CI updates

.github/publish.yaml

@@ -0,0 +1,7 @@
+# yaml-language-server: $schema=https://raw.githubusercontent.com/camptocamp/tag-publish/0.13.3/tag_publish/schema.json
+
+pypi:
+  packages:
+    - {}
+dispatch:
+  - {}

.github/renovate.json5

@@ -1,98 +1,35 @@
 {
-  extends: ['config:base'],
-  timezone: 'Europe/Zurich',
-  schedule: 'after 5pm on the first day of the month',
-  labels: ['dependencies'],
-  separateMajorMinor: true,
-  separateMinorPatch: true,
-  prHourlyLimit: 0,
-  prConcurrentLimit: 0,
-  lockFileMaintenance: {
-    enabled: true,
-    automerge: true,
-    schedule: 'after 5pm on the first day of the month',
-  },
-  'pre-commit': { enabled: true },
-  regexManagers: [
-    /** Do updates on pre-commit additional dependencies */
-    {
-      fileMatch: ['^\\.pre\\-commit\\-config\\.yaml$'],
-      matchStrings: [" +- '?(?<depName>[^' @=]+)(@|==)(?<currentValue>[^' @=]+)'? # (?<datasource>.+)"],
-    },
-    /** Do update on the schema present in the ci/config.yaml */
-    {
-      fileMatch: ['^ci/config\\.yaml$'],
-      matchStrings: [
-        '.*https://raw\\.githubusercontent\\.com/(?<depName>[^\\s]+)/(?<currentValue>[0-9\\.]+)/.*',
-      ],
-      datasourceTemplate: 'github-tags',
-    },
-    /** Python version in actions/setup-python action */
-    {
-      fileMatch: ['^\\.github/workflows/.*\\.yaml$'],
-      matchStrings: [' python-version: [\'"](?<currentValue>[0-9\\.]+)[\'"]'],
-      datasourceTemplate: 'python-version',
-      depNameTemplate: 'python',
-    },
+  extends: [
+    'github>camptocamp/gs-renovate-config-preset:base.json5#0.8.1',
+    'github>camptocamp/gs-renovate-config-preset:group.json5#0.8.1',
+    'github>camptocamp/gs-renovate-config-preset:ci.json5#0.8.1',
+    'github>camptocamp/gs-renovate-config-preset:preset.json5#0.8.1',
+    'github>camptocamp/gs-renovate-config-preset:pre-commit.json5#0.8.1',
+    'github>camptocamp/gs-renovate-config-preset:python.json5#0.8.1',
+    'github>camptocamp/gs-renovate-config-preset:security.json5#0.8.1',
+    'github>camptocamp/gs-renovate-config-preset:docker.json5#0.8.1',
+    'github>camptocamp/gs-renovate-config-preset:own.json5#0.8.1',
+    'github>camptocamp/gs-renovate-config-preset:json-schema.json5#0.8.1',
+    'github>camptocamp/gs-renovate-config-preset:shellcheck.json5#0.8.1',
   ],
   packageRules: [
-    /** Auto merge the dev dependency update */
-    {
-      matchDepTypes: ['devDependencies'],
-      automerge: true,
-    },
-    /** Group and auto merge the patch updates */
-    {
-      matchUpdateTypes: ['patch'],
-      groupName: 'all patch versions',
-      automerge: true,
-    },
-    /** Group and auto merge the minor updates */
-    {
-      matchUpdateTypes: ['minor'],
-      groupName: 'all minor versions',
-      automerge: true,
-    },
     {
       matchDatasources: ['docker'],
       versioning: 'regex:^(?<compatibility>.*)-(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)?$',
       matchDepNames: ['ghcr.io/osgeo/gdal'],
       /** Ungroup Gdal */
       groupName: 'gdal',
     },
-    /** Group Poetry packages */
-    {
-      matchPackagePrefixes: ['poetry-'],
-      groupName: 'Poetry',
-      automerge: true,
-      matchDepNames: ['poetry', 'pip'],
-    },
-    /** Support the 4 parts of shellcheck-py version with a v prefix */
-    {
-      versioning: 'regex:^v(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)\\.(?<build>\\d+)$',
-      matchDepNames: ['shellcheck-py/shellcheck-py'],
-    },
     /** Disable update of Python version in pyproject.toml */
     {
       matchFiles: ['pyproject.toml'],
       enabled: false,
       matchDepNames: ['python'],
     },
-    /** Group and auto merge the CI dependencies */
-    {
-      matchFileNames: ['.github/**', '.pre-commit-config.yaml', 'ci/**'],
-      groupName: 'CI dependencies',
-      automerge: true,
-    },
     /** Ungroup pycairo */
     {
       matchDepNames: ['pycairo'],
       groupName: 'pycairo',
     },
-    /** Ungroup Python dependencies */
-    {
-      matchDepNames: ['python'],
-      groupName: 'Python',
-    },
   ],
 }

.github/workflows/main.yaml

@@ -40,8 +40,8 @@ jobs:
           path: ~/.cache/pre-commit
           key: pre-commit-${{ hashFiles('.pre-commit-config.yaml') }}
           restore-keys: "pre-commit-${{ hashFiles('.pre-commit-config.yaml') }}\npre-commit-"
-      - run: pre-commit run --all-files
-      - run: git diff --exit-code --patch > /tmp/pre-commit.patch || true
+      - run: pre-commit run --all-files --color=always
+      - run: git diff --exit-code --patch > /tmp/pre-commit.patch; git diff --color; git reset --hard || true
         if: failure()
       - uses: actions/upload-artifact@v4
         with:
@@ -60,16 +60,22 @@ jobs:
         if: always()
 
       - name: Publish
-        run: c2cciutils-publish
+        run: tag-publish
         if: |
           env.HAS_SECRETS == 'HAS_SECRETS'
           && github.event_name == 'push'
           && ( github.ref_type == 'tag' || github.ref_name == 'master' )
-      - run: git diff --exit-code --patch > /tmp/dpkg-versions.patch || true
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - run: git diff --exit-code --patch > /tmp/dpkg-versions.patch; git diff --color; git reset --hard || true
         if: failure()
       - uses: actions/upload-artifact@v4
         with:
           name: Update dpkg versions list.patch
           path: /tmp/dpkg-versions.patch
           retention-days: 1
         if: failure()
+permissions:
+  contents: write
+  packages: write
+  id-token: write

.github/workflows/pull-request-automation.yaml

@@ -5,7 +5,6 @@ on:
     types:
       - opened
       - reopened
-
 jobs:
   auto-merge:
     name: Auto reviews pull requests from bots

.pre-commit-config.yaml

@@ -19,15 +19,13 @@ repos:
       - id: trailing-whitespace
       - id: mixed-line-ending
   - repo: https://github.com/sbrunner/hooks
-    rev: 1.2.1
+    rev: 1.3.0
     hooks:
       - id: copyright
-      - id: poetry-check
-        additional_dependencies:
-          - poetry==2.0.1 # pypi
-      - id: poetry-lock
+      - id: poetry2-lock
         additional_dependencies:
           - poetry==2.0.1 # pypi
+      - id: canonicalize
   - repo: https://github.com/codespell-project/codespell
     rev: v2.4.1
     hooks:
@@ -56,9 +54,6 @@ repos:
         args:
           - --builtin-schema
           - github-workflows-require-timeout
-      - id: check-renovate
-        additional_dependencies:
-          - pyjson5==1.6.8 # pypi
   - repo: https://github.com/sirwart/ripsecrets
     rev: v0.1.8
     hooks:
@@ -74,19 +69,42 @@ repos:
     hooks:
       - id: prospector
         args:
-          - --tool=ruff
+          - --profile=utils:pre-commit
           - --die-on-tool-error
           - --output-format=pylint
+          - --profile=.prospector.yaml
         additional_dependencies:
           - prospector-profile-duplicated==1.10.4 # pypi
           - prospector-profile-utils==1.17.0 # pypi
           - ruff==0.9.4 # pypi
+        exclude: |-
+          (?x)(
+            ^tests?/?
+            |/tests?(/|$)
+            |.*/tests(/|$)
+            |(^|/)test_[_a-zA-Z0-9]+.py$
+            |(^|/)[_a-zA-Z0-9]+_tests?.py$
+            |(^|/)tests?.py$
+          )
+      - id: prospector
+        args:
+          - --die-on-tool-error
+          - --output-format=pylint
+          - --profile=utils:tests
+          - --profile=utils:pre-commit
+        additional_dependencies:
+          - prospector-profile-utils==1.20.2 # pypi
+          - ruff==0.9.6 # pypi
   - repo: https://github.com/sbrunner/jsonschema-validator
     rev: 1.0.0
     hooks:
       - id: jsonschema-validator
-        files: ^ci/config\.yaml$
+        files: ^\.github/publish\.yaml$
   - repo: https://github.com/renovatebot/pre-commit-hooks
     rev: 39.157.0
     hooks:
       - id: renovate-config-validator
+  - repo: https://github.com/sbrunner/python-versions-hook
+    rev: 0.8.0
+    hooks:
+      - id: python-versions

.prospector.yaml

@@ -3,7 +3,6 @@ inherits:
   - utils:base
   - utils:fix
   - utils:no-design-checks
-  - utils:unsafe
 
 ignore-patterns:
   - ^tilecloud/scripts/tc_.*.py
@@ -15,7 +14,10 @@ pylint:
   disable:
     - cyclic-import # see: https://github.com/PyCQA/pylint/issues/850
 
+mypy:
+  options:
+    python-version: '3.10'
+
 ruff:
-  disable:
-    - D102 # Missing docstring in public method
-    - D107 # Missing docstring in `__init__`
+  options:
+    target-version: py310

Dockerfile

@@ -1,5 +1,5 @@
-FROM ghcr.io/osgeo/gdal:ubuntu-small-3.10.1 as base-all
-LABEL maintainer Camptocamp "info@camptocamp.com"
+FROM ghcr.io/osgeo/gdal:ubuntu-small-3.10.1 AS base-all
+LABEL org.opencontainers.image.authors="Camptocamp <info@camptocamp.com>"
 SHELL ["/bin/bash", "-o", "pipefail", "-cux"]
 
 RUN --mount=type=cache,target=/var/lib/apt/lists \
@@ -13,7 +13,7 @@ ENV PATH=/venv/bin:$PATH
 
 # Used to convert the locked packages by poetry to pip requirements format
 # We don't directly use `poetry install` because it force to use a virtual environment.
-FROM base-all as poetry
+FROM base-all AS poetry
 
 # Install Poetry
 WORKDIR /poetry
@@ -27,7 +27,7 @@ ENV POETRY_DYNAMIC_VERSIONING_BYPASS=0.0.0
 RUN poetry export --extras=all --with=dev --output=/poetry/requirements-dev.txt
 
 # Base, the biggest thing is to install the Python packages
-FROM base-all as base
+FROM base-all AS base
 
 WORKDIR /app
 

ci/requirements.txt

@@ -1,6 +1,7 @@
-c2cciutils[checks,publish]==1.7.3
+c2cciutils==1.7.3
 pre-commit==4.1.0
 poetry-dynamic-versioning==1.7.1
 poetry-plugin-export==1.9.0
 poetry-plugin-tweak-dependencies-version==1.5.2
 poetry-plugin-drop-python-upper-constraint==0.1.0
+tag-publish==0.13.3

docker-compose.yaml

@@ -1,6 +1,3 @@
----
-version: '2.1'
-
 services:
   redis:
     image: redis:7