Release v4.1.0

.devcontainer/Dockerfile

@@ -6,7 +6,7 @@ RUN apt-get update && export DEBIAN_FRONTEND=noninteractive \
 
 # Set package versions
 ARG AZURE_CLI_VERSION="2.42.0"
-ARG PWSH_VERSION="7.2.6"
+ARG PWSH_VERSION="7.3.2"
 
 # Set up TARGETARCH variable to use to pull the right binaries for the current architecture.
 ARG TARGETARCH
@@ -46,7 +46,7 @@ RUN groupadd --gid $USER_GID $USERNAME \
 USER $USERNAME
 
 # Install Sphinx dependencies
-COPY ./docs/build/requirements.txt /build/requirements.txt
+COPY ./docs/requirements.txt /build/requirements.txt
 RUN pip3 install -r /build/requirements.txt
 
 # Install/check needed powershell modules

.github/ISSUE_TEMPLATE/software_package_request.md

@@ -0,0 +1,42 @@
+---
+name: Software package request
+about: Request that a new package is added to the Tier 3 allow list
+title: "<short description of issue>"
+labels: "type: enhancement"
+assignees: ""
+---
+
+## :white_check_mark: Checklist
+
+<!--
+Before reporting a problem please check the following. Replace the empty checkboxes [ ] below with checked ones [x] accordingly.
+-->
+
+- [ ] I have searched open and closed issues for duplicates.
+- [ ] This is a request for a new software package to be added to the Data Safe Haven
+- [ ] The package is still missing in the [latest version](https://github.com/alan-turing-institute/data-safe-haven/releases).
+
+## :gift: Package details
+
+<!--
+Provide details about the package you would like to see added:
+
+- Package name
+- Target audience: "core" (broadly useful for any project) or "extra" (domain specific)
+- Package version (if different from latest)
+- Package repository (e.g. CRAN, PyPI)
+- Number of authors/contributors to the package codebase
+- Any existing versions that should not be used (linking to publicly-accessible CVE databases if relevant)
+- Download statistics (recent and longer-term, for both current and previous versions)
+- List of packages that this package depends on
+-->
+
+## :steam_locomotive: Why is this needed?
+
+<!--
+To support this request, please respond to the following questions:
+
+- What will you be able to do with this package that you can't currently do?
+- Is this the most widely supported package for the intended purpose? What alternatives are there?
+- What risks to data integrity/security might arise from including this package or its dependencies?
+-->

.github/pull_request_template.md

@@ -8,10 +8,10 @@ Replace the empty checkboxes [ ] below with checked ones [x] accordingly.
 -->
 
 - [ ] You have given your pull request a meaningful title (_e.g._ `Enable foobar integration` rather than `515 foobar`).
-- [ ] You are targeting the **develop branch**.
-- [ ] Your branch is up-to-date with the **develop branch** (you probably started your branch from `develop` but it may have changed since then).
-- [ ] If-and-only-if your changes are not yet ready to merge, you have marked this pull request as a **draft** pull request and added '[WIP]' to the title.
-- [ ] If-and-only-if you have changed any Powershell code, you have run the code formatter. You can do this with `./tests/AutoFormat_Powershell.ps1 -TargetPath <path to file or directory>`.
+- [ ] You are targeting the appropriate branch. If you're not certain which one this is, it should be **`develop`**.
+- [ ] Your branch is up-to-date with the **target branch** (it probably was when you started, but it may have changed since then).
+- [ ] You have marked this pull request as a **draft** and added `'[WIP]'` to the title if needed (if you're not yet ready to merge).
+- [ ] You have formatted your code using appropriate automated tools (for example `./tests/AutoFormat_Powershell.ps1 -TargetPath <path to file or directory>` for Powershell).
 
 ### :arrow_heading_up: Summary
 

.github/scripts/update_rstudio.py

@@ -7,7 +7,7 @@
 root = html.fromstring(remote_page.content)
 short_links = [link for link in root.xpath("//a[contains(text(), '.deb')]/@href") if "debian" not in link]
 
-for ubuntu_version in ["bionic", "jammy"]:
+for ubuntu_version in ["focal", "jammy"]:
     short_link = [link for link in short_links if ubuntu_version in link][0]
     remote_content = requests.get(short_link, allow_redirects=True)
     sha256 = hashlib.sha256(remote_content.content).hexdigest()

.github/workflows/build_allow_lists.yaml

@@ -7,6 +7,7 @@ on:  # yamllint disable-line rule:truthy
     branches: [develop]
   schedule:
     - cron: "0 0 */6 * *"  # run every six days in order to keep the cache fresh
+  workflow_dispatch:  # allow this workflow to be manually triggered
 
 # checkout needs 'contents:read'
 # pull request needs 'pull-requests:write' and 'contents:write'
@@ -22,10 +23,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
 
       - name: Cache dependencies
-        uses: actions/cache@v2
+        uses: actions/cache@v3
         with:
           path: environment_configs/package_lists/dependency-cache.json
           key: dependencies-${{ github.sha }}  # request a cache that does not yet exist
@@ -49,12 +50,12 @@ jobs:
 
       - name: Get current date
         id: date
-        run: echo "::set-output name=date::$(date +'%Y-%m-%d')"
+        run: echo "date=$(date +'%Y-%m-%d')" >> $GITHUB_OUTPUT
 
       - name: Create pull request
-        if: ${{ (! env.TIMEOUT_REACHED) && (! env.ACT) }}
+        if: ${{ (env.TIMEOUT_REACHED == 0) && (! env.ACT) }}
         id: pull-request
-        uses: peter-evans/create-pull-request@dcd5fd746d53dd8de555c0f10bca6c35628be47a  # This commit corresponds to tag 3.12.0
+        uses: peter-evans/create-pull-request@38e0b6e68b4c852a5500a94740f0e535e0d7ba54  # This commit corresponds to tag 4.2.4
         with:
           commit-message: Update PyPI and CRAN allow lists
           committer: GitHub Actions <noreply@github.com>

.github/workflows/documentation.yaml

@@ -0,0 +1,57 @@
+---
+name: Documentation
+
+# Run workflow on pushes to matching branches
+on:  # yamllint disable-line rule:truthy
+  push:
+    branches: [develop]
+  pull_request:
+    branches: [develop]
+
+jobs:
+  build:
+    name: Build
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: ./docs/
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+      - name: Setup Python
+        uses: actions/setup-python@v4
+        with:
+          python-version: 3.11
+      - name: Install dependencies
+        run: |
+          pip install -r requirements.txt
+      - name: Sphinx build
+        run: |
+          make html SPHINXOPTS="-W"
+
+  check_links:
+    name: Check links
+    runs-on: ubuntu-latest
+    needs: build
+    defaults:
+      run:
+        working-directory: ./docs/
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+      - name: Setup Python
+        uses: actions/setup-python@v4
+        with:
+          python-version: 3.11
+      - name: Install dependencies
+        run: |
+          pip install -r requirements.txt
+      - name: Sphinx build
+        # Set warnings to be treated as errors
+        run: |
+          make html SPHINXOPTS="-W"
+      - name: Link Checker
+        uses: lycheeverse/lychee-action@v1.7.0
+        with:
+          args: --config='./.lychee.toml' --no-progress './docs/build/html/**/*.html'
+          fail: true  # fail on broken links

.github/workflows/lint_code.yaml

@@ -9,32 +9,6 @@ on:  # yamllint disable-line rule:truthy
     branches: [develop]
 
 jobs:
-  lint_html:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v3
-      - name: Get tags
-        run: git fetch --tags origin
-      - name: Install requirements
-        shell: bash
-        run: |
-          sudo gem install html-proofer -v 4.4.1
-          pip install -r docs/build/requirements.txt
-      - name: Generate HTML documention
-        shell: bash
-        run: |
-          DISABLE_VERSION_LINKS=1 make -C docs html
-      - name: Lint HTML
-        shell: bash
-        run: |
-          htmlproofer docs/_output \
-            --allow-missing-href=true \
-            --enforce-https=true \
-            --ignore-files "/_static/" \
-            --ignore-status-codes "502,503" \
-            --ignore-urls "/github.com\/alan-turing-institute\/data-classification-app/,/www.turing.ac.uk/"
-
   lint_json:
     runs-on: ubuntu-latest
     steps:

.github/workflows/test_code.yaml

@@ -31,7 +31,8 @@ jobs:
       - name: Install requirements
         shell: bash
         run: npm install -g markdown-link-check
-      - name: Test Markdown for dead links
-        shell: bash
-        run: find . -name "*.md" | xargs -n 1 markdown-link-check -p -c .markdownlinkcheck.json
-        continue-on-error: true
+      - name: Link Checker
+        uses: lycheeverse/lychee-action@v1.7.0
+        with:
+          args: --config='./.lychee.toml' --no-progress --offline '**/*.md' --exclude-path './docs'
+          fail: true  # fail on broken links

.github/workflows/update_package_versions.yaml

@@ -7,6 +7,7 @@ on:  # yamllint disable-line rule:truthy
     branches: [develop]
   schedule:
     - cron: "0 0 */7 * *"  # run once per week
+  workflow_dispatch:  # allow this workflow to be manually triggered
 
 # checkout needs 'contents:read'
 # pull request needs 'pull-requests:write' and 'contents:write'
@@ -19,10 +20,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
 
       - name: Setup Python
-        uses: actions/setup-python@v2
+        uses: actions/setup-python@v4
         with:
           python-version: '3.10'
 
@@ -54,7 +55,7 @@ jobs:
       - name: Create pull request
         if: ${{ ! env.ACT }}
         id: pull-request
-        uses: peter-evans/create-pull-request@dcd5fd746d53dd8de555c0f10bca6c35628be47a  # This commit corresponds to tag 3.12.0
+        uses: peter-evans/create-pull-request@153407881ec5c347639a548ade7d8ad1d6740e38  # This commit corresponds to tag 5.0.2
         with:
           commit-message: Update SRD package versions
           committer: GitHub Actions <noreply@github.com>

.gitignore

@@ -28,9 +28,13 @@ docs/*.pdf
 # ... except the tiers flowchart
 !docs/tiersflowchart.pdf
 
-# Sphinx output
-docs/_output
+# Sphinx output and venv
+docs/build
+docs/venv
 
 # Files produced during testing
 .mustache_config.json
-expanded.yaml
+expanded.yaml
+
+# Lychee cache
+.lycheecache