Merge pull request #722 from icesat2py/development

release v2.0.1

Author: JessicaS11

.all-contributorsrc

@@ -512,7 +512,17 @@
       "avatar_url": "https://avatars.githubusercontent.com/u/5607545?v=4",
       "profile": "https://developmentseed.org/",
       "contributions": [
-        "infra"
+        "infra",
+        "review"
+      ]
+    },
+    {
+      "login": "emmanuel-ferdman",
+      "name": "Emmanuel Ferdman",
+      "avatar_url": "https://avatars.githubusercontent.com/u/35470921?v=4",
+      "profile": "https://github.com/emmanuel-ferdman",
+      "contributions": [
+        "code"
       ]
     }
   ],

.github/actions/install-icepyx/action.yml

@@ -16,7 +16,7 @@ jobs:
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
     # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       with:
         ref: "traffic"
 
@@ -29,7 +29,7 @@ jobs:
 
     # Commits files to repository
     - name: Commit changes
-      uses: EndBug/add-and-commit@v9
+      uses: EndBug/add-and-commit@a94899bca583c204427a224a7af87c02f9b325d5 # v9.1.4
       with:
         author_name: learn2phoenix
         message: "Pypi stats auto-update"

.github/workflows/download_test.yml

@@ -1,8 +1,7 @@
 name: "Integration test"
-# NOTE: This runs all integration tests except those that download data.
+# NOTE: This runs all integration tests, including some that download data.
 # It will not automatically run integration tests (some of which require auth)
 # on PRs from forks.
-# Integration tests that download data are run separately.
 
 
 on:
@@ -29,7 +28,7 @@ jobs:
     steps:
       - name: "Fetch user permission"
         id: "permission"
-        uses: "actions-cool/check-user-permission@v2"
+        uses: "actions-cool/check-user-permission@7b90a27f92f3961b368376107661682c441f6103" # v2.3.0
         with:
           require: "write"
           username: "${{ github.triggering_actor }}"
@@ -48,21 +47,31 @@ jobs:
           exit 1
 
       - name: "Checkout source"
-        uses: "actions/checkout@v4"
+        uses: "actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8" # v5.0.0
+        with:
+          fetch-depth: 0
 
-      - uses: "./.github/actions/install-icepyx"
+      - name: Set up Python
+        uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
         with:
           python-version: "3.12"
 
-      - name: "Run auth tests"
+      - name: "Install package and test dependencies"
+        run: |
+          python -m pip install .
+          python -m pip install -r requirements-dev.txt
+
+      - name: "Run integration tests"
         env:
           EARTHDATA_USERNAME: "icepyx_devteam"
           EARTHDATA_PASSWORD: "${{ secrets.EARTHDATA_PASSWORD }}"
           NSIDC_LOGIN: "${{ secrets.EARTHDATA_PASSWORD }}"
         run: |
           pytest -s icepyx/tests/integration --verbose --cov app
+        # Only run tests that [do not] download data
+        # pytest icepyx/tests/integration --verbose --cov app -m "[not] downloads_data"
 
       - name: "Upload coverage report"
-        uses: "codecov/codecov-action@v5.4.0"
+        uses: "codecov/codecov-action@5a1091511ad55cbe89839c7260b706298ca349f7" # v5.5.1
         with:
           token: "${{ secrets.CODECOV_TOKEN }}"

.github/workflows/get_pypi_stats.yml

@@ -9,9 +9,9 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       # Use the Ruff linter to annotate code style / best-practice issues
       # NOTE: More config provided in pyproject.toml
       - name: Lint and annotate PR
-        uses: astral-sh/ruff-action@v3
+        uses: astral-sh/ruff-action@57714a7c8a2e59f32539362ba31877a1957dded1 # v3.5.1

.github/workflows/integration_test.yml

@@ -12,25 +12,25 @@ on:
   # Trigger manually at https://github.com/icesat2py/icepyx/actions/workflows/publish_to_pypi.yml
   workflow_dispatch:
 
+permissions: {}
+
 jobs:
-  publish-pypi:
-    name: Publish to PyPI
+  build:
+    name: Build distribution 📦
     runs-on: ubuntu-latest
-    if: github.repository == 'icesat2py/icepyx'
-    permissions:
-      id-token: write
 
     steps:
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       with:
         # fetch all history so that setuptools-scm works
         fetch-depth: 0
+        persist-credentials: false
 
     - name: Set up Python
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
       with:
-        python-version: 3.11
+        python-version: '3.11'
 
     - name: Install dependencies
       run: python -m pip install build setuptools wheel
@@ -51,11 +51,55 @@ jobs:
         echo "Generated files:"
         ls -lh dist/
 
-    - name: Publish to Test PyPI
-      uses: pypa/gh-action-pypi-publish@release/v1
+    - name: Store the distribution packages
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+      with:
+        name: python-package-distributions
+        path: dist/
+
+
+  publish-to-testpypi:
+    name: Publish Python 🐍 distribution 📦 to TestPyPI
+    if: github.repository == 'icesat2py/icepyx'
+    needs:
+      - build
+    runs-on: ubuntu-latest
+    environment:
+      name: testpypi
+      url: https://test.pypi.org/project/icepyx
+    permissions:
+      id-token: write # IMPORTANT: mandatory for trusted OIDC publishing
+
+    steps:
+    - name: Download all the dists
+      uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
+      with:
+        name: python-package-distributions
+        path: dist/
+
+    - name: Publish distribution 📦 to TestPyPI
+      uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0
       with:
         repository-url: https://test.pypi.org/legacy/
 
-    - name: Publish to PyPI
-      if: startsWith(github.ref, 'refs/tags')
-      uses: pypa/gh-action-pypi-publish@release/v1
+  publish-to-pypi:
+    name: Publish Python 🐍 distribution 📦 to PyPI
+    if: github.repository == 'icesat2py/icepyx' && startsWith(github.ref, 'refs/tags/')
+    needs:
+      - build
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/project/icepyx/
+    permissions:
+      id-token: write # IMPORTANT: mandatory for trusted OIDC publishing
+
+    steps:
+    - name: Download all the dists
+      uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
+      with:
+        name: python-package-distributions
+        path: dist/
+
+    - name: Publish distribution 📦 to PyPI
+      uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0

.github/workflows/linter_actions.yml

@@ -17,7 +17,7 @@ jobs:
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
     # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       with:
         ref: "traffic"
 
@@ -35,7 +35,7 @@ jobs:
 
     # Commits files to repository
     - name: Commit changes
-      uses: EndBug/add-and-commit@v9
+      uses: EndBug/add-and-commit@a94899bca583c204427a224a7af87c02f9b325d5 # v9.1.4
       with:
         author_name: Jessica Scheick
         message: "GitHub traffic auto-update"

.github/workflows/publish_to_pypi.yml

@@ -13,11 +13,11 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           fetch-depth: 0
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
         with:
           python-version: "3.11"
 
@@ -26,4 +26,4 @@ jobs:
           python -m pip install .[complete]
           python -m pip install -r requirements-dev.txt
 
-      - uses: jakebailey/pyright-action@v2
+      - uses: jakebailey/pyright-action@6cabc0f01c4994be48fd45cd9dbacdd6e1ee6e5e # v2.3.3

.github/workflows/traffic_action.yml

@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           ref: ${{ github.event.pull_request.head.ref }}
       - name: set up environment
@@ -29,7 +29,7 @@ jobs:
           rm ./packages_dev_uml.svg
           mv ./*.svg ./doc/source/user_guide/documentation/
       - name: Commit changes
-        uses: EndBug/add-and-commit@v9
+        uses: EndBug/add-and-commit@a94899bca583c204427a224a7af87c02f9b325d5 # v9.1.4
         with:
           author_name: GitHub Action
           message: "GitHub action UML generation auto-update"