Merge 'jupyterhub:main' into autocreate-pages-branch

Author: minrk

.bumpversion.cfg

@@ -0,0 +1,20 @@
+# dependabot.yaml reference: https://docs.github.com/en/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/configuration-options-for-dependency-updates
+#
+# Notes:
+# - Status and logs from dependabot are provided at
+#   https://github.com/jupyterhub/chartpress/network/updates.
+# - YAML anchors are not supported here or in GitHub Workflows.
+#
+version: 2
+updates:
+  # Maintain dependencies in our GitHub Workflows
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: monthly
+    groups:
+      actions:
+        patterns:
+          - "*"
+    cooldown:
+      default-days: 7

.github/dependabot.yaml

@@ -0,0 +1,73 @@
+# This is a GitHub workflow defining a set of jobs with a set of steps.
+# ref: https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions
+#
+name: Release
+
+# Always tests wheel building, but only publish to PyPI on pushed tags.
+on:
+  pull_request:
+    paths-ignore:
+      - ".github/workflows/*.yaml"
+      - "!.github/workflows/release.yaml"
+  push:
+    paths-ignore:
+      - ".github/workflows/*.yaml"
+      - "!.github/workflows/release.yaml"
+    branches-ignore:
+      - "dependabot/**"
+      - "pre-commit-ci-update-config"
+    tags:
+      - "**"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  build-release:
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version: "3.13"
+
+      - name: install build requirements
+        run: |
+          pip install --upgrade pip
+          pip install build
+          pip list --format=freeze
+
+      - name: build release
+        run: |
+          python -m build --sdist --wheel .
+          ls -l dist
+
+      # ref: https://github.com/actions/upload-artifact#readme
+      - name: upload dists
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        with:
+          name: ${{ github.repository.name }}-dist
+          path: dist/
+
+  pypi-publish:
+    runs-on: ubuntu-24.04
+    if: startsWith(github.ref, 'refs/tags/')
+    environment:
+      name: release
+    needs:
+      - build-release
+    permissions:
+      id-token: write
+
+    steps:
+      - name: Get release artifacts
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: ${{ github.repository.name }}-dist
+          path: dist/
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # release/v1

.github/dependabot.yml

@@ -1,5 +1,5 @@
 # This is a GitHub workflow defining a set of jobs with a set of steps.
-# ref: https://docs.github.com/en/free-pro-team@latest/actions/reference/workflow-syntax-for-github-actions
+# ref: https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions
 #
 name: Test
 
@@ -19,9 +19,12 @@ on:
       - "pre-commit-ci-update-config"
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   chart-tests:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-22.04
 
     strategy:
       # Keep running even if one variation of the job fail
@@ -36,6 +39,9 @@ jobs:
           - python: "3.8"
           - python: "3.9"
           - python: "3.10"
+          - python: "3.11"
+          - python: "3.12"
+          - python: "3.13"
 
     services:
       local-registry:
@@ -44,22 +50,22 @@ jobs:
           - 5000:5000
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           # chartpress requires the full history
           fetch-depth: 0
+          persist-credentials: false
 
-      # NOTE: actions/setup-python@v4 make use of a cache within the GitHub base
+      # NOTE: actions/setup-python@v6 make use of a cache within the GitHub base
       #       environment and setup in a fraction of a second.
-      - uses: actions/setup-python@v4
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
           python-version: "${{ matrix.python }}"
 
       - name: Install Python dependencies
         run: |
           pip install --upgrade pip
-          pip install .
-          pip install -r dev-requirements.txt
+          pip install ".[test]"
           pip freeze
 
       - name: Install helm
@@ -75,7 +81,7 @@ jobs:
 
       # https://github.com/docker/setup-buildx-action
       - name: Setup docker buildx
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4
         with:
           # Allows pushing to registry on localhost:5000
           driver-opts: network=host
@@ -99,4 +105,9 @@ jobs:
 
       - name: Run tests
         run: |
-          pytest --verbose --color=yes
+          pytest
+        env:
+          HELM2: ${{ matrix.helm2 }}
+
+      # GitHub action reference: https://github.com/codecov/codecov-action
+      - uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6

.github/workflows/publish.yaml

@@ -9,28 +9,35 @@
 # - Register git hooks: pre-commit install --install-hooks
 #
 repos:
+  # Autoformat: Python code, syntax patterns are modernized
+  - repo: https://github.com/asottile/pyupgrade
+    rev: 75992aaa40730136014f34227e0135f63fc951b4 # frozen: v3.21.2
+    hooks:
+      - id: pyupgrade
+        args:
+          - --py37-plus
+
   # Autoformat: Python code
-  - repo: https://github.com/psf/black
-    rev: 22.3.0
+  - repo: https://github.com/psf/black-pre-commit-mirror
+    rev: fa505ab9c3e0fedafe1709fd7ac2b5f8996c670d # frozen: 26.3.1
     hooks:
       - id: black
-        args: [--target-version=py36]
 
-  # Autoformat: markdown, yaml
-  - repo: https://github.com/pre-commit/mirrors-prettier
-    rev: v2.6.2
+  # Autoformat: Python code
+  - repo: https://github.com/pycqa/isort
+    rev: a333737ed43df02b18e6c95477ea1b285b3de15a # frozen: 8.0.1
     hooks:
-      - id: prettier
+      - id: isort
 
-  # Autoformat: https://github.com/asottile/reorder_python_imports
-  - repo: https://github.com/asottile/reorder_python_imports
-    rev: v3.1.0
+  # Autoformat: markdown, yaml
+  - repo: https://github.com/rbubley/mirrors-prettier
+    rev: c2bc67fe8f8f549cc489e00ba8b45aa18ee713b1 # frozen: v3.8.1
     hooks:
-      - id: reorder-python-imports
+      - id: prettier
 
   # Misc...
   - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v4.2.0
+    rev: 3e8a8703264a2f4a69428a0aa4dcb512790b2c8c # frozen: v6.0.0
     # ref: https://github.com/pre-commit/pre-commit-hooks#hooks-available
     hooks:
       # Autoformat: Makes sure files end in a newline and only a newline.
@@ -48,6 +55,18 @@ repos:
 
   # Lint: Python code
   - repo: https://github.com/PyCQA/flake8
-    rev: "4.0.1"
+    rev: "d93590f5be797aabb60e3b09f2f52dddb02f349f" # frozen: 7.3.0
     hooks:
       - id: flake8
+
+  # github actions security checks
+  - repo: https://github.com/zizmorcore/zizmor-pre-commit
+    rev: ea2eb407b4cbce87cf0d502f36578950494f5ac9 # frozen: v1.23.1
+    hooks:
+      - id: zizmor
+        args:
+          - --fix=all
+
+# pre-commit.ci config reference: https://pre-commit.ci/#configuration
+ci:
+  autoupdate_schedule: monthly

.github/workflows/release.yaml

@@ -0,0 +1,15 @@
+version: 2
+sphinx:
+  configuration: docs/source/conf.py
+python:
+  install:
+    - requirements: docs/requirements.txt
+    - method: pip
+      path: .
+build:
+  os: "ubuntu-24.04"
+  tools:
+    python: "3.13"
+  jobs:
+    pre_build:
+      - cd docs && ./create-zip.sh