Merge pull request #3660 from mapfish/ci-upgrade

CI updates

Author: sbrunner

.github/monthly-release

@@ -8,18 +8,21 @@ import sys
 
 _TAG_RE = re.compile(r"^(\d+)\.(\d+)\.(\d+)$")
 
+
 def _main():
     parser = argparse.ArgumentParser("Create new tags on every stabilisation branches")
     parser.add_argument("--dry-run", action="store_true", help="Do not create tags")
     args = parser.parse_args()
 
-    with open("SECURITY.md", encoding='utf-8') as security_file:
+    with open("SECURITY.md", encoding="utf-8") as security_file:
         security = security_md.Security(security_file.read())
 
     for branch in security.branches():
         subprocess.run(["git", "checkout", branch], check=True)
 
-        last_tag = subprocess.run(['git', 'describe', '--tags', '--abbrev=0'], stdout=subprocess.PIPE, encoding='utf-8').stdout.strip()
+        last_tag = subprocess.run(
+            ["git", "describe", "--tags", "--abbrev=0"], stdout=subprocess.PIPE, encoding="utf-8"
+        ).stdout.strip()
         last_tag_match = _TAG_RE.match(last_tag)
         if last_tag_match is None:
             print(f"Cannot parse tag {last_tag}")

.github/renovate.json5

@@ -10,14 +10,16 @@
     'github>camptocamp/gs-renovate-config-preset:own.json5#1.1.2',
     'github>camptocamp/gs-renovate-config-preset:json-schema.json5#1.1.2',
     'github>camptocamp/gs-renovate-config-preset:shellcheck.json5#1.1.2',
+    'github>camptocamp/gs-renovate-config-preset:python.json5#1.0.1',
+    'github>camptocamp/gs-renovate-config-preset:security.json5#1.0.1',
   ],
   baseBranches: ['3.28', '3.29', '3.30', '3.31', 'master'],
   customManagers: [
     {
-      fileMatch: ['^build.gradle$', '.*/build.gradle$'],
       matchStrings: ['toolVersion = "(?<currentValue>.*)" // (?<depName>.*)'],
       datasourceTemplate: 'maven',
       customType: 'regex',
+      managerFilePatterns: ['/^build.gradle$/', '/.*/build.gradle$/'],
     },
   ],
   packageRules: [

.github/workflows/main.yaml

@@ -14,6 +14,7 @@ permissions:
   actions: write
   contents: write
 
+  id-token: write
 env:
   HAS_SECRETS: ${{ secrets.HAS_SECRETS }}
 

.github/workflows/pull-request-automation.yaml

@@ -48,3 +48,5 @@ jobs:
             })
         if: |-
           github.event.pull_request.user.login == 'renovate[bot]'
+    permissions:
+      pull-requests: write

.pre-commit-config.yaml

@@ -28,3 +28,11 @@ repos:
     rev: 1.4.1
     hooks:
       - id: canonicalize
+  - repo: https://github.com/astral-sh/ruff-pre-commit
+    rev: v0.11.8
+    hooks:
+      - id: ruff-format
+  - repo: https://github.com/sbrunner/python-versions-hook
+    rev: 1.0.0
+    hooks:
+      - id: python-versions

core/docker/usr/local/tomcat/bin/docker-start-watch

@@ -28,7 +28,9 @@ def start():
 
 
 def main():
-    parser = argparse.ArgumentParser("This script is used in debug mode to restart the print after a compilation")
+    parser = argparse.ArgumentParser(
+        "This script is used in debug mode to restart the print after a compilation"
+    )
     parser.parse_args()
 
     global timer, process

pyproject.toml

@@ -1,3 +1,10 @@
-[tool.black]
+[tool.ruff]
+target-version = "py310"
 line-length = 110
-target-version = ["py39"]
+
+[tool.ruff.lint.pydocstyle]
+convention = "numpy"
+
+[project]
+classifiers = []
+dynamic = ["dependencies", "version"]