Merge pull request #218 from burningmantech/uv

Use uv

.coveragerc

@@ -6,9 +6,7 @@ source = transmission
 [paths]
 source=
    src/transmission
-   .tox/*/lib/python*/site-packages/transmission
-   .tox/*/Lib/site-packages/transmission
-   .tox/pypy*/site-packages/transmission
+   .tox/py*/**/site-packages
 
 [report]
 exclude_lines =

.github/dependabot.yml

@@ -1,4 +1,4 @@
-# https://docs.github.com/en/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically
+# https://docs.github.com/en/code-security/dependabot/dependabot-version-updates
 
 version: 2
 

.github/workflows/cicd.yml

@@ -26,31 +26,35 @@ jobs:
         with:
           disable-sudo: true
           disable-file-monitoring: true
-          egress-policy: audit
+          egress-policy: block
+          allowed-endpoints: >
+            *.github.com:443
+            *.githubusercontent.com:443
+            files.pythonhosted.org:443
+            github.com:443
+            pypi.org:443
 
       - name: Checkout source code
         uses: actions/checkout@v4
 
       - name: Install Python
         uses: actions/setup-python@v5
         with:
-          python-version: "3.11"
+          python-version: "3.12"
 
-      - name: System Python Information
-        uses: twisted/python-info-action@v1
+      - name: Install uv
+        uses: astral-sh/setup-uv@v4
 
       - name: Set up Tox environment
-        run: |
-          pip install tox
-          tox run -e lint --notest
-
-      - name: Tox Python Information
-        uses: twisted/python-info-action@v1
-        with:
-          python-path: .tox/lint/*/python
+        run: uvx --with=tox-uv tox run -e lint --notest
 
       - name: Run Linters
-        run: tox run -e lint
+        run: uvx --with=tox-uv tox run -e lint
+        env:
+          # no-commit-to-branch always fails in CI, because this pre-commit
+          # is only designed for running locally (i.e. when committing to a
+          # local master branch)
+          SKIP: no-commit-to-branch
 
 
   mypy:
@@ -67,72 +71,30 @@ jobs:
         with:
           disable-sudo: true
           disable-file-monitoring: true
-          egress-policy: audit
+          egress-policy: block
+          allowed-endpoints: >
+            *.github.com:443
+            *.githubusercontent.com:443
+            files.pythonhosted.org:443
+            github.com:443
+            pypi.org:443
 
       - name: Checkout source code
         uses: actions/checkout@v4
 
       - name: Install Python
         uses: actions/setup-python@v5
         with:
-          python-version: "3.11"
+          python-version: "3.12"
 
-      - name: System Python Information
-        uses: twisted/python-info-action@v1
+      - name: Install uv
+        uses: astral-sh/setup-uv@v4
 
       - name: Set up Tox environment
-        run: |
-          pip install tox
-          tox run -e mypy --notest
-
-      - name: Tox Python Information
-        uses: twisted/python-info-action@v1
-        with:
-          python-path: .tox/mypy/*/python
+        run: uvx --with=tox-uv tox run -e mypy --notest
 
       - name: Run Mypy
-        run: tox run -e mypy
-
-
-  # docs:
-
-  #   name: Build documentation
-
-  #   runs-on: ubuntu-latest
-  #   timeout-minutes: 5
-
-  #   steps:
-
-  #     - name: Harden CI
-  #       uses: step-security/[email protected]
-  #       with:
-  #         disable-sudo: true
-  #         disable-file-monitoring: true
-  #         egress-policy: audit
-
-  #     - name: Checkout source code
-  #       uses: actions/checkout@v4
-
-  #     - name: Install Python
-  #       uses: actions/setup-python@v5
-  #       with:
-  #         python-version: "3.11"
-
-  #     - name: System Python Information
-  #       uses: twisted/python-info-action@v1
-
-  #     - name: Set up Tox environment
-  #       run: |
-  #         pip install tox
-  #         tox run -e docs --notest
-
-  #     - name: Tox Python Information
-  #       uses: twisted/python-info-action@v1
-  #       with:
-  #         python-path: .tox/docs/*/python
-
-  #     - name: Build documentation
-  #       run: tox run -e docs
+        run: uvx --with=tox-uv tox run -e mypy
 
 
   packaging:
@@ -147,50 +109,51 @@ jobs:
         uses: step-security/[email protected]
         with:
           disable-sudo: true
-          egress-policy: audit
+          egress-policy: block
+          allowed-endpoints: >
+            *.github.com:443
+            *.githubusercontent.com:443
+            files.pythonhosted.org:443
+            github.com:443
+            pypi.org:443
 
       - name: Checkout source code
         uses: actions/checkout@v4
 
       - name: Install Python
         uses: actions/setup-python@v5
         with:
-          python-version: "3.11"
+          python-version: "3.12"
 
-      - name: System Python Information
-        uses: twisted/python-info-action@v1
+      - name: Install uv
+        uses: astral-sh/setup-uv@v4
 
       - name: Set up Tox environment
-        run: |
-          pip install tox
-          tox run -e packaging --notest
-
-      - name: Tox Python Information
-        uses: twisted/python-info-action@v1
-        with:
-          python-path: .tox/packaging/*/python
+        run: uvx --with=tox-uv tox run -e packaging --notest
 
       - name: Check packaging
-        run: tox run -e packaging
+        run: uvx --with=tox-uv tox run -e packaging
 
 
   unit:
 
     name: "Py:${{ matrix.python-version }} - ${{ matrix.os }}"
+    # Available versions:
+    # https://github.com/actions/python-versions/blob/main/versions-manifest.json
 
     runs-on: ${{ matrix.os }}
     timeout-minutes: 30
     continue-on-error: ${{ matrix.optional }}
     strategy:
       matrix:
         os: ["ubuntu-latest"]
-        python-version: ["3.11"]  # Versions to test with coverage
+        python-version: ["3.12"]  # Versions to test with coverage
         tox-prefix: ["coverage"]
         optional: [false]
         include:
-          # Test Python 3.12 but allow it to fail
+          # Test next Python version but allow it to fail
           - os: "ubuntu-latest"
-            python-version: "3.12"
+            python-version: "3.13"
             optional: true
             tox-prefix: "test"
 
@@ -200,7 +163,17 @@ jobs:
         uses: step-security/[email protected]
         with:
           disable-sudo: true
-          egress-policy: audit
+          egress-policy: block
+          allowed-endpoints: >
+            *.codecov.io:443
+            *.github.com:443
+            *.githubusercontent.com:443
+            codecov.io:443
+            files.pythonhosted.org:443
+            github.com:443
+            keybase.io:443
+            pypi.org:443
+            storage.googleapis.com:443
 
       - name: Checkout source code
         uses: actions/checkout@v4
@@ -212,9 +185,6 @@ jobs:
         with:
           python-version: ${{ matrix.python-version }}
 
-      - name: System Python Information
-        uses: twisted/python-info-action@v1
-
       - name: Translate Python version to Tox environment
         shell: python
         run: |
@@ -232,42 +202,62 @@ jobs:
           f = p.open(mode="a")
           f.write(f"TOX_ENV={env}\n")
 
-      - name: Set up Tox environment
-        run: |
-          pip install tox
-          tox run -e ${TOX_ENV} --notest
+      - name: Install uv
+        uses: astral-sh/setup-uv@v4
 
-      - name: Tox Python Information
-        uses: twisted/python-info-action@v1
-        with:
-          python-path: .tox/${TOX_ENV}/*/python
+      - name: Set up Tox environment
+        run: uvx --with=tox-uv tox run -e "${TOX_ENV}" --notest
 
       - name: Run unit tests
-        run: tox run -e ${TOX_ENV}
+        id: test
+        run: |
+          status=0
+          uvx --with=tox-uv tox run -e "${TOX_ENV}" || status=$?
+          if [ ${status} -ne 0 ] && [ "${{ matrix.optional }}" == "true" ]; then
+            echo "::warning::Optional matrix job failed."
+            echo "optional_fail=true" >> "${GITHUB_OUTPUT}"
+            echo "optional_fail_status=${status}" >> "${GITHUB_OUTPUT}"
+            exit 0  # Ignore error here to keep the green checkmark going
+          fi;
+          exit ${status}
 
       - name: Upload Trial log artifact
-        if: ${{ failure() }}
+        if: ${{ failure() || steps.test.outputs.optional_fail == 'true' }}
         uses: actions/upload-artifact@v4
         with:
           name: trial
           path: .tox/${TOX_ENV}/log/trial.log
 
+      - name: Add comment if optional job failed; delete otherwise
+        # this step fails on post-merge runs on master, since there's no
+        # PR to comment against.
+        if: ${{ matrix.optional && github.ref != 'refs/heads/master' }}
+        uses: thollander/actions-comment-pull-request@v3
+        with:
+          # Note: tag must be unique to each matrix case
+          comment-tag: "${{ matrix.python-version }}-${{ matrix.os }}-optional-notice"
+          message: |
+            ### ⚠️ Optional matrix job Py:${{ matrix.python-version }} - ${{ matrix.os }} failed ⚠️
+              - tox prefix: ${{ matrix.tox-prefix }}
+              - exit status: ${{ steps.test.outputs.optional_fail_status }}
+          mode: ${{ steps.test.outputs.optional_fail == 'true' && 'upsert' || 'delete' }}
+
       # Use the latest supported Python version for combining coverage to
       # prevent parsing errors in older versions when looking at modern code.
       - uses: "actions/setup-python@v5"
         if: ${{ matrix.tox-prefix == 'coverage' }}
         with:
-          python-version: "3.11"
+          python-version: "3.12"
 
       # - name: "Upload coverage to Codecov"
-      #   uses: "codecov/codecov-action@v3.1.1"
+      #   uses: "codecov/codecov-action@v5"
       #   if: ${{ matrix.tox-prefix == 'coverage' }}
       #   with:
+      #     token: ${{ secrets.CODECOV_TOKEN }}
       #     files: .tox/coverage.xml
       #     env_vars: GITHUB_REF,GITHUB_COMMIT,GITHUB_USER,GITHUB_WORKFLOW
       #     fail_ci_if_error: true
       #   env:
-      #     CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
       #     GITHUB_REF: ${{ github.ref }}
       #     GITHUB_COMMIT: ${{ github.sha }}
       #     GITHUB_USER: ${{ github.actor }}