Skip to content

Commit 97db60d

Browse files
kurtmckeekurtmckee
committed
Incorporate feedback; update to kurtmckee/github-workflows@v2.1 
1 parent bf935cc commit 97db60d

27 files changed

Lines changed: 766 additions & 179 deletions

‎.github/workflows/_test.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,9 @@ on:
1515
- "main"
1616
- "releases"
1717

18+
permissions:
19+
contents: "read"
20+
1821
jobs:
1922
test:
2023
name: "${{ matrix.name }}"

‎.github/workflows/build-python-package.jinja.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -85,7 +85,7 @@ jobs:
8585
8686
- name: "Upload the built packages"
8787
id: "upload-packages"
88-
uses: "actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f" # v6.0.0
88+
uses: "actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f" # v7.0.0
8989
with:
9090
name: "${{ env.ARTIFACT_NAME }}"
9191
path: "${{ env.PACKAGES_PATH }}"

‎.github/workflows/build-python-package.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -18,11 +18,11 @@ on:
1818

1919
env:
2020
PYTHON_VERSION: "3.13"
21-
UV_VERSION: "0.10.6"
21+
UV_VERSION: "0.11.2"
2222
ARTIFACT_NAME: "build-python-package-${{ github.run_id }}"
2323
PACKAGES_PATH: "./dist"
2424
BUILD_REQUIREMENTS: |
25-
build==1.4.0 ; python_version == "3.13"
25+
build==1.4.2 ; python_version == "3.13"
2626
colorama==0.4.6 ; python_version == "3.13" and os_name == "nt"
2727
packaging==26.0 ; python_version == "3.13"
2828
pyproject-hooks==1.2.0 ; python_version == "3.13"
@@ -74,7 +74,7 @@ jobs:
7474
7575
- name: "Upload the built packages"
7676
id: "upload-packages"
77-
uses: "actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f" # v6.0.0
77+
uses: "actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f" # v7.0.0
7878
with:
7979
name: "${{ env.ARTIFACT_NAME }}"
8080
path: "${{ env.PACKAGES_PATH }}"

‎.github/workflows/create-pr.jinja.yaml‎

Lines changed: 39 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,8 @@ on:
1818
description: |
1919
The version to use when creating the release.
2020
21-
This must be a valid version specifier (see PEP 440),
21+
This must be a valid version specifier
22+
(see PEP 440 -- https://peps.python.org/pep-0440/),
2223
but the workflow itself doesn't currently validate the version.
2324
2425
The version can be referenced in several configuration variables
@@ -151,6 +152,7 @@ jobs:
151152
- name: "Checkout the repository"
152153
uses: "actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd" # v6.0.2
153154
with:
155+
persist-credentials: "false"
154156
ref: "${{ fromJSON(inputs.config).branch-from || env.default-branch-from }}"
155157
fetch-depth: 0
156158

@@ -201,14 +203,40 @@ jobs:
201203
run: |
202204
[[ include_file("create_commit_request_body.py") | indent(10) ]]
203205
204-
- name: "Push a new branch"
206+
- name: "Compute versioned variables"
207+
shell: "python"
205208
env:
206209
VERSION: "${{ inputs.version }}"
210+
DEFAULT_BRANCH_NAME: "${{ env.default-branch-name }}"
211+
BRANCH_NAME: "${{ fromJSON(inputs.config).branch-name }}"
212+
DEFAULT_PR_TITLE: "${{ env.default-pr-title }}"
213+
PR_TITLE: "${{ fromJSON(inputs.config).pr-title }}"
214+
# Creates new environment variables:
215+
#
216+
# * COMPUTED_BRANCH_NAME
217+
# * COMPUTED_PR_TITLE
218+
#
219+
run: |
220+
[[ include_file("compute_versioned_variables.py") | indent(10) ]]
221+
222+
- name: "Push a new branch"
223+
env:
207224
GH_TOKEN: "${{ github.token }}"
208-
COMMIT_TITLE: "${{ fromJSON(inputs.config).commit-title || env.default-commit-title }}"
225+
COMPUTED_BRANCH_NAME: "${{ env.COMPUTED_BRANCH_NAME }}"
209226
run: |
210-
git push origin HEAD:"${{ fromJSON(inputs.config).branch-name || env.default-branch-name }}"
211-
gh api graphql --input "${{ runner.temp }}/graphql-input.json"
227+
# `gh api` is required because `git` has no permissions.
228+
229+
# Create the branch on the server.
230+
gh api \
231+
--method POST \
232+
-H "Accept: application/vnd.github+json" \
233+
-H "X-GitHub-Api-Version: 2026-03-10" \
234+
"/repos/${GITHUB_REPOSITORY}/git/refs" \
235+
--field "ref=refs/heads/${COMPUTED_BRANCH_NAME}" \
236+
--field "sha=${GITHUB_SHA}"
237+
238+
# Push a new commit to the branch.
239+
gh api graphql --input "${RUNNER_TEMP}/graphql-input.json"
212240
213241
- name: "Generate the PR body"
214242
env:
@@ -247,12 +275,14 @@ jobs:
247275
248276
- name: "Create a PR"
249277
env:
250-
VERSION: "${{ inputs.version }}"
251278
GH_TOKEN: "${{ github.token }}"
279+
COMPUTED_BRANCH_NAME: "${{ env.COMPUTED_BRANCH_NAME }}"
280+
COMPUTED_PR_TITLE: "${{ env.COMPUTED_PR_TITLE }}"
281+
PR_BASE: "${{ fromJSON(inputs.config).pr-base || env.default-pr-base }}"
252282
run: |
253283
gh pr create \
254284
--draft \
255-
--head "${{ fromJSON(inputs.config).branch-name || env.default-branch-name }}" \
256-
--base "${{ fromJSON(inputs.config).pr-base || env.default-pr-base }}" \
257-
--title "${{ fromJSON(inputs.config).pr-title || env.default-pr-title }}" \
285+
--head "${COMPUTED_BRANCH_NAME}" \
286+
--base "${PR_BASE}" \
287+
--title "${COMPUTED_PR_TITLE}" \
258288
--body-file "${RUNNER_TEMP}/pr-body.gfm"

‎.github/workflows/create-pr.yaml‎

Lines changed: 105 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,8 @@ on:
2020
description: |
2121
The version to use when creating the release.
2222
23-
This must be a valid version specifier (see PEP 440),
23+
This must be a valid version specifier
24+
(see PEP 440 -- https://peps.python.org/pep-0440/),
2425
but the workflow itself doesn't currently validate the version.
2526
2627
The version can be referenced in several configuration variables
@@ -41,40 +42,41 @@ on:
4142
4243
env:
4344
PYTHON_VERSION: "3.13"
44-
UV_VERSION: "0.10.6"
45+
UV_VERSION: "0.11.2"
4546
PANDOC_VERSION: "3.8.3"
4647
CHECK_JSONSCHEMA_REQUIREMENTS: |
47-
attrs==25.4.0 ; python_version == "3.13"
48+
attrs==26.1.0 ; python_version == "3.13"
4849
certifi==2026.2.25 ; python_version == "3.13"
49-
charset-normalizer==3.4.4 ; python_version == "3.13"
50-
check-jsonschema==0.36.2 ; python_version == "3.13"
50+
charset-normalizer==3.4.6 ; python_version == "3.13"
51+
check-jsonschema==0.37.1 ; python_version == "3.13"
5152
click==8.3.1 ; python_version == "3.13"
5253
colorama==0.4.6 ; python_version == "3.13" and platform_system == "Windows"
5354
idna==3.11 ; python_version == "3.13"
5455
jsonschema-specifications==2025.9.1 ; python_version == "3.13"
5556
jsonschema==4.26.0 ; python_version == "3.13"
5657
referencing==0.37.0 ; python_version == "3.13"
5758
regress==2025.10.1 ; python_version == "3.13"
58-
requests==2.32.5 ; python_version == "3.13"
59+
requests==2.33.0 ; python_version == "3.13"
5960
rpds-py==0.30.0 ; python_version == "3.13"
6061
ruamel-yaml==0.19.1 ; python_version == "3.13"
6162
urllib3==2.6.3 ; python_version == "3.13"
6263
TOX_REQUIREMENTS: |
63-
cachetools==7.0.1 ; python_version == "3.13"
64+
cachetools==7.0.5 ; python_version == "3.13"
6465
colorama==0.4.6 ; python_version == "3.13"
6566
distlib==0.4.0 ; python_version == "3.13"
66-
filelock==3.24.3 ; python_version == "3.13"
67+
filelock==3.25.2 ; python_version == "3.13"
6768
packaging==26.0 ; python_version == "3.13"
68-
platformdirs==4.9.2 ; python_version == "3.13"
69+
platformdirs==4.9.4 ; python_version == "3.13"
6970
pluggy==1.6.0 ; python_version == "3.13"
7071
pyproject-api==1.10.0 ; python_version == "3.13"
71-
python-discovery==1.0.0 ; python_version == "3.13"
72+
python-discovery==1.2.1 ; python_version == "3.13"
73+
tomli-w==1.2.0 ; python_version == "3.13"
7274
tox-gh==1.7.1 ; python_version == "3.13"
73-
tox-uv-bare==1.33.0 ; python_version == "3.13"
74-
tox-uv==1.33.0 ; python_version == "3.13"
75-
tox==4.46.3 ; python_version == "3.13"
76-
uv==0.10.6 ; python_version == "3.13"
77-
virtualenv==21.0.0 ; python_version == "3.13"
75+
tox-uv-bare==1.33.4 ; python_version == "3.13"
76+
tox-uv==1.33.4 ; python_version == "3.13"
77+
tox==4.51.0 ; python_version == "3.13"
78+
uv==0.11.2 ; python_version == "3.13"
79+
virtualenv==21.2.0 ; python_version == "3.13"
7880
7981
# These values are used when a config value is not specified.
8082
default-branch-from: "main"
@@ -241,6 +243,7 @@ jobs:
241243
- name: "Checkout the repository"
242244
uses: "actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd" # v6.0.2
243245
with:
246+
persist-credentials: "false"
244247
ref: "${{ fromJSON(inputs.config).branch-from || env.default-branch-from }}"
245248
fetch-depth: 0
246249

@@ -400,14 +403,91 @@ jobs:
400403
if __name__ == "__main__":
401404
sys.exit(main())
402405
403-
- name: "Push a new branch"
406+
- name: "Compute versioned variables"
407+
shell: "python"
404408
env:
405409
VERSION: "${{ inputs.version }}"
410+
DEFAULT_BRANCH_NAME: "${{ env.default-branch-name }}"
411+
BRANCH_NAME: "${{ fromJSON(inputs.config).branch-name }}"
412+
DEFAULT_PR_TITLE: "${{ env.default-pr-title }}"
413+
PR_TITLE: "${{ fromJSON(inputs.config).pr-title }}"
414+
# Creates new environment variables:
415+
#
416+
# * COMPUTED_BRANCH_NAME
417+
# * COMPUTED_PR_TITLE
418+
#
419+
run: |
420+
# This file is a part of the Globus GitHub Workflows project.
421+
# https://github.com/globus/workflows
422+
# Copyright 2021-2026 Globus <support@globus.org>
423+
# Copyright 2024-2026 Kurt McKee <contactme@kurtmckee.org>
424+
# SPDX-License-Identifier: MIT
425+
426+
import os
427+
import sys
428+
429+
RC_SUCCESS = 0
430+
RC_FAILURE = 1
431+
432+
mandatory_environment_variables = {
433+
"BRANCH_NAME",
434+
"DEFAULT_BRANCH_NAME",
435+
"GITHUB_ENV",
436+
"VERSION",
437+
}
438+
439+
440+
def main() -> int:
441+
# Ensure mandatory environment variables are present.
442+
if missing_keys := (mandatory_environment_variables - os.environ.keys()):
443+
for missing_key in missing_keys:
444+
print(f"`{missing_key}` is a mandatory environment variable.")
445+
return RC_FAILURE
446+
447+
# Branch name
448+
branch_name = os.environ["BRANCH_NAME"]
449+
if branch_name:
450+
version = os.environ["VERSION"]
451+
computed_branch_name = branch_name.replace("$VERSION", version)
452+
else:
453+
computed_branch_name = os.environ["DEFAULT_BRANCH_NAME"]
454+
with open(os.environ["GITHUB_ENV"], "a") as file:
455+
file.write(f"COMPUTED_BRANCH_NAME={computed_branch_name}\n")
456+
457+
# PR title
458+
pr_title = os.environ["PR_TITLE"]
459+
if pr_title:
460+
version = os.environ["VERSION"]
461+
computed_pr_title = pr_title.replace("$VERSION", version)
462+
else:
463+
computed_pr_title = os.environ["DEFAULT_PR_TITLE"]
464+
with open(os.environ["GITHUB_ENV"], "a") as file:
465+
file.write(f"COMPUTED_PR_TITLE={computed_pr_title}\n")
466+
467+
return RC_SUCCESS
468+
469+
470+
if __name__ == "__main__":
471+
sys.exit(main())
472+
473+
- name: "Push a new branch"
474+
env:
406475
GH_TOKEN: "${{ github.token }}"
407-
COMMIT_TITLE: "${{ fromJSON(inputs.config).commit-title || env.default-commit-title }}"
476+
COMPUTED_BRANCH_NAME: "${{ env.COMPUTED_BRANCH_NAME }}"
408477
run: |
409-
git push origin HEAD:"${{ fromJSON(inputs.config).branch-name || env.default-branch-name }}"
410-
gh api graphql --input "${{ runner.temp }}/graphql-input.json"
478+
# `gh api` is required because `git` has no permissions.
479+
480+
# Create the branch on the server.
481+
gh api \
482+
--method POST \
483+
-H "Accept: application/vnd.github+json" \
484+
-H "X-GitHub-Api-Version: 2026-03-10" \
485+
"/repos/${GITHUB_REPOSITORY}/git/refs" \
486+
--field "ref=refs/heads/${COMPUTED_BRANCH_NAME}" \
487+
--field "sha=${GITHUB_SHA}"
488+
489+
# Push a new commit to the branch.
490+
gh api graphql --input "${RUNNER_TEMP}/graphql-input.json"
411491
412492
- name: "Generate the PR body"
413493
env:
@@ -446,12 +526,14 @@ jobs:
446526
447527
- name: "Create a PR"
448528
env:
449-
VERSION: "${{ inputs.version }}"
450529
GH_TOKEN: "${{ github.token }}"
530+
COMPUTED_BRANCH_NAME: "${{ env.COMPUTED_BRANCH_NAME }}"
531+
COMPUTED_PR_TITLE: "${{ env.COMPUTED_PR_TITLE }}"
532+
PR_BASE: "${{ fromJSON(inputs.config).pr-base || env.default-pr-base }}"
451533
run: |
452534
gh pr create \
453535
--draft \
454-
--head "${{ fromJSON(inputs.config).branch-name || env.default-branch-name }}" \
455-
--base "${{ fromJSON(inputs.config).pr-base || env.default-pr-base }}" \
456-
--title "${{ fromJSON(inputs.config).pr-title || env.default-pr-title }}" \
536+
--head "${COMPUTED_BRANCH_NAME}" \
537+
--base "${PR_BASE}" \
538+
--title "${COMPUTED_PR_TITLE}" \
457539
--body-file "${RUNNER_TEMP}/pr-body.gfm"

‎.github/workflows/create-tag-and-release.jinja.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -174,6 +174,7 @@ jobs:
174174
)"
175175
export TAG_OBJECT_BODY
176176
177+
# Use `gh api` because `git` isn't configured with permissions.
177178
gh api \
178179
--method POST \
179180
-H "Accept: application/vnd.github+json" \

‎.github/workflows/create-tag-and-release.yaml‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -18,12 +18,12 @@ on:
1818

1919
env:
2020
PYTHON_VERSION: "3.13"
21-
UV_VERSION: "0.10.6"
21+
UV_VERSION: "0.11.2"
2222
PANDOC_VERSION: "3.8.3"
2323
SCRIV_REQUIREMENTS: |
24-
attrs==25.4.0 ; python_version == "3.13"
24+
attrs==26.1.0 ; python_version == "3.13"
2525
certifi==2026.2.25 ; python_version == "3.13"
26-
charset-normalizer==3.4.4 ; python_version == "3.13"
26+
charset-normalizer==3.4.6 ; python_version == "3.13"
2727
click-log==0.4.0 ; python_version == "3.13"
2828
click==8.3.1 ; python_version == "3.13"
2929
colorama==0.4.6 ; python_version == "3.13" and platform_system == "Windows"
@@ -32,7 +32,7 @@ env:
3232
markdown-it-py==4.0.0 ; python_version == "3.13"
3333
markupsafe==3.0.3 ; python_version == "3.13"
3434
mdurl==0.1.2 ; python_version == "3.13"
35-
requests==2.32.5 ; python_version == "3.13"
35+
requests==2.33.0 ; python_version == "3.13"
3636
scriv==1.8.0 ; python_version == "3.13"
3737
urllib3==2.6.3 ; python_version == "3.13"
3838
@@ -297,6 +297,7 @@ jobs:
297297
)"
298298
export TAG_OBJECT_BODY
299299
300+
# Use `gh api` because `git` isn't configured with permissions.
300301
gh api \
301302
--method POST \
302303
-H "Accept: application/vnd.github+json" \

0 commit comments

Comments
 (0)