Docker Publishing and other workflow updates

.bumpversion.toml

@@ -0,0 +1,58 @@
+[tool.bumpversion]
+current_version = "5.1.1"
+commit = true
+tag = true
+tag_name = "{new_version}"
+
+[[tool.bumpversion.files]]
+filename = "Dockerfile"
+search = "LABEL org.opencontainers.image.version=\"{current_version}\""
+replace = "LABEL org.opencontainers.image.version=\"{new_version}\""
+
+[[tool.bumpversion.files]]
+filename = "Dockerfile"
+search = "LABEL org.opencontainers.image.created=\"\\d{{4}}-\\d{{2}}-\\d{{2}}T\\d{{2}}:\\d{{2}}:\\d{{2}}Z\""
+replace = "LABEL org.opencontainers.image.created=\"{utcnow:%Y-%m-%dT%H:%M:%SZ}\""
+regex = true
+
+[[tool.bumpversion.files]]
+filename = "Dockerfile.adapter"
+search = "LABEL org.opencontainers.image.version=\"{current_version}\""
+replace = "LABEL org.opencontainers.image.version=\"{new_version}\""
+
+[[tool.bumpversion.files]]
+filename = "Dockerfile.adapter"
+search = "LABEL org.opencontainers.image.created=\"\\d{{4}}-\\d{{2}}-\\d{{2}}T\\d{{2}}:\\d{{2}}:\\d{{2}}Z\""
+replace = "LABEL org.opencontainers.image.created=\"{utcnow:%Y-%m-%dT%H:%M:%SZ}\""
+regex = true
+
+[[tool.bumpversion.files]]
+filename = "README.rst"
+search = "{current_version}"
+replace = "{new_version}"
+
+[[tool.bumpversion.files]]
+filename = "Makefile"
+search = "APP_VERSION ?= {current_version}"
+replace = "APP_VERSION ?= {new_version}"
+
+[[tool.bumpversion.files]]
+filename = "magpie/__meta__.py"
+search = "__version__ = \"{current_version}\""
+replace = "__version__ = \"{new_version}\""
+
+[[tool.bumpversion.files]]
+filename = "CHANGES.rst"
+search = """
+`Unreleased <https://github.com/Ouranosinc/Magpie/tree/master>`_ (latest)
+------------------------------------------------------------------------------------"""
+replace = """
+`Unreleased <https://github.com/Ouranosinc/Magpie/tree/master>`_ (latest)
+------------------------------------------------------------------------------------
+
+* Nothing new for the moment.
+
+.. _changes_{new_version}:
+
+`{new_version} <https://github.com/Ouranosinc/Magpie/tree/{new_version}>`_ ({now:%%Y-%%m-%%d})
+------------------------------------------------------------------------------------"""

.github/dependabot.yml

@@ -29,6 +29,8 @@ updates:
     commit-message:
       prefix: "ci"
       include: "scope"
+    cooldown:
+      default-days: 7
 
   # Python dependencies (pip)
   # Group patch/minor updates to reduce PR count; major updates get individual PRs
@@ -58,6 +60,8 @@ updates:
     commit-message:
       prefix: "pip"
       include: "scope"
+    cooldown:
+      default-days: 7
 
   # Docker dependencies
   # No grouping for Docker dependencies - all updates need manual review
@@ -85,6 +89,8 @@ updates:
           - "version-update:semver-minor"
         versions:
           - ">= 3.14.0"  # limit to Python 3.13.x, but allow any extra OS version tag
+    cooldown:
+      default-days: 7
 
   # NPM dependencies
   - package-ecosystem: "npm"
@@ -106,3 +112,5 @@ updates:
     commit-message:
       prefix: "npm"
       include: "scope"
+    cooldown:
+      default-days: 7

.github/workflows/docker-publish.yml

@@ -0,0 +1,123 @@
+name: Docker Hub Publishing
+
+on:
+  push:
+    branches:
+      - master
+    paths:
+      - ".bumpversion.toml"
+      - "Dockerfile"
+      - "Dockerfile.adapter"
+    tags:
+      - "[0-9]+.[0-9]+.[0-9]+"
+
+concurrency:
+  # For a given workflow, if we push to the same branch, cancel all previous builds on that branch except on master.
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref == 'refs/heads/master' }}
+
+permissions:
+  contents: read
+
+jobs:
+  build-publish-magpie:
+    name: Build and publish (Magpie)
+    runs-on: ubuntu-latest
+    env:
+      IMAGE_NAME: "pavics/magpie"
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        with:
+          disable-sudo: true
+          egress-policy: audit
+
+      - name: Check out Repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Gather Docker metadata
+        id: meta
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
+        with:
+          images: ${{ env.IMAGE_NAME }}
+          tags: |
+            type=raw,value=latest,enable={{is_default_branch}}
+            type=ref,event=tag
+            type=raw,value=latest,enable=${{ startsWith(github.ref, 'refs/tags/') }}
+
+      - name: Login to Docker Hub
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+
+      - name: Build Docker image and publish to Docker Hub
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        with:
+          file: Dockerfile
+          labels: ${{ steps.meta.outputs.labels }}
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+
+      - name: Inspect labels
+        run: |
+          docker inspect --format='{{json .Config.Labels}}' ${{ env.IMAGE_NAME }}:latest
+
+  build-publish-twitcher:
+    name: Build and publish (twitcher w/MagpieAdapter)
+    runs-on: ubuntu-latest
+    env:
+      IMAGE_NAME: "pavics/twitcher"
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        with:
+          disable-sudo: true
+          egress-policy: audit
+
+      - name: Check out Repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Gather Docker metadata
+        id: meta
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
+        with:
+          images: ${{ env.IMAGE_NAME }}
+          labels: |
+            org.opencontainers.image.authors=Francis Charette-Migneault <francis.charette-migneault@crim.ca>
+            org.opencontainers.image.description=Configures MagpieAdapter on top of Twitcher application.
+            org.opencontainers.image.licenses=Apache-2.0
+            org.opencontainers.image.title=Twitcher with MagpieAdapter
+            org.opencontainers.image.vendor=CRIM and Ouranosinc
+          tags: |
+            type=raw,value=latest,enable={{is_default_branch}},prefix=magpie-
+            type=ref,event=tag,prefix=magpie-
+            type=raw,value=latest,enable=${{ startsWith(github.ref, 'refs/tags/') }},prefix=magpie-
+
+      - name: Login to Docker Hub
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+
+      - name: Build Docker image and publish to Docker Hub
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        with:
+          file: Dockerfile.adapter
+          labels: ${{ steps.meta.outputs.labels }}
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+
+      - name: Inspect labels
+        run: |
+          docker inspect --format='{{json .Config.Labels}}' ${{ env.IMAGE_NAME }}:magpie-latest

.github/workflows/docker-testing.yml

@@ -0,0 +1,61 @@
+name: Docker-based Testing Suite
+
+on:
+  push:
+    branches:
+      - master
+  pull_request:
+
+concurrency:
+  # For a given workflow, if we push to the same branch, cancel all previous builds on that branch except on master.
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/master' }}
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    name: Build Docker image
+    runs-on: ubuntu-latest
+    env:
+      IMAGE_NAME: pavics/magpie
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        with:
+          disable-sudo: true
+          egress-policy: audit
+
+      - name: Check out Repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Gather Docker metadata
+        id: meta
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
+        with:
+          images: ${{ env.IMAGE_NAME }}
+          labels:
+            org.opencontainers.image.revision=${{ github.event.pull_request.head.sha }}
+          tags: |
+            type=raw,value=test
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+
+      - name: Build Docker image (no push)
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        with:
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+          context: .
+          labels: ${{ steps.meta.outputs.labels }}
+          load: true
+          push: false
+          tags: ${{ steps.meta.outputs.tags }}
+
+      - name: Inspect labels
+        run: |
+          docker inspect --format='{{json .Config.Labels}}' ${{ env.IMAGE_NAME }}:test

.github/workflows/greetings.yml

@@ -1,18 +1,27 @@
 name: Greetings
 
-on: [pull_request, issues]
+on: 
+  - pull_request
+  - issues
+
+permissions:
+  contents: read
 
 jobs:
   greeting:
     runs-on: ubuntu-latest
+    permissions:
+      issues: write
+      pull-requests: write
     steps:
-    - uses: actions/first-interaction@v3
+    - name: Greet Contributor
+      uses: actions/first-interaction@1c4688942c71f71d4f5502a26ea67c331730fa4d  # v3.1.0
       with:
         repo-token: ${{ secrets.GITHUB_TOKEN }}
-        issue-message: >
+        issue_message: >
           Thanks for submitting an issue. Make sure you have checked for similar issues.
           Also, provide enough details for us to be able to replicate the problem.
-        pr-message: >
+        pr_message: >
           Thanks for submitting a PR. Make sure you have looked at the contribution guidelines.
           Also, look for quick check/tests operations that you can run locally for early verification of errors.
           Travis will be happier if it doesn't need to run too many times with problematic code.

.github/workflows/label.yml

@@ -9,23 +9,31 @@ name: Pull Request Labeler
 on:
   # https://github.com/actions/labeler#recommended-permissions
   pull_request_target:
-    types: [opened, edited, synchronize, reopened]
+    types: 
+      - edited
+      - opened
+      - reopened
+      - synchronize
+
+permissions:
+  contents: read
 
 jobs:
   label:
     # Skip for Dependabot - labels are already applied via dependabot.yml config
     if: github.actor != 'dependabot[bot]'
     permissions:
       # see: https://github.com/actions/labeler/issues/870
-      contents: read
       pull-requests: write
       issues: write
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v7
+    - name: Check out Repository
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
       with:
         fetch-depth: "0"
-    - uses: actions/labeler@v7.0.0
+    - name: Label
+      uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13 # v7.0.0
       with:
         sync-labels: false
         repo-token: "${{ secrets.GITHUB_TOKEN }}"

.github/workflows/secret-scan.yml

@@ -14,6 +14,9 @@ on:
   - pull_request
   - push
 
+permissions:
+  contents: read
+
 jobs:
   # ref: https://github.com/svdarren/secrets-workflow/blob/9633bc1195a1ca1d4d70415aa4eff6cf55d706de/.github/workflows/secrets.yml
   gitleak:
@@ -24,10 +27,12 @@ jobs:
     if: github.actor != 'dependabot[bot]'
 
     steps:
-      - uses: actions/checkout@v7
+      - name: Check out Repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           fetch-depth: '0'
-      - uses: gitleaks/gitleaks-action@v3.0.0
+      - name: Run gitleaks
+        uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e  # v3.0.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }}