refactor: migrate to starflow

.editorconfig

@@ -0,0 +1,38 @@
+# Editor configuration options.
+# See: https://spec.editorconfig.org/
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+indent_size = 4
+indent_style = space
+insert_final_newline = true
+max_line_length = 88
+trim_trailing_whitespace = true
+
+[.editorconfig]
+max_line_length = off
+
+[{Makefile,*.mk}]
+indent_style = tab
+
+[{*.py,*.pyi}]
+max_line_length = 88
+
+[{*.bash,*.sh,*.zsh}]
+indent_size = 2
+tab_width = 2
+
+[{*.har,*.json,*.json5}]
+indent_size = 2
+max_line_length = off
+
+[{*.markdown,*.md,*.rst}]
+ij_visual_guides = none
+
+[{*.toml,Cargo.lock,Cargo.toml.orig,Gopkg.lock,Pipfile,poetry.lock}]
+max_line_length = off
+
+[{*.yaml,*.yml}]
+indent_size = 2

.github/ISSUE_TEMPLATE/bug.yaml

@@ -62,4 +62,3 @@ body:
     id: additional-context
     attributes:
       label: Additional context
-

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,6 +1,6 @@
 - [ ] Have you followed the [guidelines for contributing](https://github.com/canonical/snapcraft/blob/main/CONTRIBUTING.md)?
 - [ ] Have you signed the [CLA](http://www.ubuntu.com/legal/contributors/)?
-- [ ] Have you successfully run `tox run -m lint`?
-- [ ] Have you successfully run `tox run -e test-py310`? (supported versions: `py39`, `py310`, `py311`, `py312`)
+- [ ] Have you successfully run `make lint`?
+- [ ] Have you successfully run `make test`?
 
------
+---

.github/release-drafter.yml

@@ -15,10 +15,10 @@ categories:
   - title: "Tooling"
     label:
       - "tooling"
-change-template: '- $TITLE @$AUTHOR (#$NUMBER)'
+change-template: "- $TITLE @$AUTHOR (#$NUMBER)"
 template: |
   Special thanks to the contributors that made this release happen: $CONTRIBUTORS
-  
+
   ## Full list of changes
 
   $CHANGES

.github/spread-problem-matcher.json

@@ -1,14 +1,14 @@
 {
-    "problemMatcher": [
+  "problemMatcher": [
+    {
+      "owner": "spread-error",
+      "pattern": [
         {
-            "owner": "spread-error",
-            "pattern": [
-                {
-                    "regexp": "^\\d+-\\d+-\\d+ \\d+:\\d+:\\d+ ((Error) (preparing|executing|restoring) .+) : .*$",
-                    "message": 1,
-                    "severity": 2
-                }
-            ]
+          "regexp": "^\\d+-\\d+-\\d+ \\d+:\\d+:\\d+ ((Error) (preparing|executing|restoring) .+) : .*$",
+          "message": 1,
+          "severity": 2
         }
-    ]
+      ]
+    }
+  ]
 }

.github/workflows/check-renovate.yaml

@@ -10,7 +10,7 @@ on:
     inputs:
       enable_ssh_access:
         type: boolean
-        description: 'Enable ssh access'
+        description: "Enable ssh access"
         required: false
         default: false
 
@@ -25,7 +25,7 @@ jobs:
         with:
           node-version: 22
       - name: Install renovate
-        run: npm install --global renovate
+        run: npm install --global re2 renovate
       - name: Enable ssh access
         uses: mxschmitt/action-tmate@v3
         if: ${{ inputs.enable_ssh_access }}
@@ -34,7 +34,7 @@ jobs:
       - name: Check renovate config
         run: renovate-config-validator .github/renovate.json5
       - name: Renovate dry-run
-        run: renovate --dry-run --autodiscover
+        run: renovate --dry-run=full --autodiscover --print-config
         env:
           RENOVATE_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           RENOVATE_USE_BASE_BRANCH_CONFIG: ${{ github.ref }}

.github/workflows/policy.yaml

@@ -0,0 +1,22 @@
+name: Check policy
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+      - hotfix/*
+      - work/check-policy # For development
+
+jobs:
+  policy:
+    uses: canonical/starflow/.github/workflows/policy.yaml@main
+  python-scans:
+    name: Security scan
+    uses: canonical/starflow/.github/workflows/scan-python.yaml@main
+    with:
+      # 1. requirements-noble.txt can't build on jammy
+      # 2. Ignore requirements files in spread tests, as some of these intentionally
+      #    contain vulnerable versions.
+      # 3. Docs contain requirements.txt files that don't specify versions.
+      requirements-find-args: '! -name requirements-noble.txt ! -path "./tests/spread*" ! -path "./docs/**"'
+      trivy-extra-args: "--severity HIGH,CRITICAL --ignore-unfixed --skip-dirs tests/spread/"

.github/workflows/publish.yaml

@@ -1,6 +1,6 @@
 name: CI
 
-on: 
+on:
   pull_request:
   push:
     branches:

.github/workflows/qa.yaml

@@ -0,0 +1,24 @@
+name: QA
+on:
+  push:
+    branches:
+      - "main"
+      - "feature/*"
+      - "hotfix/*"
+      - "release/*"
+      - "renovate/*"
+  pull_request:
+
+jobs:
+  lint:
+    uses: canonical/starflow/.github/workflows/lint-python.yaml@main
+  test:
+    uses: canonical/starflow/.github/workflows/test-python.yaml@main
+    with:
+      # Snapcraft currently only tests on Python 3.12 on Ubuntu 24.04
+      fast-test-platforms: '["ubuntu-24.04"]'
+      slow-test-platforms: '["ubuntu-24.04"]'
+      lowest-python-platform: "ubuntu-24.04"
+      fast-test-python-versions: '["3.12"]'
+      slow-test-python-versions: '["3.12"]'
+      lowest-python-version: "3.12"

.github/workflows/release-drafter.yaml

@@ -0,0 +1,16 @@
+name: Release Drafter
+
+on:
+  push:
+    # branches to consider in the event; optional, defaults to all
+    branches:
+      - main
+
+jobs:
+  update_release_draft:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Release Drafter
+        uses: release-drafter/[email protected]
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/release-publish.yaml

@@ -0,0 +1,72 @@
+name: Release
+on:
+  push:
+    tags:
+      # These tags should be protected, remember to enable the rule:
+      # https://github.com/canonical/starbase/settings/tag_protection
+      - "[0-9]+.[0-9]+.[0-9]+"
+
+permissions:
+  contents: write
+
+jobs:
+  source-wheel:
+    runs-on: [self-hosted, jammy]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Fetch tag annotations
+        run: |
+          # Note: we fetch the tags here instead of using actions/checkout's "fetch-tags"
+          # because of https://github.com/actions/checkout/issues/1467
+          git fetch --force --tags --depth 1
+          git describe --dirty --long --match '[0-9]*.[0-9]*.[0-9]*' --exclude '*[^0-9.]*'
+      - name: Setup Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.10"
+          check-latest: true
+      - name: Build packages
+        run: |
+          pip install build twine
+          python3 -m build
+          twine check dist/*
+      - name: Upload pypi packages artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: pypi-packages
+          path: dist/
+  pypi:
+    needs: ["source-wheel"]
+    runs-on: [self-hosted, jammy, amd64]
+    permissions:
+      # IMPORTANT: this permission is mandatory for trusted publishing
+      id-token: write
+    steps:
+      - name: Get packages
+        uses: actions/download-artifact@v4
+        with:
+          name: pypi-packages
+          path: dist/
+      - name: Publish to pypi
+        # Note: this action uses PyPI's support for Trusted Publishers
+        # It needs a configuration on the PyPI project - see:
+        # https://docs.pypi.org/trusted-publishers/adding-a-publisher/#github-actions
+        uses: pypa/gh-action-pypi-publish@release/v1
+  github-release:
+    needs: ["source-wheel"]
+    runs-on: [self-hosted, jammy]
+    steps:
+      - name: Get pypi artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: pypi-packages
+      - name: Release
+        uses: softprops/action-gh-release@v2
+        with:
+          # Generate release notes on the new GH release
+          generate_release_notes: true
+          # Add wheel and source tarball
+          files: |
+            *.whl
+            *.tar.gz

.github/workflows/tics.yaml

@@ -3,13 +3,13 @@ name: TICS
 on:
   push:
     branches:
-    - main
-    # to easy test changes to the workflow
-    - tiobe
+      - main
+      # to easy test changes to the workflow
+      - tiobe
 
 jobs:
   CI:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -22,22 +22,32 @@ jobs:
           sudo apt-get update
           echo "::endgroup::"
           echo "::group::apt-get install..."
-          sudo apt-get install -y python3 python3-dev libapt-pkg-dev libyaml-dev xdelta3 patchelf
+          sudo apt-get install -y python3 python3-dev libapt-pkg-dev libyaml-dev umoci
           echo "::endgroup::"
-          echo "::group::pip install"
-          python -m pip install 'tox<5.0' tox-gh
+          echo "::group::snap install"
+          sudo snap install --classic astral-uv
+          echo "::endgroup::"
+          echo "::group::install requirements"
+          uv sync --frozen --group dev
           echo "::endgroup::"
 
-      - name: Setup Tox environment
-        run: tox --workdir /tmp/tox run-parallel --parallel auto --parallel-no-spinner --parallel-live --colored yes -e test-all-py310 --notest
+      - name: Install project
+        run: |
+          python -m pip install -e .
 
-      - name: Test with tox
-        run: tox --workdir /tmp/tox run --skip-pkg-install --result-json results/tox-py310.json --colored yes -e test-all-py310
+      - name: Run coverage
+        run: |
+          make test-coverage
+
+      - name: Upload test results
+        if: success() || failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: test-results-ubuntu-24.04
+          path: results/
 
       - name: Run TICS analysis
         uses: tiobe/tics-github-action@v3
-        env:
-          PATH: "/tmp/tox/test-all-py310/bin:/snap/bin:/home/runner/.local/bin:/home/runner/.cargo/bin:/bin:/usr/bin:/usr/local/bin:"
         with:
           mode: qserver
           project: snapcraft