chore: merge main to update branch

Author: devin-ai-integration[bot]

.codecov.yml

@@ -0,0 +1,10 @@
+coverage:
+  status:
+    project:
+      default:
+        target: auto
+        threshold: 0.05%
+    patch:
+      default:
+        target: auto
+        threshold: 0.05%

.github/CODEOWNERS

@@ -0,0 +1,2 @@
+# Default owners for everything in the repository
+* @saltenasl @jamesbhobbs @Artmann @andyjakubowski

.github/workflows/build.yml

@@ -44,7 +44,8 @@ jobs:
           set -eux
           python -m pip install .[test]
 
-          pytest -vv -r ap --cov jupyterlab_deepnote
+          mkdir -p coverage
+          pytest -vv -r ap --cov jupyterlab_deepnote --cov-report=xml --junit-xml=coverage/pytest-results.xml
           jupyter server extension list
           jupyter server extension list 2>&1 | grep -ie "jupyterlab_deepnote.*OK"
 
@@ -54,6 +55,21 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
+      - name: Upload coverage to Codecov
+        uses: codecov/codecov-action@v5
+        with:
+          token: ${{ secrets.CODECOV_TOKEN }}
+          files: coverage.xml,coverage/lcov.info
+          fail_ci_if_error: true
+
+      - name: Upload test results to Codecov
+        if: '!cancelled()'
+        uses: codecov/test-results-action@v1
+        with:
+          token: ${{ secrets.CODECOV_TOKEN }}
+          files: coverage/pytest-results.xml,coverage/junit.xml
+          fail_ci_if_error: true
+
       - name: Package the extension
         run: |
           set -eux
@@ -169,3 +185,5 @@ jobs:
       - uses: actions/checkout@v4
       - uses: jupyterlab/maintainer-tools/.github/actions/base-setup@v1
       - uses: jupyterlab/maintainer-tools/.github/actions/check-links@v1
+        with:
+          ignore_links: 'https://github.com/deepnote/jupyterlab-deepnote/pull/ https://github.com/deepnote/jupyterlab-deepnote/issues/'

.github/workflows/check-licenses.yml

@@ -0,0 +1,95 @@
+name: CI
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+
+permissions:
+  contents: read
+  pull-requests: read
+  packages: read
+
+jobs:
+  qlty:
+    name: Qlty Check
+    runs-on: ubuntu-latest
+    timeout-minutes: 3
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
+
+      - name: Install qlty
+        uses: qltysh/qlty-action/install@06730ef41b86b073c3813c0fc07a0c734980ce5d
+
+      - name: Run qlty check
+        run: qlty check
+
+      - name: Run qlty code smells analysis
+        run: qlty smells
+
+  audit-prod:
+    name: Audit - Production
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Base Setup
+        uses: jupyterlab/maintainer-tools/.github/actions/base-setup@v1
+
+      - name: Install dependencies
+        run: python -m pip install -U "jupyterlab>=4.0.0,<5"
+
+      - name: Install node dependencies
+        run: jlpm
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Run audit for production dependencies
+        run: jlpm npm audit --environment production
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+  audit-all:
+    name: Audit - All
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Base Setup
+        uses: jupyterlab/maintainer-tools/.github/actions/base-setup@v1
+
+      - name: Install dependencies
+        run: python -m pip install -U "jupyterlab>=4.0.0,<5"
+
+      - name: Install node dependencies
+        run: jlpm
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Run audit for all dependencies
+        run: jlpm npm audit
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        
+  license-check:
+    name: License Check
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Base Setup
+        uses: jupyterlab/maintainer-tools/.github/actions/base-setup@v1
+
+      - name: Check licenses
+        run: yarn check-licenses

.github/workflows/ci.yml

@@ -123,3 +123,9 @@ dmypy.json
 
 # Yarn cache
 .yarn/
+# Qlty cache directories
+.qlty/cache
+.qlty/logs
+.qlty/out
+.qlty/plugin_cachedir
+.qlty/results

.gitignore

@@ -0,0 +1,74 @@
+# Qlty Configuration
+# Learn more at https://docs.qlty.sh
+config_version = "0"
+
+# Plugins configuration
+[[plugin]]
+name = "actionlint"
+
+[[plugin]]
+name = "trufflehog"
+
+[[plugin]]
+name = "osv-scanner"
+
+# Source configuration
+[[source]]
+name = "default"
+default = true
+
+# Exclusion patterns
+exclude_patterns = [
+  "node_modules/**",
+  "dist/**",
+  "build/**",
+  "coverage/**",
+  "**/*.min.js",
+  "**/*.min.css",
+  ".git/**",
+  ".venv/**",
+  "venv/**",
+  ".tox/**",
+  ".mypy_cache/**",
+  "**/__pycache__/**",
+]
+
+# Code Smells Configuration
+[smells]
+mode = "block"
+
+[smells.boolean_logic]
+enabled = true
+threshold = 4
+
+[smells.nested_control_flow]
+enabled = true
+threshold = 4
+
+[smells.function_parameters]
+enabled = true
+threshold = 5
+
+[smells.function_length]
+enabled = true
+threshold = 50
+
+[smells.file_length]
+enabled = true
+threshold = 500
+
+[smells.cognitive_complexity]
+enabled = true
+threshold = 15
+
+[smells.duplicate_code]
+enabled = true
+threshold = 6
+
+[smells.large_class]
+enabled = true
+threshold = 500
+
+[smells.long_parameter_list]
+enabled = true
+threshold = 2

.qlty/qlty.toml

@@ -82,7 +82,7 @@ The `@deepnote/blocks` package is published on GitHub Packages. To install it, y
    - Select the `read:packages` scope
    - Generate and copy the token
 
-2. Set the `GITHUB_TOKEN` environment variable to ensure `jlpm` (which is a wrapper around Yarn) can download the `@deepnote/blocks` package from the GitHub package registry. You can set the variable in `.zshrc` or manually like:
+2. Set the `GITHUB_TOKEN` environment variable to ensure `jlpm` (which is a wrapper around Yarn) can download the `@deepnote/blocks` package from the GitHub package registry. You can export the variable in `.zshrc` (or by reading a `~/.env` file):
    ```shell
    export GITHUB_TOKEN=your_token_here
    ```

README.md

@@ -22,7 +22,12 @@ module.exports = {
     '!src/**/*.d.ts',
     '!src/**/.ipynb_checkpoints/*'
   ],
+  coverageDirectory: './coverage',
   coverageReporters: ['lcov', 'text'],
+  reporters: [
+    'default',
+    ['jest-junit', { outputDirectory: './coverage', outputName: 'junit.xml' }]
+  ],
   testRegex: 'src/.*/.*.spec.ts[x]?$',
   transformIgnorePatterns: [`/node_modules/(?!${esModules}).+`]
 };

jest.config.js

@@ -2,6 +2,7 @@ import React from 'react';
 import { ReactWidget } from '@jupyterlab/apputils';
 import { NotebookPanel } from '@jupyterlab/notebook';
 import { HTMLSelect } from '@jupyterlab/ui-components';
+import { deepnoteMetadataSchema } from '../types';
 
 export class NotebookPicker extends ReactWidget {
   private selected: string | null = null;
@@ -31,22 +32,30 @@ export class NotebookPicker extends ReactWidget {
 
     const selected = event.target.value;
     const deepnoteMetadata = this.panel.context.model.getMetadata('deepnote');
-    const notebooks = deepnoteMetadata?.notebooks;
+    const deepnoteMetadataValidated =
+      deepnoteMetadataSchema.safeParse(deepnoteMetadata);
 
-    if (notebooks && selected in notebooks) {
-      // clone the notebook JSON
-      const newModelData = { ...notebooks[selected] };
+    if (!deepnoteMetadataValidated.success) {
+      console.error(
+        'Invalid deepnote metadata:',
+        deepnoteMetadataValidated.error
+      );
+      return;
+    }
 
-      // preserve deepnote metadata *without* re-inserting all notebooks
-      newModelData.metadata = {
-        ...(newModelData.metadata ?? {}),
-        deepnote: {
-          notebook_names: deepnoteMetadata?.notebook_names ?? [],
-          notebooks: deepnoteMetadata?.notebooks ?? {}
-        }
-      };
+    const notebooks = deepnoteMetadataValidated.data.notebooks;
 
-      model.fromJSON(newModelData);
+    if (selected in notebooks) {
+      model.fromJSON({
+        cells: notebooks[selected]?.cells ?? [],
+        metadata: {
+          deepnote: {
+            notebooks
+          }
+        },
+        nbformat: 4,
+        nbformat_minor: 0
+      });
       model.dirty = false;
     }
 
@@ -56,12 +65,13 @@ export class NotebookPicker extends ReactWidget {
 
   render(): JSX.Element {
     const deepnoteMetadata = this.panel.context.model.getMetadata('deepnote');
-    const metadataNames = deepnoteMetadata?.notebook_names;
-    const names =
-      Array.isArray(metadataNames) &&
-      metadataNames.every(n => typeof n === 'string')
-        ? metadataNames
-        : [];
+
+    const deepnoteMetadataValidated =
+      deepnoteMetadataSchema.safeParse(deepnoteMetadata);
+
+    const names = deepnoteMetadataValidated.success
+      ? Object.values(deepnoteMetadataValidated.data.notebooks).map(n => n.name)
+      : [];
 
     return (
       <HTMLSelect