fix: Add workflow-level permissions and GITHUB_TOKEN for Docker push

- Add workflow-level permissions for packages:write
- Explicitly pass GITHUB_TOKEN to build.py
- Update pre-commit to match CI Ruff configuration exactly

Author: aronchick

.github/workflows/release.yml

@@ -11,6 +11,11 @@ on:
         required: true
         type: string
 
+permissions:
+  contents: write
+  packages: write
+  id-token: write
+
 env:
   REGISTRY: ghcr.io
   IMAGE_NAME: ${{ github.repository }}
@@ -49,7 +54,7 @@ jobs:
       contents: write
       packages: write
       id-token: write
-    
+
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
@@ -92,66 +97,66 @@ jobs:
         run: |
           # Get the previous tag
           PREVIOUS_TAG=$(git describe --tags --abbrev=0 "${VERSION}^" 2>/dev/null || echo "")
-          
+
           if [ -z "$PREVIOUS_TAG" ]; then
             echo "No previous tag found, including all commits"
             COMMIT_RANGE=""
           else
             echo "Generating changelog from $PREVIOUS_TAG to $VERSION"
             COMMIT_RANGE="$PREVIOUS_TAG..$VERSION"
           fi
-          
+
           # Generate changelog
           {
             echo "CHANGELOG<<EOF"
             echo "## 🚀 What's Changed"
             echo ""
-            
+
             # Features
             FEATURES=$(git log $COMMIT_RANGE --pretty=format:"* %s (%h)" --grep="^feat" 2>/dev/null)
             if [ -n "$FEATURES" ]; then
               echo "### ✨ Features"
               echo "$FEATURES"
               echo ""
             fi
-            
+
             # Bug fixes
             FIXES=$(git log $COMMIT_RANGE --pretty=format:"* %s (%h)" --grep="^fix" 2>/dev/null)
             if [ -n "$FIXES" ]; then
               echo "### 🐛 Bug Fixes"
               echo "$FIXES"
               echo ""
             fi
-            
+
             # Documentation
             DOCS=$(git log $COMMIT_RANGE --pretty=format:"* %s (%h)" --grep="^docs" 2>/dev/null)
             if [ -n "$DOCS" ]; then
               echo "### 📚 Documentation"
               echo "$DOCS"
               echo ""
             fi
-            
+
             # Performance
             PERF=$(git log $COMMIT_RANGE --pretty=format:"* %s (%h)" --grep="^perf" 2>/dev/null)
             if [ -n "$PERF" ]; then
               echo "### ⚡ Performance"
               echo "$PERF"
               echo ""
             fi
-            
+
             # All other commits
             OTHER=$(git log $COMMIT_RANGE --pretty=format:"* %s (%h)" --grep="^feat" --grep="^fix" --grep="^docs" --grep="^perf" --invert-grep 2>/dev/null)
             if [ -n "$OTHER" ]; then
               echo "### 🔧 Other Changes"
               echo "$OTHER"
               echo ""
             fi
-            
+
             # Contributors
             echo "### 👥 Contributors"
             git log $COMMIT_RANGE --pretty=format:"* @%an" | sort -u
             echo ""
-            
+
             # Statistics
             if [ -n "$COMMIT_RANGE" ]; then
               echo "### 📊 Statistics"
@@ -160,32 +165,34 @@ jobs:
               echo "* $COMMITS commits"
               echo "* $FILES"
             fi
-            
+
             echo "EOF"
           } >> $GITHUB_OUTPUT
 
       - name: Build and push with build.py
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           # Install Python dependencies for build script
           pip install rich click semver pyyaml
-          
+
           # Set CI environment variable to ensure proper tagging
           export CI=true
-          
+
           # Build and push with the specific version tag
           python build.py --version-tag ${{ steps.version.outputs.version_number }}
-          
+
           # Additional tags for releases
           docker tag ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:v${{ steps.version.outputs.version_number }} ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
           docker push ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
-          
+
           # Create major and minor version tags
           MAJOR=$(echo ${{ steps.version.outputs.version_number }} | cut -d. -f1)
           MINOR=$(echo ${{ steps.version.outputs.version_number }} | cut -d. -f1,2)
-          
+
           docker tag ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:v${{ steps.version.outputs.version_number }} ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:v${MAJOR}
           docker push ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:v${MAJOR}
-          
+
           docker tag ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:v${{ steps.version.outputs.version_number }} ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:v${MINOR}
           docker push ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:v${MINOR}
 
@@ -203,7 +210,7 @@ jobs:
           # Install cosign
           curl -sSL https://github.com/sigstore/cosign/releases/latest/download/cosign-linux-amd64 -o /tmp/cosign
           chmod +x /tmp/cosign
-          
+
           # Sign the images
           /tmp/cosign sign --yes ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:v${{ steps.version.outputs.version_number }}
           /tmp/cosign sign --yes ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
@@ -221,32 +228,32 @@ jobs:
             sbom.spdx.json
           body: |
             ## 🐳 Docker Images
-            
+
             ### Pull the image:
             ```bash
             # Latest version
             docker pull ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
-            
+
             # Specific version
             docker pull ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.version }}
-            
+
             # Major version (will update with patches)
             docker pull ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:v$(echo ${{ steps.version.outputs.version_number }} | cut -d. -f1)
             ```
-            
+
             ### Run the container:
             ```bash
             # Using docker-compose (recommended)
             docker-compose up -d
-            
+
             # Or using docker run
             docker run -d \
               --name sensor-log-generator \
               -v $(pwd)/data:/app/data \
               -v $(pwd)/config:/app/config \
               ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.version }}
             ```
-            
+
             ### Run with WAL mode disabled (for Docker Desktop on Mac/Windows):
             ```bash
             docker run -d \
@@ -255,17 +262,17 @@ jobs:
               -e SENSOR_WAL=false \
               ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.version }}
             ```
-            
+
             ---
-            
+
             ${{ steps.changelog.outputs.CHANGELOG }}
-            
+
             ---
-            
+
             ## 📦 Assets
             - **SBOM**: Software Bill of Materials attached below
             - **Container Signature**: Images are signed with Cosign/Sigstore
-            
+
             ## 🔗 Quick Links
             - [Documentation](https://github.com/${{ github.repository }}/blob/main/README.md)
             - [Container Registry](https://github.com/${{ github.repository }}/pkgs/container/${{ github.event.repository.name }})

.pre-commit-config.yaml

@@ -9,15 +9,17 @@ repos:
       - id: check-ast
         name: Check Python syntax
 
-  # Ruff - Auto-fix formatting and basic linting issues
+  # Ruff - Auto-fix formatting and linting issues (uses pyproject.toml config)
   - repo: https://github.com/astral-sh/ruff-pre-commit
     rev: v0.12.10
     hooks:
       - id: ruff
         name: Ruff auto-fix
-        args: [--fix, --select, "F,E,W,I,TRY", --ignore, "E501,W293,TRY401"]  # Include TRY rules, ignore redundant exception in log
+        args: [--fix]  # Uses config from pyproject.toml
+        files: ^(src/|tests/|main\.py)
       - id: ruff-format
         name: Ruff formatter
+        files: ^(src/|tests/|main\.py)
 
   # Basic file checks (fast)
   - repo: https://github.com/pre-commit/pre-commit-hooks
@@ -48,8 +50,8 @@ repos:
   - repo: local
     hooks:
       - id: full-lint
-        name: Full linting check
-        entry: uv run ruff check src/ tests/ main.py
+        name: Full linting check (same as CI)
+        entry: bash -c 'uv run ruff check src/ tests/ main.py && uv run ruff format --check src/ tests/ main.py'
         language: system
         pass_filenames: false
         stages: [manual]

build.py

@@ -19,7 +19,6 @@
 import sys
 from datetime import datetime
 from pathlib import Path
-from typing import Optional
 
 import click
 import semver
@@ -39,7 +38,7 @@ class BuildError(Exception):
 class DockerComposeBuilder:
     def __init__(
         self,
-        image_name: Optional[str] = None,
+        image_name: str | None = None,
         platforms: str = "linux/amd64,linux/arm64",
         dockerfile: str = "Dockerfile",
         registry: str = "ghcr.io",
@@ -366,7 +365,7 @@ def setup_buildx_builder(self):
         console.print("[green]✓[/green] Builder created and ready")
         return True
 
-    def get_current_version(self) -> Optional[semver.Version]:
+    def get_current_version(self) -> semver.Version | None:
         """Get the current version from git tags"""
         try:
             result = self._run_command(["git", "tag", "--list", "v*"], check=False)
@@ -389,7 +388,7 @@ def get_current_version(self) -> Optional[semver.Version]:
             pass
         return None
 
-    def bump_version(self, current: Optional[semver.Version], bump_type: str) -> semver.Version:
+    def bump_version(self, current: semver.Version | None, bump_type: str) -> semver.Version:
         """Bump the version based on type"""
         if current is None:
             # Start with 1.0.0 if no version exists
@@ -677,11 +676,11 @@ def cleanup(self):
     help="Docker Compose file for building",
 )
 def main(
-    image_name: Optional[str],
+    image_name: str | None,
     platforms: str,
     dockerfile: str,
     registry: str,
-    version_tag: Optional[str],
+    version_tag: str | None,
     version_bump: str,
     dev_mode: bool,
     skip_push: bool,