Migrate QGIS plugin to Qt5/Qt6 dual compatibility (QGIS 4.0) (#249)

* Migrate QGIS plugin to Qt5/Qt6 dual compatibility (QGIS 4.0)

Single codebase that loads on QGIS 3.28+ (PyQt5) and QGIS 4.0 (PyQt6).
Plugin now appears on the QGIS 4 Ready list via qgisMaximumVersion=4.99.

- Run upstream scripts/pyqt5_to_pyqt6 migrator to fully-qualify Qt enums
  (Qt.AlignmentFlag.AlignCenter, QMessageBox.StandardButton.Yes, etc.).
  Fully-qualified form works on both PyQt5 (>=5.15) and PyQt6.
- Hand-qualify QGIS core enums the script cannot introspect:
  Qgis.Info -> Qgis.MessageLevel.Info, QgsWkbTypes.PointGeometry ->
  QgsWkbTypes.GeometryType.PointGeometry, etc.
- metadata.txt: bump version 0.6.0 -> 0.7.0, add qgisMaximumVersion=4.99,
  changelog entry. (No supportsQt6 flag; that field was removed in QGIS 4.)
- update_checker.py: add _require_https() guard before urlopen/urlretrieve;
  annotate the two call sites with # nosec B310 (defense-in-depth for
  hardcoded https GitHub constants).
- qgis_plugin/tests/: add PyQt6 import-smoke tests (auto-discovers plugin
  package via metadata.txt) with a qgis.PyQt -> PyQt6 stub conftest.
- .github/workflows/qgis-plugin.yml: new CI with Bandit (matches the
  plugins.qgis.org medium-severity gate) and PyQt6 import smoke matrix
  (Python 3.10-3.13 with the libEGL/libGL runtime libs PyQt6.QtGui dlopens).
- .pre-commit-config.yaml: add Bandit hook scoped to qgis_plugin/.

References:
- https://github.com/qgis/QGIS/wiki/Plugin-migration-to-be-compatible-with-Qt5-and-Qt6
- https://plugins.qgis.org/docs/migrate-qgis4

* Address Copilot review feedback

- conftest.py: gate PyQt6 imports behind pytest.importorskip so other
  pytest invocations (e.g. `pytest .` from the repo root) don't fail
  collection when PyQt6 is absent.
- test_pyqt6_imports.py: explicitly insert PLUGIN_ROOT.parent on
  sys.path before importlib.import_module so the test does not depend
  on pytest's rootdir detection. Mirrors how QGIS adds plugin parent
  dirs to sys.path.
- update_checker.py: move the two `# nosec B310` annotations from the
  closing-paren line onto the line containing `urlopen(` /
  `urlretrieve(`, where Bandit attaches the finding. Same suppression
  count (2) but more robust across Bandit versions.
- qgis-plugin.yml: pin `pip install bandit==1.9.4` to match the
  pre-commit revision so local and CI runs use the same Bandit ruleset.

* Rename qgis_plugin/tests -> qgis_plugin/qt6_tests to avoid pytest package collision

The repo already has a top-level tests/ package (with __init__.py).
Adding qgis_plugin/tests/__init__.py registered a second `tests` package
with the same dotted name, so pytest's default prepend importmode
collapsed both into one entry in sys.modules. The first one to be
collected won, and every test in the other directory then failed with
`ModuleNotFoundError: No module named 'tests.test_<x>'` -- breaking the
existing ubuntu/macos/windows CI workflows that run `pytest .` from the
repo root.

Renaming to qt6_tests gives the smoke tests a unique top-level package
name. The auto-discovery in test_pyqt6_imports.py is name-agnostic
(it globs `*/metadata.txt`), so no test logic changes are needed; only
the CI workflow path is updated.

Author: giswqs

.github/workflows/qgis-plugin.yml

@@ -0,0 +1,52 @@
+name: QGIS plugin
+
+on:
+    push:
+        branches: ["**"]
+        paths:
+            - "qgis_plugin/**"
+            - ".github/workflows/qgis-plugin.yml"
+            - ".pre-commit-config.yaml"
+    pull_request:
+        branches: [main]
+        paths:
+            - "qgis_plugin/**"
+            - ".github/workflows/qgis-plugin.yml"
+            - ".pre-commit-config.yaml"
+
+jobs:
+    bandit:
+        name: Bandit security scan
+        runs-on: ubuntu-latest
+        steps:
+            - uses: actions/checkout@v6
+            - uses: actions/setup-python@v6
+              with:
+                  python-version: "3.13"
+            - name: Install Bandit
+              run: pip install bandit==1.9.4
+            - name: Run Bandit (matches plugins.qgis.org security gate)
+              run: bandit -r qgis_plugin/hypercoast_qgis -ll
+
+    pyqt6-smoke:
+        name: PyQt6 import smoke
+        runs-on: ubuntu-latest
+        strategy:
+            fail-fast: false
+            matrix:
+                python-version: ["3.10", "3.11", "3.12", "3.13"]
+        steps:
+            - uses: actions/checkout@v6
+            - uses: actions/setup-python@v6
+              with:
+                  python-version: ${{ matrix.python-version }}
+            - name: Install Qt6 runtime libs
+              run: |
+                  sudo apt-get update
+                  sudo apt-get install -y libegl1 libgl1 libxkbcommon0 libdbus-1-3 libfontconfig1
+            - name: Install PyQt6, pytest, and plugin runtime deps
+              run: |
+                  python -m pip install --upgrade pip
+                  pip install PyQt6 PyQt6-QScintilla pytest numpy Pillow
+            - name: Run import smoke tests
+              run: pytest qgis_plugin/qt6_tests -v

.pre-commit-config.yaml

@@ -36,3 +36,10 @@ repos:
       rev: v6.2.0
       hooks:
           - id: reuse
+
+    - repo: https://github.com/PyCQA/bandit
+      rev: 1.9.4
+      hooks:
+          - id: bandit
+            args: ["-r", "qgis_plugin/hypercoast_qgis", "-ll"]
+            pass_filenames: false

qgis_plugin/hypercoast_qgis/core/python_manager.py

@@ -41,12 +41,12 @@
 }
 
 
-def _log(message, level=Qgis.Info):
+def _log(message, level=Qgis.MessageLevel.Info):
     """Log a message to the QGIS message log.
 
     Args:
         message: The message to log.
-        level: The log level (Qgis.Info, Qgis.Warning, Qgis.Critical).
+        level: The log level (Qgis.MessageLevel.Info, Qgis.MessageLevel.Warning, Qgis.MessageLevel.Critical).
     """
     QgsMessageLog.logMessage(str(message), "HyperCoast", level=level)
 
@@ -217,7 +217,7 @@ def download_python_standalone(progress_callback=None, cancel_check=None):
                 )
             else:
                 error_msg = f"Download failed: {error_msg}"
-            _log(error_msg, Qgis.Critical)
+            _log(error_msg, Qgis.MessageLevel.Critical)
             return False, error_msg
 
         if cancel_check and cancel_check():
@@ -258,7 +258,7 @@ def download_python_standalone(progress_callback=None, cancel_check=None):
         if success:
             if progress_callback:
                 progress_callback(100, f"Python {python_version} installed")
-            _log("Python standalone installed successfully", Qgis.Success)
+            _log("Python standalone installed successfully", Qgis.MessageLevel.Success)
             return True, f"Python {python_version} installed successfully"
         else:
             return False, f"Verification failed: {verify_msg}"
@@ -267,7 +267,7 @@ def download_python_standalone(progress_callback=None, cancel_check=None):
         return False, "Download cancelled"
     except Exception as e:
         error_msg = f"Installation failed: {str(e)}"
-        _log(error_msg, Qgis.Critical)
+        _log(error_msg, Qgis.MessageLevel.Critical)
 
         if sys.platform == "win32":
             error_lower = str(e).lower()
@@ -339,14 +339,20 @@ def verify_standalone_python():
             if not version_output.startswith(
                 f"{sys.version_info.major}.{sys.version_info.minor}"
             ):
-                _log(f"Python version mismatch: got {version_output}", Qgis.Warning)
+                _log(
+                    f"Python version mismatch: got {version_output}",
+                    Qgis.MessageLevel.Warning,
+                )
                 return False, f"Version mismatch: {version_output}"
 
-            _log(f"Verified Python standalone: {version_output}", Qgis.Success)
+            _log(
+                f"Verified Python standalone: {version_output}",
+                Qgis.MessageLevel.Success,
+            )
             return True, f"Python {version_output} verified"
         else:
             error = result.stderr or "Unknown error"
-            _log(f"Python verification failed: {error}", Qgis.Warning)
+            _log(f"Python verification failed: {error}", Qgis.MessageLevel.Warning)
             return False, f"Verification failed: {error[:100]}"
 
     except subprocess.TimeoutExpired:
@@ -366,9 +372,9 @@ def remove_standalone_python():
 
     try:
         shutil.rmtree(STANDALONE_DIR)
-        _log("Removed standalone Python installation", Qgis.Success)
+        _log("Removed standalone Python installation", Qgis.MessageLevel.Success)
         return True, "Standalone Python removed"
     except Exception as e:
         error_msg = f"Failed to remove: {str(e)}"
-        _log(error_msg, Qgis.Warning)
+        _log(error_msg, Qgis.MessageLevel.Warning)
         return False, error_msg

qgis_plugin/hypercoast_qgis/core/uv_manager.py

@@ -32,12 +32,12 @@
 UV_VERSION = "0.10.6"
 
 
-def _log(message, level=Qgis.Info):
+def _log(message, level=Qgis.MessageLevel.Info):
     """Log a message to the QGIS message log.
 
     Args:
         message: The message to log.
-        level: The log level (Qgis.Info, Qgis.Warning, Qgis.Critical).
+        level: The log level (Qgis.MessageLevel.Info, Qgis.MessageLevel.Warning, Qgis.MessageLevel.Critical).
     """
     QgsMessageLog.logMessage(str(message), "HyperCoast", level=level)
 
@@ -142,7 +142,7 @@ def download_uv(progress_callback=None, cancel_check=None):
                 )
             else:
                 error_msg = f"Download failed: {error_msg}"
-            _log(error_msg, Qgis.Critical)
+            _log(error_msg, Qgis.MessageLevel.Critical)
             return False, error_msg
 
         if cancel_check and cancel_check():
@@ -213,7 +213,7 @@ def download_uv(progress_callback=None, cancel_check=None):
         if success:
             if progress_callback:
                 progress_callback(100, f"uv {UV_VERSION} installed")
-            _log("uv installed successfully", Qgis.Success)
+            _log("uv installed successfully", Qgis.MessageLevel.Success)
             return True, f"uv {UV_VERSION} installed successfully"
         else:
             return False, f"Verification failed: {verify_msg}"
@@ -222,7 +222,7 @@ def download_uv(progress_callback=None, cancel_check=None):
         return False, "Download cancelled"
     except Exception as e:
         error_msg = f"uv installation failed: {str(e)}"
-        _log(error_msg, Qgis.Critical)
+        _log(error_msg, Qgis.MessageLevel.Critical)
         return False, error_msg
     finally:
         if os.path.exists(temp_path):
@@ -279,11 +279,11 @@ def verify_uv():
 
         if result.returncode == 0:
             version_output = result.stdout.strip()
-            _log(f"Verified uv: {version_output}", Qgis.Success)
+            _log(f"Verified uv: {version_output}", Qgis.MessageLevel.Success)
             return True, version_output
         else:
             error = result.stderr or "Unknown error"
-            _log(f"uv verification failed: {error}", Qgis.Warning)
+            _log(f"uv verification failed: {error}", Qgis.MessageLevel.Warning)
             return False, f"Verification failed: {error[:100]}"
 
     except subprocess.TimeoutExpired:
@@ -303,9 +303,9 @@ def remove_uv():
 
     try:
         shutil.rmtree(UV_DIR)
-        _log("Removed uv installation", Qgis.Success)
+        _log("Removed uv installation", Qgis.MessageLevel.Success)
         return True, "uv removed"
     except Exception as e:
         error_msg = f"Failed to remove uv: {str(e)}"
-        _log(error_msg, Qgis.Warning)
+        _log(error_msg, Qgis.MessageLevel.Warning)
         return False, error_msg