Merge branch 'release/0.5.1'

Author: jenskeiner

.devcontainer/Dockerfile

@@ -1,39 +1,30 @@
 {
-	"name": "python3",
-	"build": {
-		"dockerfile": "Dockerfile"
-	},
-
-	// Set *default* container specific settings.json values on container create.
-	"settings": {
-		"terminal.integrated.shell.linux": "/bin/bash",
-		"python.testing.pytestArgs": [
-			"tests"
-		],
-		"python.testing.unittestEnabled": false,
-		"python.testing.pytestEnabled": true
-	},
-
-	// 👇 Features to add to the Dev Container. More info: https://containers.dev/implementors/features.
-	// "features": {},
-
-	// 👇 Use 'forwardPorts' to make a list of ports inside the container available locally.
-	// "forwardPorts": [],
-
-	// 👇 Use 'postCreateCommand' to run commands after the container is created.
-	"postCreateCommand": "poetry install",
-
-	// 👇 Configure tool-specific properties.
-	"customizations": {
-        "vscode": {
-            "extensions":[
-				"donjayamanne.python-extension-pack"
-			]
-            }
-        }
-
-
-
-	// 👇 Uncomment to connect as root instead. More info: https://aka.ms/dev-containers-non-root.
-	// "remoteUser": "root"
+  "name": "exchange-calendars-extensions",
+  "image": "mcr.microsoft.com/devcontainers/python:dev-3.14",
+  "containerEnv": {
+    "UV_LINK_MODE": "copy"
+  },
+  "features": {
+    "ghcr.io/jsburckhardt/devcontainer-features/uv:1": {},
+    "ghcr.io/jsburckhardt/devcontainer-features/ruff:1": {},
+    "ghcr.io/prulloac/devcontainer-features/pre-commit:1": {}
+  },
+  "customizations": {
+    "vscode": {
+      "extensions": [
+        "ms-python.python",
+        "ms-python.vscode-pylance",
+        "ms-python.debugpy"
+      ],
+      "settings": {
+        "python.testing.pytestArgs": [
+          "tests"
+        ],
+        "python.testing.unittestEnabled": false,
+        "python.testing.pytestEnabled": true
+      }
+    }
+  },
+  "postCreateCommand": "uv sync",
+  "remoteUser": "vscode"
 }

.devcontainer/devcontainer.json

@@ -9,7 +9,11 @@ updates:
     directory: "/" # Location of package manifests
     schedule:
       interval: "monthly"
-  - package-ecosystem: "pip" # See documentation for possible values
+    cooldown:
+      default-days: 7
+  - package-ecosystem: "uv" # See documentation for possible values
     directory: "/" # Location of package manifests
     schedule:
       interval: "monthly"
+    cooldown:
+      default-days: 7

.github/dependabot.yml

@@ -13,23 +13,37 @@ on:
       - main
       - develop
 
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 env:
   PACKAGE_VERSION: "0"
 
 jobs:
   build-and-test:
+    name: Run automated tests.
     runs-on: ${{ matrix.os }}
+    timeout-minutes: 5
     strategy:
       matrix:
         os: [ubuntu-latest, windows-latest, macos-latest]
-        python-version: ["3.9", "3.10", "3.11", "3.12", "3.13", "3.14"]
+        python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
     - name: Install uv
-      uses: astral-sh/setup-uv@v5
+      uses: astral-sh/setup-uv@61cb8a9741eeb8a550a1b8544337180c0fc8476b # v7
       with:
-        enable-cache: true
-    - name: Set up Python ${{ matrix.python-version }}
-      run: uv python install ${{ matrix.python-version }}
+        enable-cache: true  # zizmor: ignore[cache-poisoning] Blast radius limited because this workflow only runs automated tests.
+    - name: Set up Python
+      shell: bash
+      env:
+        PYTHON_VERSION: ${{ matrix.python-version }}
+      run: uv python install ${PYTHON_VERSION}
     - name: Run tests.
       run: uv run pytest

.github/workflows/ci.yml

@@ -5,19 +5,23 @@ on:
     branches:
       - develop
 
+permissions:
+  contents: read
+
+concurrency:
+  group: release-drafter
+  cancel-in-progress: false
+
 jobs:
   draft-release-publish:
     name: Draft a new release
     permissions:
-      # write permission is required to create a GitHub release
-      contents: write
-      # write permission is required for autolabeler
-      # otherwise, read permission is required at least
-      pull-requests: write
+      contents: write  # Required to create GitHub release.
+      pull-requests: read  # Required to read PR contents.
     runs-on: ubuntu-latest
     steps:
       # Drafts your next Release notes as Pull Requests are merged into "master"
-      - uses: release-drafter/release-drafter@v6
+      - uses: release-drafter/release-drafter@6db134d15f3909ccc9eefd369f02bd1e9cffdf97 # v6
         with:
           config-name: release-drafter-config.yml
         env:

.github/workflows/draft-release.yml

@@ -7,46 +7,61 @@ on:
       - 'hotfix/**'
       - 'support/**'
 
+permissions:
+  contents: read
+
+concurrency:
+  group: publish
+  cancel-in-progress: false
+
 env:
   PACKAGE_NAME: exchange_calendars_extensions_api
   MODULE_NAME: exchange_calendars_extensions.api
   PYTHON_VERSION: "3.13"
 
 jobs:
-  build-and-publish-testpypi:
+  build-and-publish:
     name: Build and publish release candidate Python distribution to TestPyPI.
     runs-on: ubuntu-latest
     environment: testpypi
     permissions:
-      id-token: write
+      id-token: write  # Required for trusted publishing.
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
     - name: Install uv
-      uses: astral-sh/setup-uv@v5
+      uses: astral-sh/setup-uv@61cb8a9741eeb8a550a1b8544337180c0fc8476b # v7
       with:
-        enable-cache: true
-    - name: Set up Python ${{ env.PYTHON_VERSION }}
-      run: uv python install ${{ env.PYTHON_VERSION }}
+        enable-cache: false  # No cache when building RCs or releases.
+    - name: Set up Python
+      shell: bash
+      run: uv python install ${PYTHON_VERSION}
     - name: Determine package version.
+      shell: bash
+      env:
+        REF_NAME: ${{ github.ref_name }}
+        RUN_NUMBER: ${{ github.run_number }}
       run: |
-        export PACKAGE_VERSION=$(echo ${{ github.ref_name }} | sed -e 's/^\(release\|hotfix\|support\)\///')rc${{ github.run_number }}
+        export PACKAGE_VERSION=$(echo ${REF_NAME} | sed -e 's/^\(release\|hotfix\|support\)\///')rc${RUN_NUMBER}
         echo "RC version is $PACKAGE_VERSION."
         echo "PACKAGE_VERSION=$PACKAGE_VERSION" >> $GITHUB_ENV
     - name: Build package
       run: uv build
     - name: Publish package to Test PyPI.
-      uses: pypa/gh-action-pypi-publish@release/v1
+      uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # release/v1
       with:
         repository-url: https://test.pypi.org/legacy/
         skip-existing: true
     - name: Test that the package can be installed and imported (Test PyPI).
+      shell: bash
       run: |
         i=0
         max=10
         exists=0
         while [ $i -lt $max ] && [ $exists -eq 0 ]; do
             i=$(expr $i + 1)
-            if curl -f -s https://test.pypi.org/pypi/${{ env.PACKAGE_NAME }}/json | jq -e ".releases | has(\"${{ env.PACKAGE_VERSION }}\")" &> /dev/null; then
+            if curl -f -s https://test.pypi.org/pypi/${PACKAGE_NAME}/json | jq -e ".releases | has(\"${PACKAGE_VERSION}\")" &> /dev/null; then
                 echo "$i/$max Package has appeared in index."
                 exists=1
             else
@@ -59,7 +74,7 @@ jobs:
             i=0
             max=3
             while [ $i -lt $max ]; do
-                if uv run -n --refresh --default-index https://test.pypi.org/simple --index https://pypi.org/simple --index-strategy unsafe-best-match --with "${{ env.PACKAGE_NAME }}==${{ env.PACKAGE_VERSION }}" --no-project -- python -c 'from importlib.metadata import version;print(version("${{ env.MODULE_NAME }}"))'; then
+                if uv run -n --refresh --default-index https://test.pypi.org/simple --index https://pypi.org/simple --index-strategy unsafe-best-match --with "${PACKAGE_NAME}==${PACKAGE_VERSION}" --no-project -- python -c "from importlib.metadata import version;print(version(\"${MODULE_NAME}\"))"; then
                     exit 0
                 else
                     echo "The command failed. Retrying $i/$max."