Staging

.devcontainer/compose.yaml

@@ -0,0 +1,11 @@
+services:
+  app:
+    build:
+      context: ..
+      dockerfile: .devcontainer/dockerfile
+    volumes:
+      - ..:/workspace
+    command: sleep infinity
+    user: vscode
+
+

.devcontainer/devcontainer.json

@@ -0,0 +1,28 @@
+{
+    "name": "python 3.10 & uv",
+    "dockerComposeFile": "compose.yaml",
+    "service": "app",
+    "workspaceFolder": "/workspace",
+    "remoteUser": "vscode",
+    "runArgs": [
+        "--userns=keep-id"
+    ],
+    "containerEnv": {
+        "HOME": "/home/vscode"
+    },
+    "postCreateCommand": ".devcontainer/post-create.sh",
+    "customizations": {
+        "vscode": {
+            "extensions": [
+                "hashicorp.terraform",
+                "ms-python.black-formatter"
+            ],
+            "settings": {
+                "[python]": {
+                    "editor.defaultFormatter": "ms-python.black-formatter",
+                    "editor.formatOnSave": true
+                  }
+            }
+        }
+    }
+}

.devcontainer/dockerfile

@@ -0,0 +1,37 @@
+FROM mcr.microsoft.com/devcontainers/python:3.10-bookworm
+
+# Copy uv and uvx from the official image
+COPY --from=ghcr.io/astral-sh/uv:0.4.30 /uv /uvx /bin/
+
+# Enable bytecode compilation
+ENV UV_COMPILE_BYTECODE=1
+
+# Copy from the cache instead of linking since it's a mounted volume
+ENV UV_LINK_MODE=copy
+
+# Install gcloud cli
+RUN echo "deb [signed-by=/usr/share/keyrings/cloud.google.gpg] https://packages.cloud.google.com/apt cloud-sdk main" | tee -a /etc/apt/sources.list.d/google-cloud-sdk.list && curl https://packages.cloud.google.com/apt/doc/apt-key.gpg | sudo gpg --dearmor -o /usr/share/keyrings/cloud.google.gpg && apt-get update -y && apt-get install google-cloud-cli=500.0.0-0 -y
+
+# Install gh cli
+RUN (type -p wget >/dev/null || (sudo apt update && sudo apt-get install wget -y)) \
+	&& sudo mkdir -p -m 755 /etc/apt/keyrings \
+	&& wget -qO- https://cli.github.com/packages/githubcli-archive-keyring.gpg | sudo tee /etc/apt/keyrings/githubcli-archive-keyring.gpg > /dev/null \
+	&& sudo chmod go+r /etc/apt/keyrings/githubcli-archive-keyring.gpg \
+	&& echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" | sudo tee /etc/apt/sources.list.d/github-cli.list > /dev/null \
+	&& sudo apt update \
+	&& sudo apt install gh -y
+
+# Install terraform
+RUN sudo apt-get update && sudo apt-get install -y gnupg software-properties-common \
+	&& wget -O- https://apt.releases.hashicorp.com/gpg | \
+	gpg --dearmor | \
+	sudo tee /usr/share/keyrings/hashicorp-archive-keyring.gpg > /dev/null \
+	&& gpg --no-default-keyring \
+	--keyring /usr/share/keyrings/hashicorp-archive-keyring.gpg \
+	--fingerprint \
+	&& echo "deb [signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] \
+	https://apt.releases.hashicorp.com $(lsb_release -cs) main" | \
+	sudo tee /etc/apt/sources.list.d/hashicorp.list \
+	&& sudo apt update && sudo apt-get install terraform
+
+

.devcontainer/post-create.sh

@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+
+source devtools/lib.sh
+
+# Install dependencies
+runcmd uv sync --frozen --no-install-project --no-dev
+
+# Init gcloud cli
+runcmd gcloud init --skip-diagnostics
+runcmd gcloud auth application-default login --impersonate-service-account [email protected]
+
+# Init gh cli
+runcmd gh auth login

.dockerignore

@@ -0,0 +1,2 @@
+# Exclude the project virtual environment from image builds
+.venv

.github/CODEOWNERS

@@ -0,0 +1,6 @@
+# ref: https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners
+
+pdp/ @bdewilde @kaylawilding @vishpillai123
+zogotech/ @anzhely
+modeling/ @bdewilde
+# todo: target bias code => who ??

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,38 @@
+---
+name: Bug report
+about: Create a report to help us improve
+title: ''
+labels: ''
+assignees: ''
+
+---
+
+**Describe the bug**
+A clear and concise description of what the bug is.
+
+**To Reproduce**
+Steps to reproduce the behavior:
+1. Go to '...'
+2. Click on '....'
+3. Scroll down to '....'
+4. See error
+
+**Expected behavior**
+A clear and concise description of what you expected to happen.
+
+**Screenshots**
+If applicable, add screenshots to help explain your problem.
+
+**Desktop (please complete the following information):**
+ - OS: [e.g. iOS]
+ - Browser [e.g. chrome, safari]
+ - Version [e.g. 22]
+
+**Smartphone (please complete the following information):**
+ - Device: [e.g. iPhone6]
+ - OS: [e.g. iOS8.1]
+ - Browser [e.g. stock browser, safari]
+ - Version [e.g. 22]
+
+**Additional context**
+Add any other context about the problem here.

.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,20 @@
+---
+name: Feature request
+about: Suggest an idea for this project
+title: ''
+labels: ''
+assignees: ''
+
+---
+
+**Is your feature request related to a problem? Please describe.**
+A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
+
+**Describe the solution you'd like**
+A clear and concise description of what you want to happen.
+
+**Describe alternatives you've considered**
+A clear and concise description of any alternative solutions or features you've considered.
+
+**Additional context**
+Add any other context or screenshots about the feature request here.

.github/ISSUE_TEMPLATE/maintenance_task.md

@@ -0,0 +1,14 @@
+---
+name: Maintenance task
+about: Suggest a maintenance task
+title: ''
+labels: ''
+assignees: ''
+
+---
+
+**Describe your maintenance task**
+A clear and concise description of what your propose and why it will improve the codebase [...]
+
+**Additional context**
+Add any other context or screenshots about the feature request here.

.github/ISSUE_TEMPLATE/security_issue.md

@@ -0,0 +1,22 @@
+---
+name: Security issue
+about: Report a security issue
+title: ''
+labels: ''
+assignees: ''
+
+---
+
+**Describe the bug**
+
+**Security issue description**
+
+*Describe the security issue here*
+
+**Impact**
+
+*What impact does this security issue have?*
+
+**Mitigation**
+
+*If you have suggestions to mitigate the issue, please provide them here*

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,11 @@
+<!--- Provide a brief description of your changes in the title above. -->
+
+## changes
+<!--- Describe your changes in detail, to guide reviewers through the git diff. -->
+
+## context
+<!--- Why are these change required? What problem does it solve? -->
+<!--- If this fixes an open issue / is ticketed, put the link(s) here! -->
+
+## questions
+<!--- Ask any specific questions that you'd like reviewers to address. -->

.github/actions/setup-python-env/action.yml

@@ -0,0 +1,23 @@
+name: "Set Up Python Environment"
+
+inputs:
+  python-version:
+    description: "Python version to use"
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - name: Install python
+      uses: actions/setup-python@v5
+      with:
+        python-version: ${{ inputs.python-version }}
+    - name: Install uv
+      uses: astral-sh/setup-uv@v3
+      with:
+        version: "0.5.4"
+        enable-cache: true
+        cache-dependency-glob: "uv.lock"
+    - name: Install project and dependencies
+      run: uv sync --frozen --dev
+      shell: bash

.github/dependabot.yml

@@ -0,0 +1,11 @@
+# To get started with Dependabot version updates, you'll need to specify which
+# package ecosystems to update and where the package manifests are located.
+# Please see the documentation for all configuration options:
+# https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
+
+version: 2
+updates:
+  - package-ecosystem: "" # See documentation for possible values
+    directory: "/" # Location of package manifests
+    schedule:
+      interval: "weekly"

.github/workflows/branch_security.yml

@@ -0,0 +1,21 @@
+name: Enforce PR Source Branch
+
+on:
+  pull_request:
+    branches:
+      - staging
+      - prod
+
+jobs:
+  check-source-branch:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check PR source branch
+        run: |
+          if [[ "$GITHUB_BASE_REF" == "staging" && "$GITHUB_HEAD_REF" != "develop" ]]; then
+            echo "Only 'develop' can merge into 'staging'"
+            exit 1
+          elif [[ "$GITHUB_BASE_REF" == "prod" && "$GITHUB_HEAD_REF" != "staging" ]]; then
+            echo "Only 'staging' can merge into 'prod'"
+            exit 1
+          fi

.github/workflows/pre-release.yml

@@ -0,0 +1,24 @@
+name: pre-release
+
+on:
+  # pull request targeting main branch
+  pull_request:
+    branches: [main]
+
+jobs:
+  check-changelog:
+    runs-on: ubuntu-latest
+    permissions:
+      pull-requests: read
+    steps:
+      - name: Get changed files
+        id: changed-files
+        uses: step-security/changed-files@v45
+        with:
+          files: |
+            CHANGELOG.md
+      - name: Ensure changelog updated
+        if: steps.changed-files.outputs.any_changed == 'false'
+        run: |
+          echo "CHANGELOG.md file must be updated with release notes"
+          exit 1

.github/workflows/publish.yml

@@ -0,0 +1,34 @@
+name: publish
+
+on:
+  release:
+    types: [published]
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+      - name: Set up Python environment
+        uses: ./.github/actions/setup-python-env
+        with:
+          python-version: "3.10"
+      - name: Build package
+        run: |
+          uv build --python "3.10"
+      - name: Publish package to TestPyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          repository-url: https://test.pypi.org/legacy/
+          user: __token__
+          password: ${{ secrets.TEST_PYPI_API_TOKEN }}
+          verify-metadata: true
+          verbose: true
+      - name: Publish package to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          user: __token__
+          password: ${{ secrets.PYPI_API_TOKEN }}
+          verify-metadata: true
+          verbose: true

.github/workflows/style.yml

@@ -0,0 +1,30 @@
+name: style
+
+on:
+  pull_request:  # any pull request
+
+jobs:
+  style:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+      - name: Set up Python environment
+        uses: ./.github/actions/setup-python-env
+        with:
+          python-version: "3.10"
+      - name: Get changed files
+        id: changed-files
+        uses: step-security/changed-files@v45
+        with:
+          files: |
+            **.py
+            **.ipynb
+      - name: Run linter
+        if: steps.changed-files.outputs.any_changed == 'true'
+        run: |
+          uv tool run ruff check ${{ steps.changed-files.outputs.all_changed_files }}
+      - name: Run formatter
+        if: steps.changed-files.outputs.any_changed == 'true'
+        run: |
+          uv tool run ruff format --check ${{ steps.changed-files.outputs.all_changed_files }}

.github/workflows/test.yml

@@ -0,0 +1,24 @@
+name: test
+
+on:
+  pull_request:  # any pull request
+  schedule:  # run weekly
+    - cron: "0 12 * * 0"
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.10", "3.11", "3.12"]
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+      - name: Set up Python environment
+        uses: ./.github/actions/setup-python-env
+        with:
+          python-version: ${{ matrix.python-version }}
+      - name: Run tests
+        run: |
+          uv run python -m pytest