Skip to content

Commit c54f02d

Browse files
lwjohnst86lwjohnst86
committed
refactor: 👷 replace reusable workflows with normal workflow steps
1 parent c8f2e6d commit c54f02d

7 files changed

Lines changed: 312 additions & 73 deletions

File tree

‎template/.github/workflows/add-to-project.yml‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
name: Add to project board
2+
3+
on:
4+
issues:
5+
types:
6+
- opened
7+
- reopened
8+
- transferred
9+
pull_request:
10+
types:
11+
- reopened
12+
- opened
13+
14+
# Limit token permissions for security
15+
permissions: read-all
16+
17+
env:
18+
# TODO: Fill in with the correct board number for this repo.
19+
BOARD_NUMBER: ""
20+
21+
jobs:
22+
add-to-project:
23+
runs-on: ubuntu-latest
24+
permissions:
25+
pull-requests: write
26+
steps:
27+
# This is a useful security step to check for unexpected outbound calls from the runner,
28+
# which could indicate a compromised token or runner.
29+
- name: Harden the runner (Audit all outbound calls)
30+
uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
31+
with:
32+
egress-policy: audit
33+
34+
# Using this security pattern for GitHub Apps is recommended by GitHub and ensures that
35+
# the token is only available for a short time and has limited permissions. Check out
36+
# <https://guidebook.seedcase-project.org/operations/security> for more details.
37+
- uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
38+
id: app-token
39+
with:
40+
# TODO: Make sure that the repo has this variable set up.
41+
client-id: "${{ vars.ADD_TO_BOARD_APP_ID }}"
42+
# TODO: Confirm that this secret is set up for this repo.
43+
private-key: "${{ secrets.ADD_TO_BOARD }}"
44+
45+
- name: Add issue or PR to project board
46+
uses: actions/add-to-project@244f685bbc3b7adfa8466e08b698b5577571133e # v1.0.2
47+
with:
48+
project-url: "https://github.com/orgs/${{ github.repository_owner }}/projects/${{ env.BOARD_NUMBER }}"
49+
github-token: "${{ steps.app-token.outputs.token }}"
50+
51+
- name: Assign PR to creator
52+
if: ${{ github.event_name == 'pull_request' }}
53+
run: |
54+
gh pr edit $PR --add-assignee $AUTHOR --repo $REPO
55+
env:
56+
REPO: ${{ github.repository }}
57+
AUTHOR: ${{ github.event.pull_request.user.login }}
58+
PR: ${{ github.event.pull_request.html_url }}
59+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

‎template/.github/workflows/add-to-project.yml.jinja‎

Lines changed: 0 additions & 28 deletions
This file was deleted.

‎template/.github/workflows/build-website.yml.jinja‎

Lines changed: 62 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -10,17 +10,73 @@ permissions: read-all
1010

1111
jobs:
1212
build-website:
13-
uses: seedcase-project/.github/.github/workflows/reusable-build-docs-with-python.yml@main
13+
runs-on: ubuntu-latest
1414
{%- if hosting_provider == 'gh-pages' %}
1515
with:
1616
hosting-provider: gh-pages
1717
permissions:
1818
contents: write
1919
pages: write
2020
{%- endif %}
21-
secrets:
22-
{% if hosting_provider == 'gh-pages' -%}
23-
github-token: {{ '${{ secrets.GITHUB_TOKEN }}' }}
24-
{%- elif hosting_provider == 'netlify' -%}
25-
netlify-token: {{ '${{ secrets.NETLIFY_AUTH_TOKEN }}' }}
21+
concurrency:
22+
group: build-website-python-group
23+
cancel-in-progress: true
24+
env:
25+
QUARTO_PYTHON: ".venv/bin/python3"
26+
steps:
27+
- name: Harden the runner (Audit all outbound calls)
28+
uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
29+
with:
30+
egress-policy: audit
31+
32+
- name: Check out repository
33+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
34+
35+
- name: Install uv
36+
uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
37+
with:
38+
# Install a specific version of uv.
39+
# uv recommends to set the version for best practice.
40+
version: "0.11.15"
41+
# To have a faster CI time, enable cache between runs.
42+
enable-cache: true
43+
# Reset the cache if the lock file changes.
44+
cache-dependency-glob: "uv.lock"
45+
46+
- name: "Set up Python"
47+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
48+
with:
49+
python-version-file: "pyproject.toml"
50+
51+
- name: Install the project and it's dependencies
52+
run: |
53+
uv sync --all-extras --dev
54+
echo "$PWD/.venv/bin" >> "$GITHUB_PATH"
55+
56+
- name: Set up Quarto
57+
uses: quarto-dev/quarto-actions/setup@8a96df13519ee81fd526f2dfca5962811136661b # v2.2.0
58+
59+
- name: Spell check repo
60+
uses: crate-ci/typos@aca895bf05aec0cb7dffa6f94495e923224d9f17 # v1.46.2
61+
62+
- name: Build function reference docs
63+
run: uv run quartodoc build
64+
65+
{% if hosting_provider == 'netlify' -%}
66+
- name: Publish to Netlify (and render)
67+
if: ${{ inputs.hosting-provider == 'netlify' }}
68+
uses: quarto-dev/quarto-actions/publish@8a96df13519ee81fd526f2dfca5962811136661b # v2.2.0
69+
with:
70+
target: netlify
71+
NETLIFY_AUTH_TOKEN: ${{ secrets.netlify-token }}
72+
73+
{%- elif hosting_provider == 'gh-pages' -%}
74+
# NOTE: If Publishing to GitHub Pages, set the permissions correctly (see above).
75+
- name: Publish to GitHub Pages (and render)
76+
if: ${{ inputs.hosting-provider == 'gh-pages' }}
77+
uses: quarto-dev/quarto-actions/publish@8a96df13519ee81fd526f2dfca5962811136661b # v2.2.0
78+
with:
79+
target: gh-pages
80+
env:
81+
GITHUB_TOKEN: ${{ secrets.github-token }}
2682
{%- endif %}

‎template/.github/workflows/check-package.yml‎

Lines changed: 0 additions & 19 deletions
This file was deleted.

‎template/.github/workflows/checks.yml‎

Lines changed: 152 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,152 @@
1+
name: Checks
2+
3+
on:
4+
pull_request:
5+
branches:
6+
- main
7+
push:
8+
branches:
9+
- main
10+
11+
# Limit token permissions for security
12+
permissions: read-all
13+
14+
jobs:
15+
check-python:
16+
# Permissions needed for pushing to the coverage branch.
17+
permissions:
18+
contents: write
19+
runs-on: ubuntu-latest
20+
steps:
21+
- name: Harden the runner (Audit all outbound calls)
22+
uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
23+
with:
24+
egress-policy: audit
25+
26+
- name: Checkout repository
27+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
28+
29+
- name: Install uv
30+
uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
31+
with:
32+
enable-cache: true
33+
34+
- name: Install justfile
35+
run: sudo apt-get install -y just
36+
37+
- name: Install Python
38+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
39+
with:
40+
python-version-file: "pyproject.toml"
41+
42+
- name: Install the project and it's dependencies
43+
run: just install-deps
44+
45+
- name: Check Python style
46+
run: just check-python
47+
48+
- name: Run tests and coverage
49+
run: just test-python
50+
51+
- name: Prepare repo for coverage report
52+
run: |
53+
# So that folder can be committed
54+
rm htmlcov/.gitignore
55+
56+
- name: Push coverage report and badge to branch
57+
uses: JamesIves/github-pages-deploy-action@d92aa235d04922e8f08b40ce78cc5442fcfbfa2f # v4.8.0
58+
with:
59+
branch: coverage
60+
folder: htmlcov
61+
# Keep a simple Git history
62+
single-commit: true
63+
64+
- name: Run security checks
65+
run: just check-security
66+
67+
- name: Run unused code checker
68+
run: just check-unused
69+
70+
check-typos:
71+
runs-on: ubuntu-latest
72+
steps:
73+
# This is a useful security step to check for unexpected outbound calls from the runner,
74+
# which could indicate a compromised token or runner.
75+
- name: Harden the runner (Audit all outbound calls)
76+
uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
77+
with:
78+
egress-policy: audit
79+
80+
- name: Checkout repository
81+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
82+
83+
- name: Spell check repo
84+
uses: crate-ci/typos@cf5f1c29a8ac336af8568821ec41919923b05a83 # v1.45.1
85+
86+
check-website-build:
87+
runs-on: ubuntu-latest
88+
env:
89+
QUARTO_PYTHON: ".venv/bin/python3"
90+
steps:
91+
# This is a useful security step to check for unexpected outbound calls from the runner,
92+
# which could indicate a compromised token or runner.
93+
- name: Harden the runner (Audit all outbound calls)
94+
uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
95+
with:
96+
egress-policy: audit
97+
98+
- name: Check out repository
99+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
100+
101+
- name: Install uv
102+
uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
103+
with:
104+
# To have a faster CI time, enable cache between runs.
105+
enable-cache: true
106+
# Reset the cache if the lock file changes.
107+
cache-dependency-glob: "uv.lock"
108+
109+
- name: "Set up Python"
110+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
111+
with:
112+
python-version-file: "pyproject.toml"
113+
114+
- name: Install the project and it's dependencies
115+
run: |
116+
uv sync --all-extras --dev
117+
echo "$PWD/.venv/bin" >> "$GITHUB_PATH"
118+
119+
- name: Set up Quarto
120+
uses: quarto-dev/quarto-actions/setup@8a96df13519ee81fd526f2dfca5962811136661b # v2.2.0
121+
122+
- name: Build function reference docs
123+
run: uv run quartodoc build
124+
125+
- name: Build function reference docs
126+
run: uvx quartodoc build
127+
128+
# Check that the website builds, but don't publish it
129+
- name: Render Quarto Project
130+
uses: quarto-dev/quarto-actions/render@8a96df13519ee81fd526f2dfca5962811136661b # v2.2.0
131+
132+
# Dependency Review Action
133+
#
134+
# This Action will scan dependency manifest files that change as part of a Pull Request,
135+
# surfacing known-vulnerable versions of the packages declared or updated in the PR.
136+
# Once installed, if the workflow run is marked as required,
137+
# PRs introducing known-vulnerable packages will be blocked from merging.
138+
#
139+
# Source repository: https://github.com/actions/dependency-review-action
140+
check-dependencies:
141+
runs-on: ubuntu-latest
142+
steps:
143+
- name: Harden the runner (Audit all outbound calls)
144+
uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
145+
with:
146+
egress-policy: audit
147+
148+
- name: "Checkout Repository"
149+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
150+
151+
- name: "Dependency Review"
152+
uses: actions/dependency-review-action@3c4e3dcb1aa7874d2c16be7d79418e9b7efd6261 # v4.8.2

‎template/.github/workflows/dependency-review.yml‎

Lines changed: 0 additions & 17 deletions
This file was deleted.

0 commit comments

Comments
 (0)