Merge pull request #98 from OpenRailAssociation/switch-uv-ruff-ty

chore: switch to uv/ruff/ty

Author: mxmehl

.github/actions/poetrybuild/action.yaml

@@ -0,0 +1,35 @@
+# SPDX-FileCopyrightText: 2025 DB Systel GmbH
+#
+# SPDX-License-Identifier: Apache-2.0
+
+name: "Reusable uv build workflow"
+description: "Reusable workflow to set up Python and install dependencies via uv. The Python version and additional uv arguments can be configured via inputs."
+inputs:
+  python:
+    default: "3.14"
+    description: "Value for 'python-version'"
+    required: false
+    type: string
+  uv_args:
+    default: ""
+    description: "Additional arguments for the uv install step'"
+    required: false
+    type: string
+runs:
+  using: "composite"
+  steps:
+    - name: Set up Python
+      uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+      with:
+        python-version: ${{ inputs.python }}
+    - name: Install uv
+      uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8.0.0
+      with:
+        enable-cache: true
+    - name: Setup project
+      run: |
+        uv_args="${UV_ARGS}"
+        uv sync  --locked --all-extras --dev $uv_args
+      env:
+        UV_ARGS: ${{ inputs.uv_args }}
+      shell: bash

.github/actions/uvbuild/action.yaml

@@ -8,11 +8,25 @@ on:
     types: [published]
 
 jobs:
-  build:
+  pypi-publish:
     runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/p/purl-tools
+    permissions:
+      id-token: write
+      contents: read
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - name: Build and publish to PyPI
-        uses: JRubics/poetry-publish@4b3306307f536bbfcb559603629b3b4f6aef5ab8 # v2.1
         with:
-          pypi_token: ${{ secrets.PYPI_TOKEN }}
+          persist-credentials: false
+      - name: Set up Python
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+      - name: Install uv
+        uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8.0.0
+        with:
+          enable-cache: false # avoid cache-poisoning attacks
+      - name: Build package
+        run: uv build
+      - name: Publish package to PyPI
+        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0

.github/workflows/publish.yaml

@@ -8,6 +8,9 @@ on:
   schedule:
     - cron: "35 9 * * 1"  # run a check once a week
 
+permissions:
+  contents: read
+
 jobs:
   osv-check:
     runs-on: ubuntu-latest

.github/workflows/release-vulnerabilities.yaml

@@ -10,16 +10,19 @@ on:
       - main
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
-  # Test using the tool via poetry on different OSes and python versions
+  # Test using the tool via uv on different OSes and python versions
   test-os-python-matrix:
     runs-on: ${{ matrix.os }}
     strategy:
       max-parallel: 10
       # do not abort the whole test job if one combination in the matrix fails
       fail-fast: false
       matrix:
-        python-version: ["3.10", "3.11", "3.12", "3.13"]
+        python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]
         os: [ubuntu-22.04]
         include:
           - python-version: "3.10"
@@ -29,73 +32,76 @@ jobs:
 
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: ./.github/actions/poetrybuild
+        with:
+          persist-credentials: false
+      - uses: ./.github/actions/uvbuild
         with:
           python: ${{ matrix.python-version }}
-          poetry_args: --only main
+          uv_args: --no-dev
       - name: Execute purl-tools
-        run: poetry run purl-tools --help
+        run: uv run purl-tools --help
 
   # Test building the package and installing it via pip3
   test-build-install:
     runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - name: Install poetry
-        run: pipx install poetry
+        with:
+          persist-credentials: false
       - name: Set up Python
         uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: "3.14"
-          cache: "poetry"
+      - name: Install uv
+        uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8.0.0
+        with:
+          enable-cache: true
       - name: Build package
-        run: poetry build
+        run: uv build
       - name: Install package
         run: pip3 install dist/purl_tools-*.tar.gz
       - name: Run package
         run: |
           purl-tools --version
           purl-tools --help
 
-  # Formatting
-  pylint:
+  # Quality checks
+  ruff:
     runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: ./.github/actions/poetrybuild
-      - name: Lint with pylint
-        run: poetry run pylint --disable=fixme purltools/ tests/
-
-  formatting:
-    runs-on: ubuntu-24.04
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: ./.github/actions/poetrybuild
-      - name: Test formatting with isort and black
-        run: |
-          poetry run isort --check purltools/ tests/
-          poetry run black --check .
+        with:
+          persist-credentials: false
+      - uses: ./.github/actions/uvbuild
+      - name: Lint with ruff
+        run: uv run ruff check
 
-  mypy:
+  ty:
     runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: ./.github/actions/poetrybuild
-      - name: Test typing with mypy
-        run: poetry run mypy
+        with:
+          persist-credentials: false
+      - uses: ./.github/actions/uvbuild
+      - name: Test typing with ty
+        run: uv run ty check
 
   pytest:
     runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: ./.github/actions/poetrybuild
+        with:
+          persist-credentials: false
+      - uses: ./.github/actions/uvbuild
       - name: Test with pytest
-        run: poetry run pytest
+        run: uv run pytest
 
   # REUSE
   reuse:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
       - name: Check REUSE Compliance
         uses: fsfe/reuse-action@676e2d560c9a403aa252096d99fcab3e1132b0f5 # v6.0.0