Skip to content

Commit 855c11f

Browse files
lwjohnst86lwjohnst86
authored
ci: 👷 update workflows from t-squared, improve releasing (#267)
# Description Improves/resolves issues with the release workflow. Comes from t-squared template. Closes #209, closes #261 No review needed.
1 parent b2d1b34 commit 855c11f

15 files changed

Lines changed: 1286 additions & 217 deletions

‎.config/cliff.toml‎

Lines changed: 130 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,130 @@
1+
[remote]
2+
# Strictly don't connect to the internet to generate the changelog.
3+
offline = false
4+
5+
[remote.github]
6+
owner = "seedcase-project"
7+
repo = "template-python-package"
8+
9+
[changelog]
10+
# A Tera template to be rendered for each release in the changelog.
11+
header = """
12+
# Changelog
13+
14+
Since we follow
15+
[Conventional Commits](https://decisions.seedcase-project.org/why-conventional-commits/)
16+
when writing commit messages, we're able to automatically create formal
17+
"releases" of the template based on the commit messages. Releases in the
18+
context of template are when changes occur to the `template/` files or
19+
to the `copier.yaml` files. The releases are also published to Zenodo
20+
for easier discovery, archival, and citation purposes. We use
21+
[Cocogitto](https://decisions.seedcase-project.org/why-semantic-release-with-cocogitto/)
22+
to be able to automatically create these releases, which uses
23+
[SemVar](https://semverdoc.org) as the version numbering scheme,
24+
and [Git Cliff](https://decisions.seedcase-project.org/why-changelog-with-git-cliff/)
25+
to generate the changelog based on the commit messages.
26+
27+
Because releases are created based on commit messages, a new release is
28+
created quite often---sometimes several times in a day. This also means
29+
that any individual release will not have many changes within it. Below
30+
is a list of the releases we've made so far, along with what was changed
31+
within each release.
32+
33+
Commits from bots, like `dependabot` or `pre-commit-ci`, are not included in
34+
the changelog.
35+
"""
36+
37+
body = """
38+
{%- macro remote_url() -%}
39+
https://github.com/{{ remote.github.owner }}/{{ remote.github.repo }}
40+
{%- endmacro -%}
41+
42+
{% macro print_commit(commit) -%}
43+
- {% if commit.scope %}*({{ commit.scope }})* {% endif %}\
44+
{% if commit.breaking %}**breaking** {% endif %}\
45+
{{ commit.message | upper_first }} \
46+
{% if commit.remote.username %} by \
47+
{% if commit.remote.username is containing("[bot]") %}
48+
`@{{ commit.remote.username }}`\
49+
{% else %}\
50+
[`@{{ commit.remote.username }}`](https://github.com/{{ commit.remote.username }})\
51+
{% endif %}\
52+
{% endif %} \
53+
([{{ commit.id | truncate(length=7, end="") }}]({{ self::remote_url() }}/commit/{{ commit.id }}))\
54+
{% endmacro -%}
55+
56+
{% if version %}\
57+
{% if previous.version %}\
58+
## [{{ version | trim_start_matches(pat="v") }}]\
59+
({{ self::remote_url() }}/compare/{{ previous.version }}..{{ version }}) - {{ timestamp | date(format="%Y-%m-%d") }}
60+
{% else %}\
61+
## [{{ version | trim_start_matches(pat="v") }}] - {{ timestamp | date(format="%Y-%m-%d") }}
62+
{% endif %}\
63+
{% else %}\
64+
## [unreleased]
65+
{% endif %}\
66+
67+
{% for group, commits in commits | group_by(attribute="group") %}
68+
### {{ group | striptags | trim | upper_first }}
69+
{% for commit in commits
70+
| filter(attribute="scope")
71+
| sort(attribute="scope") %}
72+
{{ self::print_commit(commit=commit) }}
73+
{%- endfor %}
74+
{% for commit in commits %}
75+
{%- if not commit.scope -%}
76+
{{ self::print_commit(commit=commit) }}
77+
{% endif -%}
78+
{% endfor -%}
79+
{% endfor -%}
80+
81+
{%- if github -%}
82+
{% if github.contributors | filter(attribute="is_first_time", value=true) | length != 0 %}
83+
### ❤️ New contributors
84+
{% endif %}\
85+
{% for contributor in github.contributors | filter(attribute="is_first_time", value=true) %}
86+
{% if contributor.username is containing("[bot]") %}
87+
- `@{{ contributor.username }}` started making automated contributions\
88+
{% else %}\
89+
- [`@{{ contributor.username }}`](https://github.com/{{ contributor.username }}) made their first contribution
90+
{%- if contributor.pr_number %} in \
91+
[#{{ contributor.pr_number }}]({{ self::remote_url() }}/pull/{{ contributor.pr_number }})\
92+
{%- endif %}
93+
{%- endif %}\
94+
{%- endfor -%}
95+
{%- endif %}
96+
97+
"""
98+
99+
# Remove leading and trailing whitespaces from the changelog's body.
100+
trim = true
101+
output = "CHANGELOG.md"
102+
103+
[git]
104+
commit_preprocessors = [
105+
# Replace pull request numbers with links to GitHub.
106+
{ pattern = '\((\w+\s)?#([0-9]+)\)', replace = "[#${2}](https://github.com/seedcase-project/template-python-package/pull/${2})" },
107+
# Check spelling of the commit message using https://github.com/crate-ci/typos.
108+
# If the spelling is incorrect, it will be fixed automatically.
109+
{ pattern = '.*', replace_command = 'uvx typos --write-changes -' },
110+
# Remove gitmoji, both actual UTF emoji and :emoji:
111+
{ pattern = ' *(:\w+:|[\p{Emoji_Presentation}\p{Extended_Pictographic}](?:\u{FE0F})?\u{200D}?) *', replace = "" },
112+
]
113+
114+
commit_parsers = [
115+
# Don't include commits from bots.
116+
{ field = "author.name", pattern = ".*(dependabot|github-actions|pre-commit-ci).*", skip = true },
117+
# Don't include the version update commits.
118+
{ message = ".*update version", skip = true },
119+
{ message = "^feat", group = "<!-- 0 -->✨ Features" },
120+
{ message = "^fix", group = "<!-- 1 -->🐛 Fixes" },
121+
{ message = "^refactor", group = "<!-- 2 -->♻️ Refactor" },
122+
{ message = "^docs", group = "<!-- 3 -->📝 Documentation" },
123+
{ message = "^perf", group = "<!-- 4 -->⚡ Performance" },
124+
{ message = "^style", group = "<!-- 5 -->💄 Styling" },
125+
{ message = "^test", group = "<!-- 6 -->🧪 Tests" },
126+
{ message = "^ci", group = "<!-- 7 -->👷 CI/CD" },
127+
{ message = "^chore|^build", group = "<!-- 8 -->👩‍💻 Miscellaneous" },
128+
{ message = "^revert", group = "<!-- 9 -->⏪ Revert" },
129+
{ message = ".*", skip = true },
130+
]

‎.copier-answers.yml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
# Changes here will be overwritten by Copier; NEVER EDIT MANUALLY
2+
_commit: 0.7.0
3+
_src_path: gh:seedcase-project/t-squared
4+
for_seedcase: true
5+
github_repo: template-python-package
6+
github_user: seedcase-project
7+
hosting_provider: netlify

‎.cz.toml‎

Lines changed: 0 additions & 8 deletions
This file was deleted.

‎.github/workflows/add-to-project.yml‎

Lines changed: 36 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -14,14 +14,43 @@ on:
1414
# Limit token permissions for security
1515
permissions: read-all
1616

17+
env:
18+
BOARD_NUMBER: "24"
19+
1720
jobs:
1821
add-to-project:
19-
uses: seedcase-project/.github/.github/workflows/reusable-add-to-project.yml@main
22+
runs-on: ubuntu-latest
2023
permissions:
2124
pull-requests: write
22-
with:
23-
board-number: 18
24-
app-id: ${{ vars.ADD_TO_BOARD_APP_ID }}
25-
secrets:
26-
add-to-board-token: ${{ secrets.ADD_TO_BOARD }}
27-
gh-token: ${{ secrets.GITHUB_TOKEN }}
25+
steps:
26+
# This is a useful security step to check for unexpected outbound calls from the runner,
27+
# which could indicate a compromised token or runner.
28+
- name: Harden the runner (Audit all outbound calls)
29+
uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
30+
with:
31+
egress-policy: audit
32+
33+
# Using this security pattern for GitHub Apps is recommended by GitHub and ensures that
34+
# the token is only available for a short time and has limited permissions. Check out
35+
# <https://guidebook.seedcase-project.org/operations/security> for more details.
36+
- uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
37+
id: app-token
38+
with:
39+
client-id: ${{ vars.ADD_TO_BOARD_APP_ID }}
40+
private-key: ${{ secrets.ADD_TO_BOARD }}
41+
42+
- name: Add issue or PR to project board
43+
uses: actions/add-to-project@244f685bbc3b7adfa8466e08b698b5577571133e # v1.0.2
44+
with:
45+
project-url: "https://github.com/orgs/${{ github.repository_owner }}/projects/${{ env.BOARD_NUMBER }}"
46+
github-token: ${{ steps.app-token.outputs.token }}
47+
48+
- name: Assign PR to creator
49+
if: ${{ github.event_name == 'pull_request' }}
50+
run: |
51+
gh pr edit $PR --add-assignee $AUTHOR --repo $REPO
52+
env:
53+
REPO: ${{ github.repository }}
54+
AUTHOR: ${{ github.event.pull_request.user.login }}
55+
PR: ${{ github.event.pull_request.html_url }}
56+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/build-website.yml‎

Lines changed: 27 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,30 @@ on:
99
permissions: read-all
1010

1111
jobs:
12-
build-website:
13-
uses: seedcase-project/.github/.github/workflows/reusable-build-docs.yml@main
14-
secrets:
15-
netlify-token: ${{ secrets.NETLIFY_AUTH_TOKEN }}
12+
build-deploy:
13+
runs-on: ubuntu-latest
14+
# Stop builds from running more than one at a time, to save resources and also
15+
# to limit conflicts when uploading to the hosting provider.
16+
concurrency:
17+
group: build-website-group
18+
cancel-in-progress: true
19+
20+
steps:
21+
# This is a useful security step to check for unexpected outbound calls from the runner,
22+
# which could indicate a compromised token or runner.
23+
- name: Harden the runner (Audit all outbound calls)
24+
uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
25+
with:
26+
egress-policy: audit
27+
28+
- name: Check out repository
29+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
30+
31+
- name: Set up Quarto
32+
uses: quarto-dev/quarto-actions/setup@8a96df13519ee81fd526f2dfca5962811136661b # v2.2.0
33+
34+
- name: Render and publish to Netlify
35+
uses: quarto-dev/quarto-actions/publish@8a96df13519ee81fd526f2dfca5962811136661b # v2.2.0
36+
with:
37+
target: netlify
38+
NETLIFY_AUTH_TOKEN: ${{ secrets.NETLIFY_AUTH_TOKEN }}

‎.github/workflows/checks.yml‎

Lines changed: 94 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
name: Checks
2+
3+
on: pull_request
4+
5+
permissions: read-all
6+
7+
jobs:
8+
check-template:
9+
runs-on: ubuntu-latest
10+
steps:
11+
# This is a useful security step to check for unexpected outbound calls from the runner,
12+
# which could indicate a compromised token or runner.
13+
- name: Harden the runner (Audit all outbound calls)
14+
uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
15+
with:
16+
egress-policy: audit
17+
18+
- name: Checkout repository
19+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
20+
21+
- name: Set up uv
22+
uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
23+
with:
24+
enable-cache: true
25+
26+
- name: Install justfile
27+
run: uv tool install rust-just
28+
29+
# Set this user so that the checks create Git commits.
30+
- name: Set bot user
31+
run: |
32+
git config --global user.name "github-actions[bot]"
33+
git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
34+
35+
- name: Check template creation
36+
run: just test-all
37+
38+
check-typos:
39+
runs-on: ubuntu-latest
40+
steps:
41+
# This is a useful security step to check for unexpected outbound calls from the runner,
42+
# which could indicate a compromised token or runner.
43+
- name: Harden the runner (Audit all outbound calls)
44+
uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
45+
with:
46+
egress-policy: audit
47+
48+
- name: Checkout repository
49+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
50+
51+
- name: Spell check repo
52+
uses: crate-ci/typos@cf5f1c29a8ac336af8568821ec41919923b05a83 # v1.45.1
53+
54+
check-website-build:
55+
runs-on: ubuntu-latest
56+
steps:
57+
# This is a useful security step to check for unexpected outbound calls from the runner,
58+
# which could indicate a compromised token or runner.
59+
- name: Harden the runner (Audit all outbound calls)
60+
uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
61+
with:
62+
egress-policy: audit
63+
64+
- name: Checkout repository
65+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
66+
67+
- name: Set up Quarto
68+
uses: quarto-dev/quarto-actions/setup@8a96df13519ee81fd526f2dfca5962811136661b # v2.2.0
69+
70+
# Check that the website builds, but don't publish it
71+
- name: Render Quarto Project
72+
uses: quarto-dev/quarto-actions/render@8a96df13519ee81fd526f2dfca5962811136661b # v2.2.0
73+
74+
# Dependency Review Action
75+
#
76+
# This Action will scan dependency manifest files that change as part of a Pull Request,
77+
# surfacing known-vulnerable versions of the packages declared or updated in the PR.
78+
# Once installed, if the workflow run is marked as required,
79+
# PRs introducing known-vulnerable packages will be blocked from merging.
80+
#
81+
# Source repository: https://github.com/actions/dependency-review-action
82+
check-dependencies:
83+
runs-on: ubuntu-latest
84+
steps:
85+
- name: Harden the runner (Audit all outbound calls)
86+
uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
87+
with:
88+
egress-policy: audit
89+
90+
- name: "Checkout Repository"
91+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
92+
93+
- name: "Dependency Review"
94+
uses: actions/dependency-review-action@3c4e3dcb1aa7874d2c16be7d79418e9b7efd6261 # v4.8.2

‎.github/workflows/dependency-review.yml‎

Lines changed: 0 additions & 17 deletions
This file was deleted.

‎.github/workflows/release-project.yml‎

Lines changed: 0 additions & 21 deletions
This file was deleted.

0 commit comments

Comments
 (0)