From 4fb8f3c7de74969e0dd6c6eb99138732ee90b6e3 Mon Sep 17 00:00:00 2001 From: Filipe Fernandes Date: Mon, 13 Jul 2026 16:50:06 -0300 Subject: [PATCH 1/3] modernize CIs and fix zizmor lints --- .github/dependabot.yml | 26 +++++++++++++++++++++++ .github/workflows/deploy-docs.yml | 20 +++++++++++------ .github/workflows/pypi.yml | 15 ++++++++++--- .github/workflows/test_code.yml | 20 ++++++++++------- .github/workflows/test_code_notebooks.yml | 16 ++++++++------ .github/workflows/test_mypy.yml | 24 +++++++++++---------- .github/workflows/test_selenium.yml | 18 ++++++++++------ .pre-commit-config.yaml | 11 +++++++++- 8 files changed, 107 insertions(+), 43 deletions(-) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..441d5c7 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,26 @@ +# See https://docs.github.com/en/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/keeping-your-actions-up-to-date-with-dependabot + +version: 2 +updates: + + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "daily" + labels: + - "Bot" + groups: + github-actions: + patterns: + - '*' + cooldown: + default-days: 7 + + - package-ecosystem: "pre-commit" + directory: "/" + schedule: + interval: "daily" + labels: + - "Bot" + cooldown: + default-days: 7 diff --git a/.github/workflows/deploy-docs.yml b/.github/workflows/deploy-docs.yml index e237917..54dd107 100644 --- a/.github/workflows/deploy-docs.yml +++ b/.github/workflows/deploy-docs.yml @@ -1,6 +1,9 @@ name: Documentation +# no permissions by default +permissions: {} + on: pull_request: push: @@ -13,28 +16,31 @@ on: jobs: build-docs: runs-on: ubuntu-latest + permissions: + contents: write + defaults: + run: + shell: bash -l {0} steps: - - name: checkout - uses: actions/checkout@v3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: fetch-depth: 0 + persist-credentials: false - name: Setup Micromamba - uses: mamba-org/setup-micromamba@v1 + uses: mamba-org/setup-micromamba@d7c9bd84e824b79d2af72a2d4196c7f4300d3476 # v3.0.0 with: environment-name: TEST init-shell: bash create-args: >- python=3 --file requirements.txt --file requirements-dev.txt --channel conda-forge - - name: Install branca - shell: bash -l {0} + - name: Install library run: | python -m pip install -e . --no-deps --force-reinstall - name: Build documentation - shell: bash -l {0} run: > set -e && pushd docs @@ -43,7 +49,7 @@ jobs: - name: Deploy if: success() && github.event_name == 'release' - uses: peaceiris/actions-gh-pages@v3 + uses: peaceiris/actions-gh-pages@84c30a85c19949d7eee79c4ff27748b70285e453 # v4.1.0 with: github_token: ${{ secrets.GITHUB_TOKEN }} publish_dir: docs/build/html diff --git a/.github/workflows/pypi.yml b/.github/workflows/pypi.yml index d2d3086..50f0c30 100644 --- a/.github/workflows/pypi.yml +++ b/.github/workflows/pypi.yml @@ -1,6 +1,9 @@ name: Publish to PyPI +# no permissions by default +permissions: {} + on: pull_request: push: @@ -17,11 +20,17 @@ defaults: jobs: packages: runs-on: ubuntu-latest + permissions: + contents: write steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + # Should be enough for setuptools-scm + fetch-depth: 100 + persist-credentials: false - name: Set up Python - uses: actions/setup-python@v4 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: "3.x" @@ -47,7 +56,7 @@ jobs: - name: Publish a Python distribution to PyPI if: success() && github.event_name == 'release' - uses: pypa/gh-action-pypi-publish@release/v1 + uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0 with: user: __token__ password: ${{ secrets.PYPI_PASSWORD }} diff --git a/.github/workflows/test_code.yml b/.github/workflows/test_code.yml index d705c01..bdcf5d4 100644 --- a/.github/workflows/test_code.yml +++ b/.github/workflows/test_code.yml @@ -1,5 +1,8 @@ name: Code Tests +# no permissions by default +permissions: {} + on: pull_request: push: @@ -11,26 +14,27 @@ jobs: strategy: fail-fast: false matrix: - os: [ubuntu-latest, windows-latest] - python-version: ["3.8", "3.12"] + os: [ ubuntu-latest, windows-latest, macos-latest ] + python-version: ["3.10", "3.14"] steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + fetch-depth: 0 + persist-credentials: false - - name: Setup Micromamba Python ${{ matrix.python-version }} - uses: mamba-org/setup-micromamba@v1 + - name: Setup Micromamba + uses: mamba-org/setup-micromamba@d7c9bd84e824b79d2af72a2d4196c7f4300d3476 # v3.0.0 with: environment-name: TEST init-shell: bash create-args: >- python=${{ matrix.python-version }} pip --file requirements.txt --file requirements-dev.txt --channel conda-forge - - name: Install branca - shell: bash -l {0} + - name: Install library run: | python -m pip install -e . --no-deps --force-reinstall - name: Tests - shell: bash -l {0} run: | python -m pytest -vv -rxs tests -m "not headless" diff --git a/.github/workflows/test_code_notebooks.yml b/.github/workflows/test_code_notebooks.yml index 2f8580c..3887653 100644 --- a/.github/workflows/test_code_notebooks.yml +++ b/.github/workflows/test_code_notebooks.yml @@ -1,5 +1,8 @@ name: Notebook Tests +# no permissions by default +permissions: {} + on: pull_request: push: @@ -10,22 +13,23 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + fetch-depth: 0 + persist-credentials: false - - name: Setup Micromamba Python 3 - uses: mamba-org/setup-micromamba@v1 + - name: Setup Micromamba + uses: mamba-org/setup-micromamba@d7c9bd84e824b79d2af72a2d4196c7f4300d3476 # v3.0.0 with: environment-name: TEST init-shell: bash create-args: >- python=3 pip --file requirements.txt --file requirements-dev.txt --channel conda-forge - - name: Install branca - shell: bash -l {0} + - name: Install library run: | python -m pip install -e . --no-deps --force-reinstall - name: Notebook tests - shell: bash -l {0} run: | python -m pytest --nbval-lax examples diff --git a/.github/workflows/test_mypy.yml b/.github/workflows/test_mypy.yml index 96715e0..acbb666 100644 --- a/.github/workflows/test_mypy.yml +++ b/.github/workflows/test_mypy.yml @@ -1,33 +1,35 @@ name: Mypy type hint checks +# no permissions by default +permissions: {} + on: pull_request: push: - branches: - - main + branches: [main] jobs: run: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + fetch-depth: 0 + persist-credentials: false - - name: Setup Micromamba env - uses: mamba-org/setup-micromamba@v1 + - name: Setup Micromamba + uses: mamba-org/setup-micromamba@d7c9bd84e824b79d2af72a2d4196c7f4300d3476 # v3.0.0 with: environment-name: TEST + init-shell: bash create-args: >- - python=3 - --file requirements.txt - --file requirements-dev.txt + python=3 pip --file requirements.txt --file requirements-dev.txt --channel conda-forge - - name: Install branca from source - shell: bash -l {0} + - name: Install library run: | python -m pip install -e . --no-deps --force-reinstall - name: Mypy test - shell: bash -l {0} run: | mypy branca diff --git a/.github/workflows/test_selenium.yml b/.github/workflows/test_selenium.yml index 85958e6..839fe4c 100644 --- a/.github/workflows/test_selenium.yml +++ b/.github/workflows/test_selenium.yml @@ -1,4 +1,7 @@ -name: Headless Tests +name: Full Tests + +# no permissions by default +permissions: {} on: pull_request: @@ -10,22 +13,23 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + fetch-depth: 0 + persist-credentials: false - - name: Setup Micromamba Python 3 - uses: mamba-org/setup-micromamba@v1 + - name: Setup Micromamba + uses: mamba-org/setup-micromamba@d7c9bd84e824b79d2af72a2d4196c7f4300d3476 # v3.0.0 with: environment-name: TEST init-shell: bash create-args: >- python=3 pip --file requirements.txt --file requirements-dev.txt --channel conda-forge - - name: Install branca - shell: bash -l {0} + - name: Install library run: | python -m pip install -e . --no-deps --force-reinstall - name: Tests - shell: bash -l {0} run: | pytest -vv -rxs tests -m "headless" diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index 0a63725..e85c915 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -21,7 +21,7 @@ repos: args: [--max-line-length=105, "--ignore=E203,W503"] - repo: https://github.com/pycqa/isort - rev: 9.0.0a3 + rev: 9.0.0b1 hooks: - id: isort additional_dependencies: [toml] @@ -56,3 +56,12 @@ repos: rev: v4.0.0 hooks: - id: add-trailing-comma + +ci: + autofix_commit_msg: | + [pre-commit.ci] auto fixes from pre-commit.com hooks + + for more information, see https://pre-commit.ci + autofix_prs: false + skip: [] + submodules: false From 9b62e5077a92ec948325d03f5ef9605cbb19bb92 Mon Sep 17 00:00:00 2001 From: Filipe Fernandes Date: Mon, 13 Jul 2026 16:56:12 -0300 Subject: [PATCH 2/3] add env to call python --- .github/workflows/test_code.yml | 3 +++ .github/workflows/test_code_notebooks.yml | 3 +++ .github/workflows/test_mypy.yml | 3 +++ .github/workflows/test_selenium.yml | 3 +++ 4 files changed, 12 insertions(+) diff --git a/.github/workflows/test_code.yml b/.github/workflows/test_code.yml index bdcf5d4..9494afc 100644 --- a/.github/workflows/test_code.yml +++ b/.github/workflows/test_code.yml @@ -11,6 +11,9 @@ on: jobs: run: runs-on: ${{ matrix.os }} + defaults: + run: + shell: bash -l {0} strategy: fail-fast: false matrix: diff --git a/.github/workflows/test_code_notebooks.yml b/.github/workflows/test_code_notebooks.yml index 3887653..f3c308c 100644 --- a/.github/workflows/test_code_notebooks.yml +++ b/.github/workflows/test_code_notebooks.yml @@ -11,6 +11,9 @@ on: jobs: run: runs-on: ubuntu-latest + defaults: + run: + shell: bash -l {0} steps: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 diff --git a/.github/workflows/test_mypy.yml b/.github/workflows/test_mypy.yml index acbb666..a4336c9 100644 --- a/.github/workflows/test_mypy.yml +++ b/.github/workflows/test_mypy.yml @@ -11,6 +11,9 @@ on: jobs: run: runs-on: ubuntu-latest + defaults: + run: + shell: bash -l {0} steps: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 diff --git a/.github/workflows/test_selenium.yml b/.github/workflows/test_selenium.yml index 839fe4c..64dcb50 100644 --- a/.github/workflows/test_selenium.yml +++ b/.github/workflows/test_selenium.yml @@ -11,6 +11,9 @@ on: jobs: run: runs-on: ubuntu-latest + defaults: + run: + shell: bash -l {0} steps: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 From 71c5bd1e4637f7a4b024c576188f73ff91d46513 Mon Sep 17 00:00:00 2001 From: Filipe Fernandes Date: Mon, 13 Jul 2026 17:04:35 -0300 Subject: [PATCH 3/3] remove unused deps --- requirements-dev.txt | 12 ------------ 1 file changed, 12 deletions(-) diff --git a/requirements-dev.txt b/requirements-dev.txt index 3c3b55f..0c9824d 100644 --- a/requirements-dev.txt +++ b/requirements-dev.txt @@ -1,24 +1,12 @@ -black check-manifest -flake8 -flake8-builtins -flake8-comprehensions -flake8-mutable -flake8-print -isort jupyter mypy nbsphinx nbval numpy -pre-commit -pylint pytest pytest-cov -pytest-flake8 pytest-xdist selenium setuptools_scm sphinx -twine -wheel