diff --git a/.ci/scripts/release.sh b/.ci/scripts/release.sh index a9c3644..41d2677 100755 --- a/.ci/scripts/release.sh +++ b/.ci/scripts/release.sh @@ -23,4 +23,4 @@ towncrier build --yes --version "${NEW_VERSION}" bump-my-version bump release --commit --message "Release {new_version}" --tag --tag-name "{new_version}" --tag-message "Release {new_version}" --allow-dirty bump-my-version bump patch --commit -git push origin "${BRANCH}" "${NEW_VERSION}" +git push --atomic origin "${BRANCH}" "${NEW_VERSION}" diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index d7c6a4b..b192492 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -4,12 +4,18 @@ name: "Build" on: workflow_call: +defaults: + run: + working-directory: "pulp-cli-deb" + jobs: build: runs-on: "ubuntu-latest" steps: - name: "Checkout" uses: "actions/checkout@v6" + with: + path: "pulp-cli-deb" - name: "Set up Python" uses: "actions/setup-python@v6" with: @@ -22,14 +28,14 @@ jobs: - name: "Build wheels" run: | make build - touch .root + touch ../.root - name: "Upload wheels" uses: "actions/upload-artifact@v6" with: name: "pulp_cli_packages" path: | .root - dist/ + pulp-cli-deb/dist/ if-no-files-found: "error" retention-days: 5 ... diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index facb1a8..969e277 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -2,11 +2,12 @@ name: "CodeQL" on: - push: - branches: - - "main" workflow_call: +defaults: + run: + working-directory: "pulp-cli-deb" + jobs: analyze: name: "Analyze" @@ -19,6 +20,8 @@ jobs: steps: - name: "Checkout" uses: "actions/checkout@v6" + with: + path: "pulp-cli-deb" - name: "Initialize CodeQL" uses: "github/codeql-action/init@v4" with: diff --git a/.github/workflows/collect_changes.yml b/.github/workflows/collect_changes.yml index 5e08242..f3c2c0c 100644 --- a/.github/workflows/collect_changes.yml +++ b/.github/workflows/collect_changes.yml @@ -4,13 +4,21 @@ on: workflow_call: workflow_dispatch: +defaults: + run: + working-directory: "pulp-cli-deb" + jobs: collect-changes: + permissions: + contents: "write" + pull-requests: "write" runs-on: "ubuntu-latest" steps: - name: "Checkout" uses: "actions/checkout@v6" with: + path: "pulp-cli-deb" fetch-depth: 0 - name: "Set up Python" uses: "actions/setup-python@v6" @@ -32,16 +40,16 @@ jobs: uses: "peter-evans/create-pull-request@v8" id: "create_pr" with: - token: "${{ secrets.RELEASE_TOKEN }}" title: "Update Changelog" body: "" branch: "update_changes" delete-branch: true + path: "pulp-cli-deb" - name: "Mark PR automerge" run: | gh pr merge --rebase --auto "${{ steps.create_pr.outputs.pull-request-number }}" if: "steps.create_pr.outputs.pull-request-number" env: - GH_TOKEN: "${{ secrets.RELEASE_TOKEN }}" + GH_TOKEN: "${{ secrets.GITHUB_TOKEN }}" continue-on-error: true ... diff --git a/.github/workflows/cookiecutter.yml b/.github/workflows/cookiecutter.yml index 40ba960..97ecca9 100644 --- a/.github/workflows/cookiecutter.yml +++ b/.github/workflows/cookiecutter.yml @@ -11,16 +11,21 @@ defaults: jobs: update-ci: + permissions: + contents: "write" + pull-requests: "write" runs-on: "ubuntu-latest" steps: - uses: "actions/checkout@v6" with: repository: "pulp/pulp-cli" - path: "pulp-cli" - - uses: "actions/checkout@v6" + ref: "main" + path: "pulp-cli_cc" + - name: "Checkout" + uses: "actions/checkout@v6" with: - token: "${{ secrets.RELEASE_TOKEN }}" path: "pulp-cli-deb" + token: "${{ secrets.RELEASE_TOKEN }}" - name: "Set up Python" uses: "actions/setup-python@v6" with: @@ -36,7 +41,7 @@ jobs: git config user.email pulp-infra@redhat.com - name: "Apply cookiecutter templates" run: | - uv run ../pulp-cli/cookiecutter/apply_templates.py + uv run ../pulp-cli_cc/cookiecutter/apply_templates.py if [ "$(git status --porcelain)" ] then git add . @@ -46,29 +51,33 @@ jobs: uses: "peter-evans/create-pull-request@v8" id: "create_pr" with: - token: "${{ secrets.RELEASE_TOKEN }}" title: "Update cookiecutter" body: "" branch: "update_cookiecutter" delete-branch: true path: "pulp-cli-deb" + token: "${{ secrets.RELEASE_TOKEN }}" - name: "Mark PR automerge" run: | gh pr merge --rebase --auto "${{ steps.create_pr.outputs.pull-request-number }}" if: "steps.create_pr.outputs.pull-request-number" env: - GH_TOKEN: "${{ secrets.RELEASE_TOKEN }}" + GH_TOKEN: "${{ secrets.GITHUB_TOKEN }}" continue-on-error: true update-dependencies: + permissions: + contents: "write" + pull-requests: "write" runs-on: "ubuntu-latest" steps: - uses: "actions/checkout@v6" with: repository: "pulp/pulp-cli" - path: "pulp-cli" - - uses: "actions/checkout@v6" + branch: "main" + path: "pulp-cli_cc" + - name: "Checkout" + uses: "actions/checkout@v6" with: - token: "${{ secrets.RELEASE_TOKEN }}" path: "pulp-cli-deb" - name: "Set up Python" uses: "actions/setup-python@v6" @@ -85,7 +94,7 @@ jobs: git config user.email pulp-infra@redhat.com - name: "Apply cookiecutter templates" run: | - uv run ../pulp-cli/cookiecutter/update_pulp_cli.py + uv run ../pulp-cli_cc/cookiecutter/update_pulp_cli.py if [ "$(git status --porcelain)" ] then git add . @@ -95,7 +104,6 @@ jobs: uses: "peter-evans/create-pull-request@v8" id: "create_pr" with: - token: "${{ secrets.RELEASE_TOKEN }}" title: "Update CLI and GLUE" body: "" branch: "update_cli" @@ -106,6 +114,6 @@ jobs: gh pr merge --rebase --auto "${{ steps.create_pr.outputs.pull-request-number }}" if: "steps.create_pr.outputs.pull-request-number" env: - GH_TOKEN: "${{ secrets.RELEASE_TOKEN }}" + GH_TOKEN: "${{ secrets.GITHUB_TOKEN }}" continue-on-error: true ... diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index fee95cd..d92aed4 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -4,6 +4,10 @@ name: "Lint" on: workflow_call: +defaults: + run: + working-directory: "pulp-cli-deb" + jobs: lint: runs-on: "ubuntu-latest" @@ -16,6 +20,8 @@ jobs: steps: - name: "Checkout" uses: "actions/checkout@v6" + with: + path: "pulp-cli-deb" - name: "Set up Python" uses: "actions/setup-python@v6" with: diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml index cf39225..8ec5b26 100644 --- a/.github/workflows/nightly.yml +++ b/.github/workflows/nightly.yml @@ -1,5 +1,5 @@ --- -name: "pulp-cli Nightly" +name: "Nightly" on: schedule: @@ -14,8 +14,14 @@ jobs: - "build" uses: "./.github/workflows/test.yml" codeql: + permissions: + actions: "read" + contents: "read" + security-events: "write" uses: "./.github/workflows/codeql.yml" collect_changes: + permissions: + contents: "write" + pull-requests: "write" uses: "./.github/workflows/collect_changes.yml" - secrets: "inherit" ... diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml index 5617875..01fb0e2 100644 --- a/.github/workflows/pr.yml +++ b/.github/workflows/pr.yml @@ -1,5 +1,5 @@ --- -name: "pulp-cli CI" +name: "Pull Request" on: pull_request: @@ -22,6 +22,10 @@ jobs: codeql: needs: - "lint" + permissions: + actions: "read" + contents: "read" + security-events: "write" uses: "./.github/workflows/codeql.yml" check-commits: runs-on: "ubuntu-latest" @@ -29,6 +33,7 @@ jobs: - name: "Checkout" uses: "actions/checkout@v6" with: + path: "pulp-cli-deb" fetch-depth: 0 - name: "Set up Python" uses: "actions/setup-python@v6" @@ -53,6 +58,7 @@ jobs: fi done shell: "bash" + working-directory: "pulp-cli-deb" ready-to-ship: # This is a dummy dependent task to have a single entry for the branch protection rules. runs-on: "ubuntu-latest" diff --git a/.github/workflows/pr_checks.yml b/.github/workflows/pr_checks.yml index c031756..eb1ffd0 100644 --- a/.github/workflows/pr_checks.yml +++ b/.github/workflows/pr_checks.yml @@ -1,5 +1,5 @@ --- -name: "Pulp CLI PR static checks" +name: "PR static checks" on: pull_request_target: types: ["opened", "synchronize", "reopened"] @@ -12,16 +12,21 @@ concurrency: group: "${{ github.event.pull_request.number }}-${{ github.workflow }}" cancel-in-progress: true +defaults: + run: + working-directory: "pulp-cli-deb" + jobs: apply_labels: - runs-on: "ubuntu-latest" - name: "Label PR" permissions: pull-requests: "write" + runs-on: "ubuntu-latest" + name: "Label PR" steps: - name: "Checkout" uses: "actions/checkout@v6" with: + path: "pulp-cli-deb" fetch-depth: 0 - name: "Set up Python" uses: "actions/setup-python@v6" diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 04fd8ac..bc9f489 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -1,19 +1,26 @@ --- -name: "pulp-cli Publish" +name: "Publish" on: push: tags: - "[0-9]+.[0-9]+.[0-9]+" +defaults: + run: + working-directory: "pulp-cli-deb" + jobs: build: uses: "./.github/workflows/build.yml" - environment: "pypi" publish-pypi: name: "Publish to PyPI" needs: "build" runs-on: "ubuntu-latest" + environment: + name: "pypi" + permissions: + id-token: "write" steps: - name: "Download wheels" uses: "actions/download-artifact@v8" @@ -22,7 +29,7 @@ jobs: - name: "Install uv" uses: "astral-sh/setup-uv@v7" with: - enable-cache: true + enable-cache: false - name: "Publish" run: | uv publish diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index bda5708..abdaa1d 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -1,16 +1,24 @@ --- -name: "pulp-cli Release" +name: "Tag Release" on: workflow_dispatch: +defaults: + run: + working-directory: "pulp-cli-deb" + jobs: release: name: "Release" + permissions: + contents: "write" runs-on: "ubuntu-latest" steps: - - uses: "actions/checkout@v6" + - name: "Checkout" + uses: "actions/checkout@v6" with: + path: "pulp-cli-deb" token: "${{ secrets.RELEASE_TOKEN }}" - name: "Set up Python" uses: "actions/setup-python@v6" diff --git a/.github/workflows/release_branch.yml b/.github/workflows/release_branch.yml index f20a5ef..4a8197b 100644 --- a/.github/workflows/release_branch.yml +++ b/.github/workflows/release_branch.yml @@ -3,12 +3,22 @@ name: "Create Release Branch" on: workflow_dispatch: +defaults: + run: + working-directory: "pulp-cli-deb" + jobs: create-release-branch: + permissions: + contents: "write" + issues: "write" + pull-requests: "write" runs-on: "ubuntu-latest" steps: - - uses: "actions/checkout@v6" + - name: "Checkout" + uses: "actions/checkout@v6" with: + path: "pulp-cli-deb" token: "${{ secrets.RELEASE_TOKEN }}" - name: "Set up Python" uses: "actions/setup-python@v6" @@ -30,17 +40,17 @@ jobs: uses: "peter-evans/create-pull-request@v8" id: "create_pr" with: - token: "${{ secrets.RELEASE_TOKEN }}" title: "Bump dev-version" body: "" branch: "bump_version" delete-branch: true + path: "pulp-cli-deb" - name: "Mark PR automerge" run: | gh pr merge --rebase --auto "${{ steps.create_pr.outputs.pull-request-number }}" if: "steps.create_pr.outputs.pull-request-number" env: - GH_TOKEN: "${{ secrets.RELEASE_TOKEN }}" + GH_TOKEN: "${{ secrets.GITHUB_TOKEN }}" continue-on-error: true - name: "Add Backport Label for new Branch" uses: "actions/github-script@v8" diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index b3b55c4..419ddb5 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -4,6 +4,10 @@ name: "Test" on: workflow_call: +defaults: + run: + working-directory: "pulp-cli-deb" + env: COLORTERM: "yes" TERM: "xterm-256color" @@ -37,6 +41,8 @@ jobs: steps: - name: "Checkout" uses: "actions/checkout@v6" + with: + path: "pulp-cli-deb" - name: "Download wheels" uses: "actions/download-artifact@v8" with: diff --git a/Makefile b/Makefile index b60e630..f323cf9 100644 --- a/Makefile +++ b/Makefile @@ -1,4 +1,6 @@ +# This file is managed by the cookiecutter templates. +# Do not edit manually LANGUAGES=de GLUE_PLUGINS=$(notdir $(wildcard pulp-glue-deb/src/pulp_glue/*)) CLI_PLUGINS=$(notdir $(wildcard src/pulpcore/cli/*))