Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Updates for January 2024 #30

Merged
merged 13 commits into from
Jan 29, 2024
Merged

Updates for January 2024 #30

merged 13 commits into from
Jan 29, 2024

Conversation

Zeitsperre
Copy link

Changes

  • Updated bump-my-version to use a SemVer-v2.0-compliant versioning scheme.
  • Updated much of the information in the top-level README file to explain some of the post-install processes required. More documentation is probably necessary.
  • Organized both the top-level and recipe-level README's for easier updating and clarity.
  • Added some security steps to existing GitHub Workflows.
  • Added a configuration for Dependabot (replaces actions-version-updater.yml).
  • Added workflows for automatic labelling, for OpenSSF Scorecard, for automated cleaning of GitHub Cache, and for Dependency-related security issues.
  • Added a workflow (workflow-warning.yml) for emitting warnings for reviewers when an external service/user updates workflow files.
  • Updated pre-commit hook versions.
  • Updated project metadata to specify that Python3.12 is supported.

@Zeitsperre Zeitsperre added documentation Improvements or additions to documentation enhancement New feature or request labels Jan 22, 2024
@Zeitsperre Zeitsperre self-assigned this Jan 22, 2024
@Zeitsperre Zeitsperre merged commit f091c34 into main Jan 29, 2024
6 checks passed
@Zeitsperre Zeitsperre deleted the updates-202401 branch January 29, 2024 18:51
Zeitsperre added a commit to Ouranosinc/xscen that referenced this pull request Feb 1, 2024
### What kind of change does this PR introduce?

* Updates the cookiecutter with the newest conventions and workflows

### Does this PR introduce a breaking change?

Boilerplate documentation is largely unchanged. Workflows are now more a
bit more elegant, including automatic labelling, warnings about unsafe
changes to workflows, security-related changes, etc.

`actions-versions-updater.yml` has been replaced with `Dependabot` (it's
just better).

There's support for evaluating the OpenSSF Scorecard (this can be
disabled if we want).

Code formatting tools are now hard-pinned. These need to be kept in sync
with changes from `pre-commit`. `Dependabot` should do this task
automatically via Pull Requests.

Versioning scheme is now SemVer 2.0-compliant:
* If the version doesn't end in `-dev` or `-dev.##`, `$ bump-my-version
bump patch` will be called. This will set the version at `X.Y.Z+1-dev`.
Otherwise, `$ bump-my-version bump build` will be called. This is all
automated by the `bump-version.yml`.

When the version is ready for a release, it's up to the maintainer to
call the following:
* `$ bump-my-version bump release` (for a patch release; i.e. `1.2.0` →
`1.2.1`) or
* `$ bump-my-version bump minor` then `$ bump-my-version bump release`
(for a minor release; i.e. `1.2.0` → `1.3.0`)

There is now also support for Documentation locales (translations) via
`.po` files. These can be staged with `$ make initialize-translations`,
whereby `.po` files will be generated and French (or other) language
strings can be added.
* **I'm not sure how this will interact with existing translation code.
Might be worth it to leave this deactivated**

### Other information:

Ouranosinc/cookiecutter-pypackage#30
Zeitsperre added a commit to hydrologie/xhydro that referenced this pull request Feb 1, 2024
### What kind of change does this PR introduce?

* Updates the cookiecutter to the latest commits
* `xhydro` is now Semantic Version v2.0.0-compliant
* Added a few workflows (Change file labelling, Cache cleaning,
Dependency scans, OpenSSF Scorecard)
* Updated pre-commit hook versions
* Formatting tools are now pinned to their pre-commit equivalents
* `actions-version-updater.yml` has been replaced by `dependabot`

### Does this PR introduce a breaking change?

Boilerplate documentation is largely unchanged. Workflows are now more a
bit more elegant, including automatic labelling, warnings about unsafe
changes to workflows, security-related changes, etc.

`actions-versions-updater.yml` has been replaced with `Dependendabot`
(it's just better).

There's support for evaluating the OpenSSF Scorecard (this can be
disabled if we want).

Code formatting tools are now hard-pinned. These need to be kept in sync
with changes from `pre-commit`. `Dependabot` should do this task
automatically via Pull Requests.

Versioning scheme is now SemVer 2.0-compliant:
* If the version doesn't end in `-dev` or `-dev.##`, `$ bump-my-version
bump patch` will be called. This will set the version at `X.Y.Z+1-dev`.
Otherwise, `$ bump-my-version bump build` will be called. This is all
automated by the `bump-version.yml`.

When the version is ready for a release, it's up to the maintainer to
call the following:
* `$ bump-my-version bump release` (for a patch release; i.e. `1.2.0` →
`1.2.1`) or
* `$ bump-my-version bump minor` then `$ bump-my-version bump release`
(for a minor release; i.e. `1.2.0` → `1.3.0`)

### Other information:

Ouranosinc/cookiecutter-pypackage#30
Zeitsperre added a commit to hydrologie/xdatasets that referenced this pull request Feb 2, 2024
### What kind of change does this PR introduce?

* Updates the cookiecutter to the latest commits
* `xdatasets` is now Semantic Version v2.0.0-compliant
* Added a few workflows (Change file labelling, Cache cleaning,
Dependency scans, OpenSSF Scorecard)
* Updated pre-commit hook versions
* Formatting tools are now pinned to their pre-commit equivalents
* `actions-version-updater.yml` has been replaced by `dependabot`

### Does this PR introduce a breaking change?

Boilerplate documentation is largely unchanged. Workflows are now more a
bit more elegant, including automatic labelling, warnings about unsafe
changes to workflows, security-related changes, etc.

`actions-versions-updater.yml` has been replaced with `Dependendabot`
(it's just better).

There's support for evaluating the OpenSSF Scorecard (this can be
disabled if we want).

Code formatting tools are now hard-pinned. These need to be kept in sync
with changes from `pre-commit`. `Dependabot` should do this task
automatically via Pull Requests.

Versioning scheme is now SemVer 2.0-compliant:
* If the version doesn't end in `-dev` or `-dev.##`, `$ bump-my-version
bump patch` will be called. This will set the version at `X.Y.Z+1-dev`.
Otherwise, `$ bump-my-version bump build` will be called. This is all
automated by the `bump-version.yml`.

When the version is ready for a release, it's up to the maintainer to
call the following:
* `$ bump-my-version bump release` (for a patch release; i.e. `1.2.0` →
`1.2.1`) or
* `$ bump-my-version bump minor` then `$ bump-my-version bump release`
(for a minor release; i.e. `1.2.0` → `1.3.0`)

### Other information:

Ouranosinc/cookiecutter-pypackage#30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
documentation Improvements or additions to documentation enhancement New feature or request
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants