Docker Publishing and other workflow updates

.bumpversion.toml

@@ -0,0 +1,58 @@
+[tool.bumpversion]
+current_version = "5.1.1"
+commit = true
+tag = true
+tag_name = "{new_version}"
+
+[[tool.bumpversion.files]]
+filename = "Dockerfile"
+search = "LABEL org.opencontainers.image.version=\"{current_version}\""
+replace = "LABEL org.opencontainers.image.version=\"{new_version}\""
+
+[[tool.bumpversion.files]]
+filename = "Dockerfile"
+search = "LABEL org.opencontainers.image.created=\"\\d{{4}}-\\d{{2}}-\\d{{2}}T\\d{{2}}:\\d{{2}}:\\d{{2}}Z\""
+replace = "LABEL org.opencontainers.image.created=\"{utcnow:%Y-%m-%dT%H:%M:%SZ}\""
+regex = true
+
+[[tool.bumpversion.files]]
+filename = "Dockerfile.adapter"
+search = "LABEL org.opencontainers.image.version=\"{current_version}\""
+replace = "LABEL org.opencontainers.image.version=\"{new_version}\""
+
+[[tool.bumpversion.files]]
+filename = "Dockerfile.adapter"
+search = "LABEL org.opencontainers.image.created=\"\\d{{4}}-\\d{{2}}-\\d{{2}}T\\d{{2}}:\\d{{2}}:\\d{{2}}Z\""
+replace = "LABEL org.opencontainers.image.created=\"{utcnow:%Y-%m-%dT%H:%M:%SZ}\""
+regex = true
+
+[[tool.bumpversion.files]]
+filename = "README.rst"
+search = "{current_version}"
+replace = "{new_version}"
+
+[[tool.bumpversion.files]]
+filename = "Makefile"
+search = "APP_VERSION ?= {current_version}"
+replace = "APP_VERSION ?= {new_version}"
+
+[[tool.bumpversion.files]]
+filename = "magpie/__meta__.py"
+search = "__version__ = \"{current_version}\""
+replace = "__version__ = \"{new_version}\""
+
+[[tool.bumpversion.files]]
+filename = "CHANGES.rst"
+search = """
+`Unreleased <https://github.com/Ouranosinc/Magpie/tree/master>`_ (latest)
+------------------------------------------------------------------------------------"""
+replace = """
+`Unreleased <https://github.com/Ouranosinc/Magpie/tree/master>`_ (latest)
+------------------------------------------------------------------------------------
+
+* Nothing new for the moment.
+
+.. _changes_{new_version}:
+
+`{new_version} <https://github.com/Ouranosinc/Magpie/tree/{new_version}>`_ ({now:%%Y-%%m-%%d})
+------------------------------------------------------------------------------------"""

.github/dependabot.yml

@@ -29,6 +29,8 @@ updates:
     commit-message:
       prefix: "ci"
       include: "scope"
+    cooldown:
+      default-days: 7
 
   # Python dependencies (pip)
   # Group patch/minor updates to reduce PR count; major updates get individual PRs
@@ -58,6 +60,8 @@ updates:
     commit-message:
       prefix: "pip"
       include: "scope"
+    cooldown:
+      default-days: 7
 
   # Docker dependencies
   # No grouping for Docker dependencies - all updates need manual review
@@ -85,6 +89,8 @@ updates:
           - "version-update:semver-minor"
         versions:
           - ">= 3.14.0"  # limit to Python 3.13.x, but allow any extra OS version tag
+    cooldown:
+      default-days: 7
 
   # NPM dependencies
   - package-ecosystem: "npm"
@@ -106,3 +112,5 @@ updates:
     commit-message:
       prefix: "npm"
       include: "scope"
+    cooldown:
+      default-days: 7

.github/workflows/docker-publish.yml

@@ -0,0 +1,117 @@
+name: Docker Hub Publishing
+
+on:
+  push:
+    branches:
+      - "master"
+    paths:
+      - ".bumpversion.toml"
+      - "Dockerfile"
+      - "Dockerfile.adapter"
+    tags:
+      - "[0-9]+.[0-9]+.[0-9]+"
+
+concurrency:
+  # For a given workflow, if we push to the same branch, cancel all previous builds on that branch except on master.
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref == 'refs/heads/main' }}
+
+permissions:
+  contents: read
+
+jobs:
+  build-publish-magpie:
+    name: Build and publish (Magpie)
+    runs-on: ubuntu-latest
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        with:
+          disable-sudo: true
+          egress-policy: audit
+
+      - name: Checkout Repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Gather Docker metadata
+        id: meta
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
+        with:
+          images: pavics/magpie
+          labels: |
+            org.opencontainers.image.authors=Francis Charette-Migneault <francis.charette-migneault@crim.ca>
+            org.opencontainers.image.description=Runs Magpie AuthN/AuthZ service for REST-API and UI interfaces.
+            org.opencontainers.image.licenses=Apache-2.0
+            org.opencontainers.image.title=Magpie
+            org.opencontainers.image.vendor=CRIM and Ouranosinc
+          tags: |
+            type=raw,value=latest,enable={{is_default_branch}}
+            type=ref,event=tag
+            type=raw,value=latest,enable=${{ startsWith(github.ref, 'refs/tags/') }}
+
+      - name: Login to Docker Hub
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+
+      - name: Build Docker image and publish to Docker Hub
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        with:
+          file: Dockerfile
+          labels: ${{ steps.meta.outputs.labels }}
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+
+  build-publish-twitcher:
+    name: Build and publish (twitcher w/MagpieAdapter)
+    runs-on: ubuntu-latest
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        with:
+          disable-sudo: true
+          egress-policy: audit
+
+      - name: Checkout Repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Gather Docker metadata
+        id: meta
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
+        with:
+          images: pavics/twitcher
+          labels: |
+            org.opencontainers.image.authors=Francis Charette-Migneault <francis.charette-migneault@crim.ca>
+            org.opencontainers.image.description=Configures MagpieAdapter on top of Twitcher application.
+            org.opencontainers.image.licenses=Apache-2.0
+            org.opencontainers.image.title=Twitcher with MagpieAdapter
+            org.opencontainers.image.vendor=CRIM and Ouranosinc
+          tags: |
+            type=raw,value=latest,enable={{is_default_branch}},prefix=magpie-
+            type=ref,event=tag,prefix=magpie-
+            type=raw,value=latest,enable=${{ startsWith(github.ref, 'refs/tags/') }},prefix=magpie-
+
+      - name: Login to Docker Hub
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+
+      - name: Build Docker image and publish to Docker Hub
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        with:
+          file: Dockerfile.adapter
+          labels: ${{ steps.meta.outputs.labels }}
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}

.github/workflows/greetings.yml

@@ -1,18 +1,27 @@
 name: Greetings
 
-on: [pull_request, issues]
+on: 
+  - pull_request
+  - issues
+
+permissions:
+  contents: read
 
 jobs:
   greeting:
     runs-on: ubuntu-latest
+    permissions:
+      issues: write
+      pull-requests: write
     steps:
-    - uses: actions/first-interaction@v3
+    - name: Greet Contributor
+      uses: actions/first-interaction@1c4688942c71f71d4f5502a26ea67c331730fa4d  # v3.1.0
       with:
         repo-token: ${{ secrets.GITHUB_TOKEN }}
-        issue-message: >
+        issue_message: >
           Thanks for submitting an issue. Make sure you have checked for similar issues.
           Also, provide enough details for us to be able to replicate the problem.
-        pr-message: >
+        pr_message: >
           Thanks for submitting a PR. Make sure you have looked at the contribution guidelines.
           Also, look for quick check/tests operations that you can run locally for early verification of errors.
           Travis will be happier if it doesn't need to run too many times with problematic code.

.github/workflows/label.yml

@@ -9,23 +9,31 @@ name: Pull Request Labeler
 on:
   # https://github.com/actions/labeler#recommended-permissions
   pull_request_target:
-    types: [opened, edited, synchronize, reopened]
+    types: 
+      - edited
+      - opened
+      - reopened
+      - synchronize
+
+permissions:
+  contents: read
 
 jobs:
   label:
     # Skip for Dependabot - labels are already applied via dependabot.yml config
     if: github.actor != 'dependabot[bot]'
     permissions:
       # see: https://github.com/actions/labeler/issues/870
-      contents: read
       pull-requests: write
       issues: write
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v7
+    - name: Check out Repository
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
       with:
         fetch-depth: "0"
-    - uses: actions/labeler@v7.0.0
+    - name: Label
+      uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13 # v7.0.0
       with:
         sync-labels: false
         repo-token: "${{ secrets.GITHUB_TOKEN }}"

.github/workflows/secret-scan.yml

@@ -14,6 +14,9 @@ on:
   - pull_request
   - push
 
+permissions:
+  contents: read
+
 jobs:
   # ref: https://github.com/svdarren/secrets-workflow/blob/9633bc1195a1ca1d4d70415aa4eff6cf55d706de/.github/workflows/secrets.yml
   gitleak:
@@ -24,10 +27,12 @@ jobs:
     if: github.actor != 'dependabot[bot]'
 
     steps:
-      - uses: actions/checkout@v7
+      - name: Check out Repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           fetch-depth: '0'
-      - uses: gitleaks/gitleaks-action@v3.0.0
+      - name: Run gitleaks
+        uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e  # v3.0.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }}

.github/workflows/tests.yml

@@ -13,6 +13,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   # see: https://github.com/fkirc/skip-duplicate-actions
   skip_duplicate:
@@ -114,12 +117,14 @@ jobs:
             echo "should_run=true" >> "$GITHUB_OUTPUT"
           fi
 
-      - uses: actions/checkout@v7
+      - name: Check out Repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         if: ${{ steps.execution_guard.outputs.should_run == 'true' }}
         with:
           fetch-depth: "0"
+
       - name: Setup Python
-        uses: actions/setup-python@v7
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
         if: ${{ steps.execution_guard.outputs.should_run == 'true' && matrix.python-version != 'none' }}
         with:
           python-version: ${{ matrix.python-version }}
@@ -128,31 +133,38 @@ jobs:
       - name: Install Package Managers
         if: ${{ steps.execution_guard.outputs.should_run == 'true' && matrix.python-version != 'none' }}
         run: make install-sys
+
       - name: Install Dependencies
         if: ${{ steps.execution_guard.outputs.should_run == 'true' && matrix.python-version != 'none' }}
         run: make install-pkg install-req install-dev version
+
       - name: Display Packages
         if: ${{ steps.execution_guard.outputs.should_run == 'true' && matrix.python-version != 'none' }}
         run: pip freeze
+
       - name: Setup Environment Variables
         if: ${{ steps.execution_guard.outputs.should_run == 'true' }}
         uses: c-py/action-dotenv-to-setenv@v5
         with:
           env-file: ./ci/magpie.env
+
       - name: Display Environment Variables
         if: ${{ steps.execution_guard.outputs.should_run == 'true' }}
         run: |
           hash -r
           env | sort
+
       - name: Create private key for network testing
         if: ${{ steps.execution_guard.outputs.should_run == 'true' && matrix.test-case == 'test-local' }}
         run: ${{ matrix.test-option }} make create-private-key
       # run '-only' test variations since dependencies are preinstalled, skip some resolution time
+
       - name: Run Tests
         if: ${{ steps.execution_guard.outputs.should_run == 'true' }}
         run: ${{ matrix.test-option }} make stop ${{ matrix.test-case }}-only
+
       - name: Upload coverage report
-        uses: codecov/codecov-action@v7
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f  # v7.0.0
         if: ${{ steps.execution_guard.outputs.should_run == 'true' && success() && matrix.test-case == 'coverage' }}
         with:
           token: ${{ secrets.CODECOV_TOKEN }}

.readthedocs.yml

@@ -1,11 +1,14 @@
 # configuration to setup readthedocs
 version: 2
+
 build:
-  os: ubuntu-22.04
+  os: ubuntu-26.04
   tools:
     python: "3.12"
+
 sphinx:
   configuration: docs/conf.py
+
 # note:
 #   disable PDF and EPUB which break during LaTeX
 #   generation because of `redoc.js` script not found
@@ -14,6 +17,7 @@ formats:
   - htmlzip
   #- pdf
   #- epub
+
 python:
   install:
     - requirements: requirements-sys.txt