Add ongoing package linting & inspection #462

hynek · 2022-12-22T06:19:00Z

Fixes #457

codecov · 2022-12-22T06:21:53Z

Codecov Report

Base: 100.00% // Head: 100.00% // No change to project coverage 👍

Coverage data is based on head (28f4dce) compared to base (6827641).
Patch has no changes to coverable lines.

Additional details and impacted files

@@            Coverage Diff            @@
##             trunk      #462   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files           13        13           
  Lines          613       613           
  Branches       144       144           
=========================================
  Hits           613       613

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

☔ View full report at Codecov.
📢 Do you have feedback about the report comment? Let us know in this issue.

hynek · 2022-12-22T06:40:16Z

So what this revealed is that we've been packaging src/towncrier.egg-info in our SDist all along and I don't know why and I don't know how to stop it. 😳

adiroiban

Many thanks for the PR.

I have a few medium important comments.

Nothing that should block this PR.
We can update the changes later in a separate PR.

The important part is to make sure we get a "red-alert" when the package is not ok.

I think that pinning the hynek/build-and-inspect-python-package@v1 to a specific commit instead of a tag is important.

I will let you decide if this is a security issue or not.

adiroiban · 2022-12-23T12:48:52Z

.github/workflows/ci.yml

+
+    steps:
+      - uses: actions/checkout@v3
+      - uses: hynek/build-and-inspect-python-package@v1


Should we pin this to a specific commit?

Similar to that we did for

uses: pypa/gh-action-pypi-publish@37f50c210e3d2f9450da2cd423303d6a14a6e29f

This is mainly for security reasons.

is someone keeping those pins up to date?

I think that GHA dependencies should be handled as any other testing / build / CI dependency.

And as a general rule, we should pin every package that we use during the build system

Now, another question.

Do "hynek/build-and-inspect-python-package" need to be a GHA action ?
Can it be distributed installed and executed just like any other python package?

Just asking.

That would be pointless since it doesn't do much novel things except calling established tools. This way you add only one like of YAML and it will just work, including handling package dependencies.

.github/workflows/ci.yml

adiroiban

thanks for the updates. I think this can be merged.

Bumps [towncrier](https://github.com/twisted/towncrier) from 22.8.0 to 23.6.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/twisted/towncrier/releases">towncrier's releases</a>.</em></p> <blockquote> <h2>Towncrier 23.6.0</h2> <h1>towncrier 23.6.0 (2023-06-06)</h1> <p>This is the last release to support Python 3.7.</p> <h2>Features</h2> <ul> <li> <p>Make <code>towncrier create</code> use the fragment counter rather than failing on existing fragment names.</p> <p>For example, if there is an existing fragment named <code>123.feature</code>, then <code>towncrier create 123.feature</code> will now create a fragment named <code>123.feature.1</code>. (<a href="https://redirect.github.com/twisted/towncrier/issues/475">#475</a>)</p> </li> <li> <p>Provide a default Markdown template if the configured filename ends with <code>.md</code>.</p> <p>The Markdown template uses the same rendered format as the default <em>reStructuredText</em> template, but with a Markdown syntax. (<a href="https://redirect.github.com/twisted/towncrier/issues/483">#483</a>)</p> </li> <li> <p>Towncrier no longer depends on setuptools & uses importlib.resources (or its backport) instead. (<a href="https://redirect.github.com/twisted/towncrier/issues/496">#496</a>)</p> </li> <li> <p>Added pre-commit hooks for checking and updating news in projects using pre-commit. (<a href="https://redirect.github.com/twisted/towncrier/issues/498">#498</a>)</p> </li> <li> <p>Calling <code>towncrier check</code> without an existing configuration, will just show only an error message.</p> <p>In previous versions, a traceback was generated instead of the error message. (<a href="https://redirect.github.com/twisted/towncrier/issues/501">#501</a>)</p> </li> </ul> <h2>Bugfixes</h2> <ul> <li> <p>Fix creating fragment in a section not adding random characters.</p> <p>For example, <code>towncrier create some_section/+.feature</code> should end up as a fragment named something like <code>news/some_section/+a4e22da1.feature</code>. (<a href="https://redirect.github.com/twisted/towncrier/issues/468">#468</a>)</p> </li> <li> <p>Fix the ReadTheDocs build for <code>towncrier</code> which was broken due to the python version in use being 3.8. Upgrade to 3.11. (<a href="https://redirect.github.com/twisted/towncrier/issues/509">#509</a>)</p> </li> </ul> <h2>Improved Documentation</h2> <ul> <li>Moved man page to correct section (<a href="https://redirect.github.com/twisted/towncrier/issues/470">#470</a>)</li> <li>Update link to Quick Start in configuration.html to point to Tutorial instead. (<a href="https://redirect.github.com/twisted/towncrier/issues/504">#504</a>)</li> <li>Add a note about the build command's <code>--version</code> requiring the command to be explicitly passed. (<a href="https://redirect.github.com/twisted/towncrier/issues/511">#511</a>)</li> <li>Fix typos in the Pre-Commit docs. (<a href="https://redirect.github.com/twisted/towncrier/issues/512">#512</a>)</li> </ul> <h2>Misc</h2> <ul> <li><a href="https://redirect.github.com/twisted/towncrier/issues/459">#459</a>, <a href="https://redirect.github.com/twisted/towncrier/issues/462">#462</a>, <a href="https://redirect.github.com/twisted/towncrier/issues/472">#472</a>, <a href="https://redirect.github.com/twisted/towncrier/issues/485">#485</a>, <a href="https://redirect.github.com/twisted/towncrier/issues/486">#486</a>, <a href="https://redirect.github.com/twisted/towncrier/issues/487">#487</a>, <a href="https://redirect.github.com/twisted/towncrier/issues/488">#488</a>, <a href="https://redirect.github.com/twisted/towncrier/issues/495">#495</a>, <a href="https://redirect.github.com/twisted/towncrier/issues/497">#497</a>, <a href="https://redirect.github.com/twisted/towncrier/issues/507">#507</a>, <a href="https://redirect.github.com/twisted/towncrier/issues/1117">#1117</a>, <a href="https://redirect.github.com/twisted/towncrier/issues/513">#513</a></li> </ul> <h2>Towncrier 23.6.0rc1</h2> <h1>towncrier 23.6.0rc1 (2023-06-05)</h1> <p>This is the last release to support Python 3.7.</p> <h2>Features</h2> <ul> <li>Make <code>towncrier create</code> use the fragment counter rather than failing on existing fragment names.</li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/twisted/towncrier/blob/trunk/NEWS.rst">towncrier's changelog</a>.</em></p> <blockquote> <h1>towncrier 23.6.0 (2023-06-06)</h1> <p>This is the last release to support Python 3.7.</p> <h2>Features</h2> <ul> <li> <p>Make <code>towncrier create</code> use the fragment counter rather than failing on existing fragment names.</p> <p>For example, if there is an existing fragment named <code>123.feature</code>, then <code>towncrier create 123.feature</code> will now create a fragment named <code>123.feature.1</code>. (<code>[#475](twisted/towncrier#475) <https://github.com/twisted/towncrier/issues/475></code>_)</p> </li> <li> <p>Provide a default Markdown template if the configured filename ends with <code>.md</code>.</p> <p>The Markdown template uses the same rendered format as the default <em>reStructuredText</em> template, but with a Markdown syntax. (<code>[#483](twisted/towncrier#483) <https://github.com/twisted/towncrier/issues/483></code>_)</p> </li> <li> <p>Towncrier no longer depends on setuptools & uses importlib.resources (or its backport) instead. (<code>[#496](twisted/towncrier#496) <https://github.com/twisted/towncrier/issues/496></code>_)</p> </li> <li> <p>Added pre-commit hooks for checking and updating news in projects using pre-commit. (<code>[#498](twisted/towncrier#498) <https://github.com/twisted/towncrier/issues/498></code>_)</p> </li> <li> <p>Calling <code>towncrier check</code> without an existing configuration, will just show only an error message.</p> <p>In previous versions, a traceback was generated instead of the error message. (<code>[#501](twisted/towncrier#501) <https://github.com/twisted/towncrier/issues/501></code>_)</p> </li> </ul> <h2>Bugfixes</h2> <ul> <li> <p>Fix creating fragment in a section not adding random characters.</p> <p>For example, <code>towncrier create some_section/+.feature</code> should end up as a fragment named something like <code>news/some_section/+a4e22da1.feature</code>. (<code>[#468](twisted/towncrier#468) <https://github.com/twisted/towncrier/issues/468></code>_)</p> </li> <li> <p>Fix the ReadTheDocs build for <code>towncrier</code> which was broken due to the python version in use being 3.8. Upgrade to 3.11. (<code>[#509](twisted/towncrier#509) <https://github.com/twisted/towncrier/issues/509></code>_)</p> </li> </ul> <h2>Improved Documentation</h2> <ul> <li>Moved man page to correct section (<code>[#470](twisted/towncrier#470) <https://github.com/twisted/towncrier/issues/470></code>_)</li> <li>Update link to Quick Start in configuration.html to point to Tutorial instead. (<code>[#504](twisted/towncrier#504) <https://github.com/twisted/towncrier/issues/504></code>_)</li> <li>Add a note about the build command's <code>--version</code> requiring the command to be explicitly passed. (<code>[#511](twisted/towncrier#511) <https://github.com/twisted/towncrier/issues/511></code>_)</li> <li>Fix typos in the Pre-Commit docs. (<code>[#512](twisted/towncrier#512) <https://github.com/twisted/towncrier/issues/512></code>_)</li> </ul> <h2>Misc</h2> <ul> <li><code>[#459](twisted/towncrier#459) <https://github.com/twisted/towncrier/issues/459></code><em>, <code>[#462](twisted/towncrier#462) <https://github.com/twisted/towncrier/issues/462></code></em>, <code>[#472](twisted/towncrier#472) <https://github.com/twisted/towncrier/issues/472></code><em>, <code>[#485](twisted/towncrier#485) <https://github.com/twisted/towncrier/issues/485></code></em>, <code>[#486](twisted/towncrier#486) <https://github.com/twisted/towncrier/issues/486></code><em>, <code>[#487](twisted/towncrier#487) <https://github.com/twisted/towncrier/issues/487></code></em>, <code>[#488](twisted/towncrier#488) <https://github.com/twisted/towncrier/issues/488></code><em>, <code>[#495](twisted/towncrier#495) <https://github.com/twisted/towncrier/issues/495></code></em>, <code>[#497](twisted/towncrier#497) <https://github.com/twisted/towncrier/issues/497></code><em>, <code>[#507](twisted/towncrier#507) <https://github.com/twisted/towncrier/issues/507></code></em>, <code>[#1117](https://github.com/twisted/towncrier/issues/1117) <https://github.com/twisted/towncrier/issues/1117></code><em>, <code>[#513](twisted/towncrier#513) <https://github.com/twisted/towncrier/issues/513></code></em></li> </ul> <p>towncrier 22.12.0 (2022-12-21)</p>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/twisted/towncrier/commit/22a5b015e6404900bfaed4d218cacbd09fc43916"><code>22a5b01</code></a> Update for final release.</li> <li><a href="https://github.com/twisted/towncrier/commit/0d9f08708a29a65050c907995e05180d5320fa6f"><code>0d9f087</code></a> Fix news file.</li> <li><a href="https://github.com/twisted/towncrier/commit/32d7034b82bef8b9f36b6aaec2e9c0de328de222"><code>32d7034</code></a> Remove deploy env requirement.</li> <li><a href="https://github.com/twisted/towncrier/commit/13e6d0c52e5dd63bf6fbf5434731dc4997ecfc82"><code>13e6d0c</code></a> Conditionally run the whole publish.</li> <li><a href="https://github.com/twisted/towncrier/commit/6b9b85a252cc10a40d024710777df48b53740b9a"><code>6b9b85a</code></a> Add dedicated environment.</li> <li><a href="https://github.com/twisted/towncrier/commit/3deaebd35a38bf89e1e0d92bf7822b3ffa61bda0"><code>3deaebd</code></a> Add a top title to the release notes.</li> <li><a href="https://github.com/twisted/towncrier/commit/a94f23c5e3e410bffd44cefbd961192d28fe76f1"><code>a94f23c</code></a> Fix NEWS.rst formatting.</li> <li><a href="https://github.com/twisted/towncrier/commit/3ba6cd1a1830d53266129770556c3d3ea593fcd6"><code>3ba6cd1</code></a> Include the release notes in the docs to make it easyier to review the RST fo...</li> <li><a href="https://github.com/twisted/towncrier/commit/1888debeb12afef9406ac997ad1f9e554423832c"><code>1888deb</code></a> Add info about 3.7.</li> <li><a href="https://github.com/twisted/towncrier/commit/b7a561cf5a85fce14e4abc1ea17d8d9ee59d2e60"><code>b7a561c</code></a> Update for release candidate.</li> <li>Additional commits viewable in <a href="https://github.com/twisted/towncrier/compare/22.8.0...23.6.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=towncrier&package-manager=pip&previous-version=22.8.0&new-version=23.6.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> --------- Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: dependabot[bot] <dependabot[bot]@users.noreply.github.com> Co-authored-by: Sam Bull <[email protected]>

Add ongoing package linting & inspection

54daa21

hynek requested a review from a team as a code owner December 22, 2022 06:19

Add news fragment

6a69e8c

Fix content type

6151824

hynek added 2 commits December 22, 2022 09:43

Merge branch 'trunk' into pkg-check

2d6c9c1

Merge branch 'trunk' into pkg-check

4bcf265

adiroiban approved these changes Dec 23, 2022

View reviewed changes

hynek added 5 commits December 30, 2022 10:21

Merge branch 'trunk' into pkg-check

eb2d999

Don't use a separate job for pkg linting

a2c6c47

Pin baipp

5f6c0e4

Return deleted empty line

ddf7811

Switch to 3.11 proper while we're at it

28f4dce

hynek requested a review from adiroiban December 30, 2022 09:49

adiroiban approved these changes Dec 30, 2022

View reviewed changes

hynek merged commit 5a90888 into trunk Dec 30, 2022

hynek deleted the pkg-check branch December 30, 2022 12:19

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add ongoing package linting & inspection #462

Add ongoing package linting & inspection #462

hynek commented Dec 22, 2022

codecov bot commented Dec 22, 2022 •

edited

Loading

hynek commented Dec 22, 2022

adiroiban left a comment

adiroiban Dec 23, 2022

hynek Dec 30, 2022

adiroiban Dec 30, 2022

hynek Dec 30, 2022

adiroiban left a comment

Add ongoing package linting & inspection #462

Add ongoing package linting & inspection #462

Conversation

hynek commented Dec 22, 2022

codecov bot commented Dec 22, 2022 • edited Loading

Codecov Report

hynek commented Dec 22, 2022

adiroiban left a comment

Choose a reason for hiding this comment

adiroiban Dec 23, 2022

Choose a reason for hiding this comment

hynek Dec 30, 2022

Choose a reason for hiding this comment

adiroiban Dec 30, 2022

Choose a reason for hiding this comment

hynek Dec 30, 2022

Choose a reason for hiding this comment

adiroiban left a comment

Choose a reason for hiding this comment

codecov bot commented Dec 22, 2022 •

edited

Loading