Merge branch 'main' into dependabot/pip/pyjwt-1.5.3

.dockerignore

@@ -0,0 +1,19 @@
+# Hidden files / folders
+.*
+
+# Temp files
+*~
+
+# Readmes
+**/*.md
+
+# Tests
+tests/
+integration_tests/
+
+# Byte-compiled / optimized / DLL files
+__pycache__/
+*.py[cod]
+
+# Mac OS
+.DS_Store

.github/actions/poetry/action.yml

@@ -5,7 +5,7 @@ inputs:
   version:
     description: "Version of poetry to install"
     required: false
-    default: "1.1.12"
+    default: "1.5.1"
 
 outputs:
   version:
@@ -21,5 +21,5 @@ runs:
       shell: bash
 
     - id: poetry-version
-      run: echo "::set-output name=version::$(poetry --version)"
+      run: echo "version=$(poetry --version)" >> $GITHUB_OUTPUT
       shell: bash

.github/codecov.yml

@@ -0,0 +1,12 @@
+# Reference: https://docs.codecov.com/docs/codecovyml-reference
+coverage:
+  status:
+    project:
+      default:
+        threshold: 0.2%
+
+comment:
+  # Only comment when coverage changes
+  require_changes: true
+  # Require all builds to finish before comment is posted
+  after_n_builds: 8

.github/dependabot.yml

@@ -7,6 +7,7 @@ updates:
     directory: "/"
     schedule:
       interval: "daily"
+    versioning-strategy: increase-if-necessary
 
   - package-ecosystem: "github-actions"
     directory: "/"

.github/release.yml

@@ -0,0 +1,23 @@
+changelog:
+  exclude:
+    labels:
+      - ignore for notes
+  categories:
+    - title: Incompatible Changes
+      labels:
+        - incompatible changes
+    - title: Features
+      labels:
+        - feature
+    - title: Bugfixes
+      labels:
+        - bug
+    - title: Other Changes
+      labels:
+        - "*"
+      exclude:
+        labels:
+          - dependencies
+    - title: Dependency Updates
+      labels:
+        - dependencies

.github/workflows/build-base-image.yml

@@ -0,0 +1,67 @@
+name: Build Base Image
+on:
+  schedule:
+    # Every Monday at 6:22am Eastern Time
+    - cron: '22 10 * * 1'
+  workflow_dispatch:
+    # Allow us to manually trigger build
+
+concurrency:
+  # This concurrency group is used to prevent multiple builds from running at the same time.
+  group: build-base-${{ github.ref_name }}-${{ github.event_name }}
+  cancel-in-progress: true
+
+jobs:
+  docker-build-baseimage:
+    name: Build Base Image
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          persist-credentials: false
+
+      # See comment here: https://github.com/actions/runner-images/issues/1187#issuecomment-686735760
+      - name: Disable network offload
+        run: sudo ethtool -K eth0 tx off rx off
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v2
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v2
+
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v2
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Generate tags for image
+        id: meta
+        uses: docker/metadata-action@v4
+        with:
+          images: ghcr.io/${{ github.repository_owner }}/circ-baseimage
+          # Generate tags for the image
+          # We use the following tags:
+            # - The date in YYYYww format, which is the year and week number. 202052 is the last week of 2020.
+            # - The latest tag
+          tags: |
+            type=schedule,pattern={{date 'YYYYww'}}
+            type=raw,value=latest
+
+      - name: Build base image
+        uses: docker/build-push-action@v4
+        with:
+          context: .
+          file: ./docker/Dockerfile.baseimage
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          push: true
+          target: baseimage
+          cache-to: type=inline
+          platforms: linux/amd64, linux/arm64

.github/workflows/codeql-analysis.yml

@@ -20,7 +20,7 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v2
+      uses: actions/checkout@v3
       with:
         submodules: recursive
 
@@ -35,12 +35,12 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v1
+      uses: github/codeql-action/init@v2
       with:
         languages: python
         config-file: ./.github/codeql/config.yml
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v1
+      uses: github/codeql-action/analyze@v2
       with:
         category: ".github/workflows/codeql-analysis.yml:analyze/language:python"

.github/workflows/lint.yml

@@ -7,25 +7,32 @@ jobs:
   lint:
     name: Lint
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
 
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
 
       - name: Set up Python
-        uses: actions/setup-python@v2
+        uses: actions/setup-python@v4
         with:
           python-version: ${{ env.PYTHON_VERSION }}
 
+      - name: Install Poetry
+        uses: ./.github/actions/poetry
+
       - name: Install Pre-commit
         run: |
-          pip install pre-commit
+          poetry install --only ci
+        env:
+          POETRY_VIRTUALENVS_CREATE: false
 
       - name: Restore pre-commit cache
-        uses: actions/cache@v2
+        uses: actions/cache@v3
         with:
           path: ~/.cache/pre-commit
           key: pre-commit-${{ runner.os }}-py${{ env.PYTHON_VERSION }}-${{ hashFiles('.pre-commit-config.yaml') }}
           restore-keys: pre-commit-${{ runner.os }}-py${{ env.PYTHON_VERSION }}
 
       - name: Lint
-        run: pre-commit run --all-files
+        run: pre-commit run --all-files --show-diff-on-failure

.github/workflows/mypy.yml

@@ -0,0 +1,32 @@
+name: Mypy (Type check)
+on: [push, pull_request]
+env:
+  PYTHON_VERSION: 3.9
+
+jobs:
+  mypy:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: Set up Python 🐍
+        uses: actions/setup-python@v4
+        with:
+          python-version: ${{ env.PYTHON_VERSION }}
+
+      - name: Install Poetry 🎸
+        uses: ./.github/actions/poetry
+
+      - name: Install OS Packages 🧰
+        run: |
+          sudo apt-get update
+          sudo apt-get install --yes libxmlsec1-dev libxml2-dev
+
+      - name: Install Python Packages 📦
+        run: poetry install --without ci
+
+      - name: Run MyPy 🪄
+        run: poetry run mypy