Sync with 4.0.21

.github/workflows/codeql-analysis.yml

@@ -13,8 +13,8 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v3
+        uses: github/codeql-action/init@v4
       - name: Autobuild
-        uses: github/codeql-action/autobuild@v3
+        uses: github/codeql-action/autobuild@v4
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v3
+        uses: github/codeql-action/analyze@v4

.github/workflows/create-release-and-upload-assets.yml

@@ -3,44 +3,87 @@ on:
   push:
     tags:
       - 'v*'
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Version to build (e.g. 4.0.9-rc1)'
+        required: true
+
+permissions:
+  contents: write
 
 jobs:
+  setup:
+    runs-on: ubuntu-latest
+    outputs:
+      version: ${{ steps.set-vars.outputs.version }}
+      rpm_version: ${{ steps.set-vars.outputs.rpm_version }}
+      is_prerelease: ${{ steps.set-vars.outputs.is_prerelease }}
+      target_branch: ${{ steps.set-vars.outputs.target_branch }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - id: set-vars
+        run: |
+          if [ "${{ github.event_name }}" == "workflow_dispatch" ]; then
+            VERSION="${{ inputs.version }}"
+          else
+            VERSION="${GITHUB_REF#refs/tags/v}"
+          fi
+          # RPM doesn't allow hyphens in version, convert to dots
+          RPM_VERSION="${VERSION//-/.}"
+          # Pre-release if version contains -, e.g. 4.0.9-rc1, 4.0.9-dev1
+          if [[ "$VERSION" == *-* ]]; then
+            IS_PRERELEASE=true
+          else
+            IS_PRERELEASE=false
+          fi
+          # Detect target branch: if tag version matches VERSION.txt, use main
+          # otherwise use stable-X.Y branch for backport releases
+          MAJOR_MINOR=$(echo "$VERSION" | grep -oP '^\d+\.\d+')
+          CURRENT=$(cat VERSION.txt | grep -oP '^\d+\.\d+')
+          if [[ "$MAJOR_MINOR" == "$CURRENT" ]]; then
+            TARGET_BRANCH="main"
+          else
+            TARGET_BRANCH="stable-${MAJOR_MINOR}"
+          fi
+          echo "version=${VERSION}" >> $GITHUB_OUTPUT
+          echo "rpm_version=${RPM_VERSION}" >> $GITHUB_OUTPUT
+          echo "is_prerelease=${IS_PRERELEASE}" >> $GITHUB_OUTPUT
+          echo "target_branch=${TARGET_BRANCH}" >> $GITHUB_OUTPUT
+          echo "Version: $VERSION, RPM Version: $RPM_VERSION, Pre-release: $IS_PRERELEASE, Target: $TARGET_BRANCH"
+
   create-release:
+    needs: setup
     runs-on: ubuntu-latest
+    outputs:
+      upload_url: ${{ steps.create_release.outputs.upload_url }}
     steps:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
-          ref: main
-      - name: git fetch --all
-        run: |
-          git fetch --all
       - name: Create release
         id: create_release
-        uses: actions/create-release@v1
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        uses: softprops/action-gh-release@v2
         with:
-          tag_name: ${{ github.ref }}
-          release_name: Release ${{ github.ref }}
+          tag_name: v${{ needs.setup.outputs.version }}
+          name: Release v${{ needs.setup.outputs.version }}
           draft: false
-          prerelease: false
-      - name: Create upload_url artifact
-        run: |
-          echo "${{ steps.create_release.outputs.upload_url }}" > upload_url.txt
-      - name: Upload upload_url artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: upload_url.txt
-          path: upload_url.txt
+          prerelease: ${{ needs.setup.outputs.is_prerelease }}
+          generate_release_notes: ${{ needs.setup.outputs.is_prerelease }}
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
   update-version-and-changelog:
-    needs: create-release
+    needs: [setup, create-release]
+    if: needs.setup.outputs.is_prerelease == 'false'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
-          ref: main
+          ref: ${{ needs.setup.outputs.target_branch }}
       - name: git fetch --all
         run: |
           git fetch --all
@@ -59,10 +102,10 @@ jobs:
             auto-commit to update version
             skip-checks: true
         run: |
-          echo "${{ github.ref }}" | cut -dv -f2 > VERSION.txt
+          echo "${{ needs.setup.outputs.version }}" > VERSION.txt
           git add VERSION.txt
           git diff --quiet && git diff --staged --quiet || git commit -m "${COMMIT_MSG}"
-          git push origin main
+          git push origin ${{ needs.setup.outputs.target_branch }}
       - name: Update debian changelog
         env:
           EMAIL: furlongm@gmail.com
@@ -71,13 +114,16 @@ jobs:
             auto-commit to update debian changelog
             skip-checks: true
         run: |
-          gbp dch --new-version=$(cat VERSION.txt)-1 --release --distribution=stable --spawn-editor=never --commit --commit-msg="${COMMIT_MSG}"
-          git push origin main
+          gbp dch --new-version=${{ needs.setup.outputs.version }}-1 --release --distribution=stable --spawn-editor=never --commit --commit-msg="${COMMIT_MSG}"
+          git push origin ${{ needs.setup.outputs.target_branch }}
+
   build-and-upload-deb-assets:
-    needs: update-version-and-changelog
+    needs: [setup, create-release, update-version-and-changelog]
+    # For pre-releases, update-version-and-changelog is skipped, so use always()
+    if: always() && needs.create-release.result == 'success'
     runs-on: ubuntu-latest
     container:
-      image: debian:bookworm
+      image: debian:trixie
     steps:
       - name: Install build dependencies
         run: |
@@ -91,63 +137,56 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
-          ref: main
+          # For stable releases, use target branch (has updated changelog); for pre-releases, use the tag
+          ref: ${{ needs.setup.outputs.is_prerelease == 'false' && needs.setup.outputs.target_branch || github.ref }}
       - name: git fetch --all
         run: |
           git config --global --add safe.directory /__w/patchman/patchman
           git fetch --all
-      - name: Get version
-        run: |
-          export version=$(echo "${{ github.ref }}" | cut -dv -f2)
-          echo "version=${version}" >> $GITHUB_ENV
-      - name: Download upload_url artifact
-        uses: actions/download-artifact@v4
-        with:
-          name: upload_url.txt
-          path: /home/runner/work/patchman/patchman
-      - name: Get upload_url
-        run: |
-          export upload_url=$(<upload_url.txt)
-          rm upload_url.txt
-          echo "upload_url=${upload_url}" >> $GITHUB_ENV
-      - name: Build deb packages
+      - name: Build deb packages (pre-release)
+        if: needs.setup.outputs.is_prerelease == 'true'
         env:
           EMAIL: furlongm@gmail.com
-          COMMIT_MSG: |
-            auto-commit
-            skip-checks: true
+          VERSION: ${{ needs.setup.outputs.version }}
         run: |
-          export version=$(echo "${{ github.ref }}" | cut -dv -f2)
-          echo "${version}" > VERSION.txt
-          git add VERSION.txt
-          git diff --quiet && git diff --staged --quiet || git commit -m "${COMMIT_MSG}"
-          gbp dch --new-version=${version}-1 --release --distribution=stable --spawn-editor=never --commit --commit-msg="${COMMIT_MSG}"
-          git tag --delete v${version}
-          git tag v${version}
-          gbp buildpackage --git-upstream-tree=${{ github.ref }} -uc -us
-      - name: Upload python3-patchman deb
-        uses: actions/upload-release-asset@v1
+          echo "${VERSION}" > VERSION.txt
+          # Generate changelog for pre-release
+          cat > debian/changelog << EOF
+          patchman (${VERSION}-1) unstable; urgency=medium
+
+            * Pre-release ${VERSION}
+
+           -- Marcus Furlong <furlongm@gmail.com>  $(date -R)
+          EOF
+          dpkg-buildpackage -us -uc -b
+      - name: Build deb packages (stable)
+        if: needs.setup.outputs.is_prerelease == 'false'
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          EMAIL: furlongm@gmail.com
+          VERSION: ${{ needs.setup.outputs.version }}
+        run: |
+          # VERSION.txt and changelog already updated on target branch by update-version-and-changelog job
+          # Recreate tag to include those commits
+          git tag --delete v${VERSION}
+          git tag v${VERSION}
+          gbp buildpackage --git-upstream-tree=v${VERSION} -uc -us
+      - name: Upload deb assets
+        uses: softprops/action-gh-release@v2
         with:
-          upload_url: ${{ env.upload_url }}
-          asset_name: ${{ format('python3-patchman_{0}-1_all.deb', env.version) }}
-          asset_path: ../${{ format('python3-patchman_{0}-1_all.deb', env.version) }}
-          asset_content_type: application/vnd.debian.binary-package
-      - name: Upload patchman-client deb
-        uses: actions/upload-release-asset@v1
+          tag_name: v${{ needs.setup.outputs.version }}
+          files: |
+            ../python3-patchman_${{ needs.setup.outputs.version }}-1_all.deb
+            ../patchman-client_${{ needs.setup.outputs.version }}-1_all.deb
+          body: ""
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          upload_url: ${{ env.upload_url }}
-          asset_name: ${{ format('patchman-client_{0}-1_all.deb', env.version) }}
-          asset_path: ../${{ format('patchman-client_{0}-1_all.deb', env.version) }}
-          asset_content_type: application/vnd.debian.binary-package
+
   build-and-upload-rpm-assets:
-    needs: update-version-and-changelog
+    needs: [setup, create-release, update-version-and-changelog]
+    if: always() && needs.create-release.result == 'success'
     runs-on: ubuntu-latest
     container:
-      image: quay.io/centos/centos:stream9
+      image: quay.io/centos/centos:stream10
     steps:
       - name: Install build dependencies
         run: |
@@ -156,49 +195,32 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
-          ref: main
+          ref: ${{ needs.setup.outputs.is_prerelease == 'false' && needs.setup.outputs.target_branch || github.ref }}
       - name: git fetch --all
         run: |
           git config --global --add safe.directory /__w/patchman/patchman
           git fetch --all
-      - name: Get version
-        run: |
-          export version=$(echo "${{ github.ref }}" | cut -dv -f2)
-          echo "version=${version}" >> $GITHUB_ENV
-      - name: Download upload_url artifact
-        uses: actions/download-artifact@v4
-        with:
-          name: upload_url.txt
-          path: /home/runner/work/patchman/patchman
-      - name: Get upload_url
-        run: |
-          export upload_url=$(<upload_url.txt)
-          rm upload_url.txt
-          echo "upload_url=${upload_url}" >> $GITHUB_ENV
       - name: Build rpm packages
+        env:
+          VERSION: ${{ needs.setup.outputs.rpm_version }}
         run: |
+          echo "${VERSION}" > VERSION.txt
           python3 setup.py bdist_rpm --python=/usr/bin/python3
           rpmbuild -bb patchman-client.spec
-      - name: Upload patchman rpm
-        uses: actions/upload-release-asset@v1
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: Upload rpm assets
+        uses: softprops/action-gh-release@v2
         with:
-          upload_url: ${{ env.upload_url }}
-          asset_name: ${{ format('patchman-{0}-1.noarch.rpm', env.version) }}
-          asset_path: ${{ format('dist/patchman-{0}-1.noarch.rpm', env.version) }}
-          asset_content_type: application/x-rpm
-      - name: Upload patchman-client rpm
-        uses: actions/upload-release-asset@v1
+          tag_name: v${{ needs.setup.outputs.version }}
+          files: |
+            dist/patchman-${{ needs.setup.outputs.rpm_version }}-1.noarch.rpm
+            dist/noarch/patchman-client-${{ needs.setup.outputs.rpm_version }}-1.noarch.rpm
+          body: ""
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          upload_url: ${{ env.upload_url }}
-          asset_name: ${{ format('patchman-client-{0}-1.noarch.rpm', env.version) }}
-          asset_path: ${{ format('dist/noarch/patchman-client-{0}-1.noarch.rpm', env.version) }}
-          asset_content_type: application/x-rpm
+
   upload-package-to-pypi:
-    needs: update-version-and-changelog
+    needs: [setup, create-release]
+    if: needs.setup.outputs.is_prerelease == 'false'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -208,7 +230,7 @@ jobs:
           python-version: '3.x'
       - name: Set version
         run: |
-          echo "${{ github.ref }}" | cut -dv -f2 > VERSION.txt
+          echo "${{ needs.setup.outputs.version }}" > VERSION.txt
       - name: Install dependencies
         run: |
           python3 -m pip install --upgrade pip

.github/workflows/lint-and-test.yml

@@ -10,7 +10,7 @@ jobs:
     strategy:
       max-parallel: 5
       matrix:
-        python-version: ['3.x']
+        python-version: ['3.13']
     steps:
       - uses: actions/checkout@v4
       - name: Set up Python ${{ matrix.python-version }}
@@ -28,6 +28,10 @@ jobs:
           pip install flake8
           flake8 . --count --select=E9,F63,F7,F82 --show-source --statistics
           flake8 . --count --max-line-length=120 --show-source --statistics
+      - name: Check isort
+        run: |
+          pip install isort
+          isort --check --profile=django .
       - name: Set secret key
         run: ./sbin/patchman-set-secret-key
       - name: Test with django

BUILD.md

@@ -5,21 +5,24 @@ vim VERSION.txt  # modify version
 git add VERSION.txt
 version=$(<VERSION.txt)
 git commit -m "Release v${version}"
-git tag v${version}
 ```
 
 # Build DEB package
 
 ```shell
 sudo apt -y install python3-setuptools debhelper dh-exec dh-python git-buildpackage
-gbp dch --commit
-gbp buildpackage -uc -us
+version=$(<VERSION.txt)
+gbp dch --commit --new-version=${version}-1 --release --distribution=stable
+git tag v${version}
+gbp buildpackage -uc -us --git-upstream-tree=main
 ```
 
 # Build RPM packages
 
 ```shell
 sudo dnf -y install rpm-build git python3-setuptools
+version=$(<VERSION.txt)
+git tag v${version}
 python3 setup.py bdist_rpm --python=/usr/bin/python3
 rpmbuild -bb patchman-client.spec
 ```