Merge branch 'main' into docs_fixes

Author: grst

.github/workflows/deploy-instance-pr-actions.yml

@@ -9,9 +9,19 @@ jobs:
 
     env:
       INSTANCE_REPO_GITHUB: scverse/cookiecutter-scverse-instance
-      GH_TOKEN: ${{ secrets.BOT_GH_TOKEN }} # for gh cli
 
     steps:
+      - name: Generate tokens
+        id: app-token
+        uses: actions/create-github-app-token@v2
+        with:
+          app-id: ${{ vars.PR_CREATOR_APP_ID }}
+          private-key: ${{ secrets.PR_CREATOR_PRIVATE_KEY }}
+          repositories: cookiecutter-scverse-instance
+
+      - name: Authenticate gh CLI with app token
+        run: echo "${{ steps.app-token.outputs.token }}" | gh auth login --with-token
+
       - name: Define sister PR branch name
         run: |
           echo "SISTER_PR_BRANCH=pr-${{ github.event.pull_request.number }}" >> $GITHUB_ENV

.github/workflows/deploy-instance-repo.yml

@@ -16,30 +16,42 @@ jobs:
       # directory in which cookiecuter generates the new repository
       INSTANCE_GENERATED: "TEMPLATE_INSTANCE_GENERATED"
       PROJECT_NAME: "cookiecutter-scverse-instance"
-      GH_TOKEN: ${{ secrets.BOT_GH_TOKEN }} # for gh cli
+      APP_USERNAME: "scverse-pr-creator[bot]"
+      APP_EMAIL: "272303624+scverse-pr-creator[bot]@users.noreply.github.com"
 
     steps:
-      - name: Checkout template repository
-        uses: actions/checkout@v6
+      - name: Install the latest version of uv
+        uses: astral-sh/setup-uv@v7
+        with:
+          cache-dependency-glob: .github/workflows/deploy-instance-repo.yml
 
       - name: Set git identity
         run: |
-          git config --global user.name "scverse-bot"
-          git config --global user.email "108668866+scverse-bot@users.noreply.github.com"
+          git config --global user.name "${{ env.APP_USERNAME }}"
+          git config --global user.email "${{ env.APP_EMAIL }}"
+
+      - name: Checkout template repository
+        uses: actions/checkout@v6
+
+      - name: Generate tokens
+        id: app-token
+        uses: actions/create-github-app-token@v2
+        with:
+          app-id: ${{ vars.PR_CREATOR_APP_ID }}
+          private-key: ${{ secrets.PR_CREATOR_PRIVATE_KEY }}
+          repositories: cookiecutter-scverse-instance
+
+      - name: Authenticate gh CLI with app token
+        run: echo "${{ steps.app-token.outputs.token }}" | gh auth login --with-token
 
       - name: Checkout instance repository
         uses: actions/checkout@v6
         with:
           repository: ${{ env.INSTANCE_REPO_GITHUB }}
-          token: ${{ secrets.BOT_GH_TOKEN }}
+          token: ${{ steps.app-token.outputs.token }}
           path: ${{ env.INSTANCE_REPO }}
           persist-credentials: true
 
-      - name: Install the latest version of uv
-        uses: astral-sh/setup-uv@v7
-        with:
-          cache-dependency-glob: .github/workflows/deploy-instance-repo.yml
-
       - name: define sister PR branch name for pull request
         if: github.event_name == 'pull_request'
         run: |
@@ -79,7 +91,9 @@ jobs:
         if: ${{ env.GIT_HAS_CHANGES == 'TRUE' }}
         uses: EndBug/add-and-commit@v9
         with:
-          default_author: github_actions
+          author_name: ${{ env.APP_USERNAME }}
+          author_email: ${{ env.APP_EMAIL }}
+          default_author: user_info
           commit: "--no-verify" # no need to run pre-commit at this point - saves runtime!
           cwd: ${{ env.INSTANCE_REPO }}
           message: Update instance repo from cookiecutter template
@@ -90,7 +104,7 @@ jobs:
         if: ${{ env.GIT_HAS_CHANGES == 'TRUE' }}
         uses: ad-m/github-push-action@v0.8.0
         with:
-          github_token: ${{ secrets.BOT_GH_TOKEN }}
+          github_token: ${{ steps.app-token.outputs.token }}
           branch: ${{ env.SISTER_PR_BRANCH }}
           repository: scverse/cookiecutter-scverse-instance
           force: false
@@ -144,6 +158,8 @@ jobs:
             [checks]: https://github.com/scverse/cookiecutter-scverse-instance/pull/${{ env.SISTER_PR_ID }}/checks
             [docs-badge]: https://app.readthedocs.org/projects/cookiecutter-scverse-instance/badge/?version=${{ env.SISTER_PR_ID }}
             [docs]: https://cookiecutter-scverse-instance--${{ env.SISTER_PR_ID }}.org.readthedocs.build/
+          # use default token, which allows to comment in the cookiecutter-scverse repo.
+          # The token generated by the app is scoped to the cookiecutter-scverse-instance repo instead.
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           allow-repeats: false
 

.github/workflows/propagate-pre-commit.yml

@@ -10,9 +10,16 @@ jobs:
     runs-on: ubuntu-latest
     if: ${{ github.actor == 'pre-commit-ci[bot]' }}
     steps:
+      - name: Generate tokens
+        id: app-token
+        uses: actions/create-github-app-token@v2
+        with:
+          app-id: ${{ vars.PR_CREATOR_APP_ID }}
+          private-key: ${{ secrets.PR_CREATOR_PRIVATE_KEY }}
+
       - uses: actions/checkout@v6
         with:
-          token: ${{ secrets.BOT_GH_TOKEN }}
+          token: ${{ steps.app-token.outputs.token }}
       - run: pipx install pre-commit
       - run: cd '{{cookiecutter.project_name}}' && pre-commit autoupdate
       - uses: stefanzweifel/git-auto-commit-action@v7

.pre-commit-config.yaml

@@ -1,7 +1,7 @@
 repos:
   # Hooks that are run everywhere
   - repo: https://github.com/biomejs/pre-commit
-    rev: v2.4.4
+    rev: v2.4.6
     hooks:
       - id: biome-format
   # Hooks that are run for scripts
@@ -11,14 +11,14 @@ repos:
       - id: pyproject-fmt
         files: ^scripts/pyproject\.toml$
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.15.4
+    rev: v0.15.5
     hooks:
       - id: ruff-check
         args: [--fix, --exit-non-zero-on-fix]
         files: ^scripts/
       - id: ruff-format
         files: ^scripts/
   - repo: https://github.com/codespell-project/codespell
-    rev: v2.4.1
+    rev: v2.4.2
     hooks:
       - id: codespell

hooks/post_gen_project.py

@@ -34,7 +34,10 @@ def skipped_dirs():
 run(args=["git", "commit", "--no-verify", "--no-gpg-sign", "-m", msg], check=True)
 
 # Install pre-commit
-run(["pre-commit", "install"], check=True)
+try:
+    run(["prek", "install"], check=True)
+except FileNotFoundError:
+    run(["pre-commit", "install"], check=True)
 
 # The following output was generated using rich
 # The formatted output is included here directly, because I don't want

{{cookiecutter.project_name}}/.pre-commit-config.yaml

@@ -7,7 +7,7 @@ default_stages:
 minimum_pre_commit_version: 2.16.0
 repos:
   - repo: https://github.com/biomejs/pre-commit
-    rev: v2.4.4
+    rev: v2.4.6
     hooks:
       - id: biome-format
         exclude: ^\.cruft\.json$ # inconsistent indentation with cruft - file never to be modified manually.
@@ -16,7 +16,7 @@ repos:
     hooks:
       - id: pyproject-fmt
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.15.4
+    rev: v0.15.5
     hooks:
       - id: ruff-check
         types_or: [python, pyi, jupyter]

{{cookiecutter.project_name}}/docs/template_usage.md

@@ -147,7 +147,8 @@ There you can see the execution history, logs, and (re-)trigger workflows manual
 
 ## Automating the PyPI release using GitHub actions
 
-Tags adhering to `"*.*.*"` that are pushed to the `main` branch will trigger the release Github workflow that automatically builds and uploads the Python package to [PyPI][].
+Releases created via the [Github releases UI][github-releases]
+will trigger the release Github workflow that automatically builds and uploads the Python package to [PyPI][].
 
 For this to work, you'll need to setup GitHub as a [trusted publisher][] on PyPI.
 To set this up, login to [PyPI][], and proceed depending on whether you already have your project on there or not:
@@ -159,6 +160,10 @@ The "Workflow name" needs to bet set to `release.yaml`.
 Set "Environment name" to “pypi” to match `environment: pypi` in `.github/workflows/release.yaml`.
 For more details, please refer to the official [PyPI guide for setting up trusted publishing][trusted publisher].
 
+If you added a new pending publisher to set up your project,
+the project will be published only once you release your package for the first time (see above).
+
+[github-releases]: https://docs.github.com/en/repositories/releasing-projects-on-github/about-releases
 [pypi-trusted-publishing-guide]: https://docs.pypi.org/trusted-publishers/adding-a-publisher/
 
 [PyPI]: https://pypi.org/