Upgrade GitHub Actions CI [bump] (#53)

Co-authored-by: github-actions <[email protected]>

Author: ric-evans

.github/dependabot.yml

@@ -0,0 +1,10 @@
+version: 2
+updates:
+- package-ecosystem: pip
+  directory: /
+  schedule:
+    interval: weekly
+- package-ecosystem: github-actions
+  directory: /
+  schedule:
+    interval: weekly

.github/workflows/wipac-cicd.yml

@@ -1,26 +1,28 @@
 name: wipac ci/cd
 
-on: [ push ]
+on:
+  push:
+    # only on branch pushes
+    branches: [ '**' ]
+    tags-ignore: [ '**' ]
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   # don't cancel on main/master/default
   cancel-in-progress: ${{ format('refs/heads/{0}', github.event.repository.default_branch) != github.ref }}
 
-env:
-  BOT_NAME: wipacdevbot  # needed to "Allow specified actors to bypass required pull requests" (pushing to main)
-  BOT_EMAIL: [email protected]
-
 jobs:
 
   py-versions:
     runs-on: ubuntu-latest
     outputs:
       matrix: ${{ steps.versions.outputs.matrix }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
+        with:
+          ref: ${{ github.sha }}  # lock to triggered commit (github.ref is dynamic)
       - id: versions
-        uses: WIPACrepo/wipac-dev-py-versions-action@v2.5
+        uses: WIPACrepo/wipac-dev-py-versions-action@v2.7
 
 
   #############################################################################
@@ -29,14 +31,23 @@ jobs:
 
 
   flake8:
+    needs: [ py-versions ]
     runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        py3: ${{ fromJSON(needs.py-versions.outputs.matrix) }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
+        with:
+          ref: ${{ github.sha }}  # lock to triggered commit (github.ref is dynamic)
       - uses: actions/setup-python@v5
-      - uses: WIPACrepo/[email protected]
+        with:
+          python-version: ${{ matrix.py3 }}
+      - uses: WIPACrepo/[email protected]
         with:
           max-function-length: 400
-          max-complexity: 25
+          max-complexity: 25  # ideal is ~10-15
 
   mypy:
     needs: [ py-versions ]
@@ -46,78 +57,49 @@ jobs:
       matrix:
         py3: ${{ fromJSON(needs.py-versions.outputs.matrix) }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
+        with:
+          ref: ${{ github.sha }}  # lock to triggered commit (github.ref is dynamic)
       - uses: actions/setup-python@v5
         with:
           python-version: ${{ matrix.py3 }}
       - uses: WIPACrepo/[email protected]
 
+
   #############################################################################
   # PACKAGING
   #############################################################################
 
-
-  writable-branch-detect:
-    runs-on: ubuntu-latest
-    outputs:
-      OKAY: ${{ steps.detect.outputs.OKAY }}
-    steps:
-      - name: is this a bot-writable branch?
-        id: detect
-        # dependabot can't access normal secrets
-        #   & don't run non-branch triggers (like tags)
-        #   & we don't want to trigger an update on PR's merge to main/master/default (which is a branch)
-        run: |
-          set -euo pipefail
-          if [[ \
-              ${{github.actor}} != 'dependabot[bot]' && \
-              ${{github.ref_type}} == 'branch' && \
-              ${{format('refs/heads/{0}', github.event.repository.default_branch)}} != ${{github.ref}} \
-          ]]; then
-            echo "OKAY=true" >> "$GITHUB_OUTPUT"
-            echo "yes, this branch is compatible"
-          else
-            echo "OKAY=false" >> "$GITHUB_OUTPUT"
-            echo "no, this branch is incompatible"
-          fi
-
   py-setup:
-    needs: [ writable-branch-detect ]
     runs-on: ubuntu-latest
     steps:
-      - if: needs.writable-branch-detect.outputs.OKAY == 'true'
-        uses: actions/checkout@v4
+      - uses: actions/checkout@v5
         with:
           token: ${{ secrets.PERSONAL_ACCESS_TOKEN }}
-      - if: needs.writable-branch-detect.outputs.OKAY == 'true'
-        uses: WIPACrepo/wipac-dev-py-setup-action@v4.1
+          ref: ${{ github.ref }}  # dont lock to sha (action needs to push)
+      - uses: WIPACrepo/wipac-dev-py-setup-action@v5.2
         with:
+          mode: PACKAGING_AND_PYPI
           python_min: 3.9
           python_max: 3.13
           pypi_name: icecube-skyreader
           author: WIPAC Developers
           author_email: [email protected]
-          keywords: IceCube "skymap scanner" skymap HEALPix neutrino reconstruction
-          git_committer_name: ${{ env.BOT_NAME }}  # b/c 'main' push-protections
-          git_committer_email: ${{ env.BOT_EMAIL }}  # b/c 'main' push-protections
+          keywords_comma: "IceCube, skymap scanner, skymap, HEALPix, neutrino, reconstruction"
 
   py-dependencies:
-    needs: [ writable-branch-detect ]
     runs-on: ubuntu-latest
     steps:
-      - if: needs.writable-branch-detect.outputs.OKAY == 'true'
-        uses: actions/checkout@v4
+      - uses: actions/checkout@v5
         with:
-          token: ${{ secrets.PERSONAL_ACCESS_TOKEN }}
-      - if: needs.writable-branch-detect.outputs.OKAY == 'true'
-        uses: WIPACrepo/[email protected]
+          ref: ${{ github.sha }}  # lock to triggered commit (github.ref is dynamic)
+      - uses: WIPACrepo/[email protected]
 
 
   #############################################################################
   # TESTS
   #############################################################################
 
-
   unit-tests:
     needs: [ py-versions ]
     runs-on: ubuntu-latest
@@ -127,52 +109,51 @@ jobs:
         py3: ${{ fromJSON(needs.py-versions.outputs.matrix) }}
     steps:
       - uses: actions/checkout@v3
+        with:
+          ref: ${{ github.sha }}  # lock to triggered commit (github.ref is dynamic)
       - uses: actions/setup-python@v3
         with:
           python-version: ${{ matrix.py3 }}
 
       - name: pip install
         run: |
-          set -euo pipefail
+          set -euo pipefail; echo "now: $(date -u +"%Y-%m-%dT%H:%M:%S.%3N")"
           pip install --upgrade pip wheel setuptools
           pip install .[tests]
 
       - name: test
         run: |
-          set -euo pipefail
+          set -euo pipefail; echo "now: $(date -u +"%Y-%m-%dT%H:%M:%S.%3N")"
           pytest -vvv tests/unit
 
       - name: dump comparison json files
         if: always()
         run: |
-          set -euo pipefail
+          set -euo pipefail; echo "now: $(date -u +"%Y-%m-%dT%H:%M:%S.%3N")"
           more *.json | cat
 
-  release:
-    # only run on main/master/default
+  ############################################################################
+  # TAG + RELEASE
+  #############################################################################
+
+  tag-and-release:
+    # only run on main/default
     if: format('refs/heads/{0}', github.event.repository.default_branch) == github.ref
-    needs: [ flake8, mypy, py-setup, py-dependencies, unit-tests ]
-    runs-on: ubuntu-latest
-    concurrency: release  # prevent any possible race conditions
-    permissions:
-      id-token: write
-      contents: write  # to allow pushing to the repo
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-      # Python-Package Version Bump
-      - uses: python-semantic-release/[email protected]
-        id: psr-psr
-        with:
-          github_token: ${{ secrets.GITHUB_TOKEN }}
-      # PyPI Release
-      - uses: pypa/[email protected]
-        if: steps.psr-psr.outputs.released == 'true'
-        with:
-          password: ${{ secrets.WIPAC_PYPI_TOKEN }}
-      # GitHub Release
-      - uses: python-semantic-release/[email protected]
-        if: steps.psr-psr.outputs.released == 'true'
-        with:
-          github_token: ${{ secrets.GITHUB_TOKEN }}
+    needs: [
+       py-versions,
+       mypy,
+       py-setup,
+       py-dependencies,
+       unit-tests
+    ]
+    uses: WIPACrepo/wipac-dev-workflows/.github/workflows/[email protected]
+    permissions: # for GITHUB_TOKEN
+      contents: write
+    with:
+      project-type: python
+      python-version: "${{ fromJSON(needs.py-versions.outputs.matrix)[0] }}"
+      release-artifacts: |
+        py-dependencies-logs
+      publish-to-pypi: true
+    secrets:
+      PYPI_TOKEN: ${{ secrets.PYPI_TOKEN }}