actions/check-architecture/action.yml

@@ -0,0 +1,30 @@
+# SPDX-FileCopyrightText: Alliander N. V.
+#
+# SPDX-License-Identifier: Apache-2.0
+
+name: check-architecture
+description: Check if the expected system architecture matches the actual architecture.
+inputs:
+  expected:
+    description: "The expected architecture."
+    required: true
+
+runs:
+  using: "composite"
+  steps:
+    - name: Check architecture
+      shell: bash
+      run: |
+        ARCHITECTURE="$(uname -m)"
+
+        EXPECT_ARM=0; [[ "${EXPECTED}" == *"arm"* ]] && EXPECT_ARM=1
+        IS_ARM=0; [[ "$ARCHITECTURE" == *"arm"* ]] && IS_ARM=1
+
+        if [[ $EXPECT_ARM == $IS_ARM ]]; then
+            echo "The expected architecture (${EXPECTED}) matches the actual architecture ($ARCHITECTURE)."
+        else
+            echo "Architecture mismatch: expected ${EXPECTED}, while actual architecture is $ARCHITECTURE."
+            exit 1
+        fi
+      env:
+        EXPECTED: ${{ inputs.expected }}

.github/actions/create-manifest/action.yml

@@ -32,14 +32,17 @@ runs:
     - name: Create manifest for ${{ inputs.component }}
       shell: bash
       run: |
-        echo '${{ inputs.components }}' | yq -r '.[]' | while read -r component;
+        echo '${COMPONENTS}' | yq -r '.[]' | while read -r component;
         do
           echo "Creating manifest for: $component"
 
           REPOSITORY=$(yq .$component.repository alliander_robotics/components.yml)
 
           docker buildx imagetools create -t \
-          $REPOSITORY:${{ inputs.tag }} \
-          $REPOSITORY:${{ inputs.tag }}-amd64 \
-          $REPOSITORY:${{ inputs.tag }}-arm64
+          $REPOSITORY:${TAG} \
+          $REPOSITORY:${TAG}-amd64 \
+          $REPOSITORY:${TAG}-arm64
         done
+      env:
+        COMPONENTS: ${{ inputs.components }}
+        TAG: ${{ inputs.tag }}

.github/actions/deploy-image/action.yml

@@ -36,18 +36,22 @@ runs:
       shell: bash
       id: arch
       run: |
-        if [[ "${{ inputs.runner }}" == *"-arm"* ]]; then
+        if [[ "${RUNNER}" == *"-arm"* ]]; then
           echo "arch=arm64" >> $GITHUB_OUTPUT
         else
           echo "arch=amd64" >> $GITHUB_OUTPUT
         fi
+      env:
+        RUNNER: ${{ inputs.runner }}
     - name: Get variables for ${{ inputs.component }}
       shell: bash
       id: variables
       run: |
-        echo "BASE_IMAGE=$(yq .${{ inputs.component }}.base_image alliander_robotics/components.yml)" >> $GITHUB_OUTPUT
-        echo "REPOSITORY=$(yq .${{ inputs.component }}.repository alliander_robotics/components.yml)" >> $GITHUB_OUTPUT
-        echo "DOCKERFILE=alliander_robotics/$(yq .${{ inputs.component }}.dockerfile alliander_robotics/components.yml)" >> $GITHUB_OUTPUT
+        echo "BASE_IMAGE=$(yq .${COMPONENT}.base_image alliander_robotics/components.yml)" >> $GITHUB_OUTPUT
+        echo "REPOSITORY=$(yq .${COMPONENT}.repository alliander_robotics/components.yml)" >> $GITHUB_OUTPUT
+        echo "DOCKERFILE=alliander_robotics/$(yq .${COMPONENT}.dockerfile alliander_robotics/components.yml)" >> $GITHUB_OUTPUT
+      env:
+        COMPONENT: ${{ inputs.component }}
     - name: Setup Docker Buildx
       uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
     - name: Docker login

.github/actions/free-disk-space/action.yml

@@ -136,7 +136,7 @@ runs:
 
         # Option: Remove Android library
 
-        if [[ ${{ inputs.android }} == 'true' ]]; then
+        if [[ ${INPUTS_ANDROID} == 'true' ]]; then
           BEFORE=$(getAvailableSpace)
 
           sudo rm -rf /usr/local/lib/android || true
@@ -148,7 +148,7 @@ runs:
 
         # Option: Remove .NET runtime
 
-        if [[ ${{ inputs.dotnet }} == 'true' ]]; then
+        if [[ ${INPUTS_DOTNET} == 'true' ]]; then
           BEFORE=$(getAvailableSpace)
 
           # https://github.community/t/bigger-github-hosted-runners-disk-space/17267/11
@@ -161,7 +161,7 @@ runs:
 
         # Option: Remove Haskell runtime
 
-        if [[ ${{ inputs.haskell }} == 'true' ]]; then
+        if [[ ${INPUTS_HASKELL} == 'true' ]]; then
           BEFORE=$(getAvailableSpace)
 
           sudo rm -rf /opt/ghc || true
@@ -175,7 +175,7 @@ runs:
         # Option: Remove large packages
         # REF: https://github.com/apache/flink/blob/master/tools/azure-pipelines/free_disk_space.sh
 
-        if [[ ${{ inputs.large-packages }} == 'true' ]]; then
+        if [[ ${INPUTS_LARGE_PACKAGES} == 'true' ]]; then
           BEFORE=$(getAvailableSpace)
 
           sudo apt-get remove -y '^aspnetcore-.*' || echo "::warning::The command [sudo apt-get remove -y '^aspnetcore-.*'] failed to complete successfully. Proceeding..."
@@ -197,7 +197,7 @@ runs:
 
         # Option: Remove Docker images
 
-        if [[ ${{ inputs.docker-images }} == 'true' ]]; then
+        if [[ ${INPUTS_DOCKER_IMAGES} == 'true' ]]; then
           BEFORE=$(getAvailableSpace)
 
           sudo docker image prune --all --force || true
@@ -210,7 +210,7 @@ runs:
         # Option: Remove tool cache
         # REF: https://github.com/actions/virtual-environments/issues/2875#issuecomment-1163392159
 
-        if [[ ${{ inputs.tool-cache }} == 'true' ]]; then
+        if [[ ${INPUTS_TOOL_CACHE} == 'true' ]]; then
           BEFORE=$(getAvailableSpace)
 
           sudo rm -rf "$AGENT_TOOLSDIRECTORY" || true
@@ -222,7 +222,7 @@ runs:
 
         # Option: Remove Swap storage
 
-        if [[ ${{ inputs.swap-storage }} == 'true' ]]; then
+        if [[ ${INPUTS_SWAP_STORAGE} == 'true' ]]; then
           BEFORE=$(getAvailableSpace)
 
           sudo swapoff -a || true
@@ -251,3 +251,11 @@ runs:
         printSavedSpace $((AVAILABLE_ROOT_END - AVAILABLE_ROOT_INITIAL))
         echo "overall:"
         printSavedSpace $((AVAILABLE_END - AVAILABLE_INITIAL))
+      env:
+        INPUTS_ANDROID: ${{ inputs.android }}
+        INPUTS_DOTNET: ${{ inputs.dotnet }}
+        INPUTS_HASKELL: ${{ inputs.haskell }}
+        INPUTS_LARGE_PACKAGES: ${{ inputs.large-packages }}
+        INPUTS_DOCKER_IMAGES: ${{ inputs.docker-images }}
+        INPUTS_TOOL_CACHE: ${{ inputs.tool-cache }}
+        INPUTS_SWAP_STORAGE: ${{ inputs.swap-storage }}

.github/workflows/documentation.yml

@@ -4,6 +4,11 @@
 
 name: documentation
 
+permissions:
+  contents: read
+  issues: read
+  pull-requests: read
+
 on:
   push:
     branches: [main]
@@ -23,8 +28,9 @@ jobs:
         with:
           persist-credentials: false
           lfs: true
+      - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
       - name: Build HTML
-        uses: ammaraskar/sphinx-action@54e52bfb642e9b60ea5b6bcb05fe3f74b40d290a # v8.2.3
+        run: uv run start.py --documentation_build
       - name: Upload artifacts
         uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
         with:

.github/workflows/main.yml

@@ -4,6 +4,11 @@
 
 name: main
 
+permissions:
+  contents: read
+  issues: read
+  pull-requests: read
+
 on:
   push:
     branches: [main]
@@ -19,13 +24,10 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
-      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
-        with:
-          python-version: "3.12"
-          cache: "pip"
-      - run: pip install pyyaml requests
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
       - id: variables
-        run: python3 github.py --select-components all
+        run: uv run github.py --select-components all
 
   build-ubuntu:
     strategy:
@@ -35,6 +37,12 @@ jobs:
       group: managed
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - name: Check architecture
+        uses: ./.github/actions/check-architecture
+        with:
+          expected: ${{ matrix.runner }}
       - name: Deploy image
         uses: ./.github/actions/deploy-image
         with:
@@ -49,6 +57,8 @@ jobs:
       group: managed
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
       - name: Create manifest
         uses: ./.github/actions/create-manifest
         with:
@@ -67,6 +77,12 @@ jobs:
       group: managed
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - name: Check architecture
+        uses: ./.github/actions/check-architecture
+        with:
+          expected: ${{ matrix.runner }}
       - name: Deploy image
         uses: ./.github/actions/deploy-image
         with:
@@ -81,6 +97,8 @@ jobs:
       group: managed
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
       - name: Create manifest
         uses: ./.github/actions/create-manifest
         with:
@@ -96,6 +114,12 @@ jobs:
       group: managed
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - name: Check architecture
+        uses: ./.github/actions/check-architecture
+        with:
+          expected: ${{ matrix.runner }}
       - name: Deploy image
         uses: ./.github/actions/deploy-image
         with:
@@ -110,6 +134,8 @@ jobs:
       group: managed
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
       - name: Create manifest
         uses: ./.github/actions/create-manifest
         with:
@@ -128,6 +154,12 @@ jobs:
       group: managed
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - name: Check architecture
+        uses: ./.github/actions/check-architecture
+        with:
+          expected: ${{ matrix.runner }}
       - name: Deploy image
         uses: ./.github/actions/deploy-image
         with:
@@ -142,6 +174,8 @@ jobs:
       group: managed
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
       - name: Create manifest
         uses: ./.github/actions/create-manifest
         with:
@@ -152,19 +186,15 @@ jobs:
   linting:
     runs-on:
       group: managed
-    needs: [build-ubuntu-images-manifest, build-cuda-images-manifest]
-    if: always()
+    needs: [build-ubuntu-images, build-ubuntu-images-manifest, build-cuda-images, build-cuda-images-manifest]
+    if: ${{ !failure() && !cancelled() }}
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-      - name: Set up python3
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
-          python-version: "3.12"
-          cache: "pip"
-      - name: Install dependencies
-        run: pip install pyyaml mashumaro
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
       - name: Run linting in alliander_tests container
-        run: python3 start.py --linting
+        run: uv run start.py --linting
 
   test:
     strategy:
@@ -173,20 +203,20 @@ jobs:
         runner: [ubuntu-24.04, ubuntu-24.04-arm]
     runs-on:
       group: managed
-    needs: [build-ubuntu-images-manifest, build-cuda-images-manifest]
+    needs: [build-ubuntu-images, build-ubuntu-images-manifest, build-cuda-images, build-cuda-images-manifest]
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - name: Check architecture
+        uses: ./.github/actions/check-architecture
+        with:
+          expected: ${{ matrix.runner }}
       - name: Docker login
         uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_TOKEN }}
-      - name: Set up python3
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
-        with:
-          python-version: "3.12"
-          cache: "pip"
-      - name: Install dependencies
-        run: pip install pyyaml mashumaro
+      - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
       - name: Run tests in alliander_tests container
-        run: python3 start.py --pytest-no-nvidia --mode all
+        run: uv run start.py --pytest-no-nvidia --mode all

.github/workflows/pr-closed.yml

@@ -4,27 +4,33 @@
 
 name: pr-closed
 
+permissions:
+  contents: read
+  issues: read
+  pull-requests: read
+
 on:
   pull_request:
     branches: [main]
     types: [closed]
 
+env:
+  BRANCH_NAME: ${{ github.event.pull_request.head.ref }}
+
 jobs:
   remove-branch-images:
     runs-on:
       group: managed
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
-          python-version: "3.12"
-          cache: "pip"
-      - run: pip install pyyaml requests
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
       - name: Get token
         id: token
         run: |
           echo "TOKEN=$(curl -s -H "Content-Type: application/json" -X POST -d "{\"username\": \"${{ secrets.DOCKER_USERNAME }}\", \"password\": \"${{ secrets.DOCKER_TOKEN }}\"}" \
           https://hub.docker.com/v2/users/login/ \
           | jq -r .token)" >> $GITHUB_OUTPUT
       - name: Remove tags on Docker Hub
-        run: python3 github.py --remove-tags-on-docker-hub ${{ steps.token.outputs.TOKEN }} --branch ${{ github.event.pull_request.head.ref }}
+        run: uv run github.py --remove-tags-on-docker-hub ${{ steps.token.outputs.TOKEN }} --branch ${BRANCH_NAME}