Modernize CI infrastructure

.github/workflows/build.yaml

@@ -11,29 +11,44 @@ on:
       - 'release/*'
   workflow_call:
 
+# Cancel any in-progress runs on new pushes to the same branch/PR
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
 jobs:
   build-wheel:
     name: Wheel
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           fetch-depth: 0  # Fetch all commits and tags, needed for intermediate versions
 
-      - name: Set up Python 3.8
-        uses: actions/setup-python@v4
+      - name: Set up Python 3.13
+        uses: actions/setup-python@v5
         with:
-          python-version: 3.8
+          python-version: '3.13'
+          cache: 'pip'
+          cache-dependency-path: |
+            requirements-build.txt
+            pyproject.toml
 
       - name: Upgrade pip and other packaging tools
-        run: python3 -m pip install --upgrade pip setuptools setuptools_scm wheel build twine
+        run: python3 -m pip install --upgrade -r requirements-build.txt
 
       - name: Show package version
         run: python3 -m setuptools_scm
 
       - name: Build the `sdr` package
         run: python3 -m build
 
+      - name: List built artifacts
+        run: ls -l dist
+
       - name: Verify the wheel file
         run: python3 -m twine check dist/*
 

.github/workflows/docs.yaml

@@ -18,21 +18,33 @@ on:
 env:
   WORKFLOW_DISPATCH_TAG: ${{ github.event.inputs.tag }}
 
+# Cancel any in-progress runs on new pushes to the same branch/PR
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Build
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           ref: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.tag || github.ref }}
           # NOTE: Fake ternary operator, see https://github.com/actions/runner/issues/409
           fetch-depth: 0  # Fetch all commits and tags, needed for intermediate versions
 
       - name: Set up Python 3.11
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v5
         with:
-          python-version: 3.11
+          python-version: '3.11'
+          cache: 'pip'
+          cache-dependency-path: |
+            docs/requirements.txt
+            pyproject.toml
 
       - name: Upgrade pip
         run: python3 -m pip install --upgrade pip
@@ -63,15 +75,18 @@ jobs:
     # Only publish new docs to GitHub pages if on a pre-release branch or tagged released version
     if: ${{ github.event_name == 'push' || github.event_name == 'workflow_call' || github.event_name == 'workflow_dispatch'}}
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           ref: gh-pages
 
       - name: Download artifacts
         uses: actions/download-artifact@v4
         with:
           name: docs
+          path: .
 
       - name: Determine folder name
         id: folder
@@ -120,7 +135,7 @@ jobs:
       - name: Update versions.json file
         shell: python
         run: |
-          from distutils.version import StrictVersion
+          from packaging.version import Version
           import json
           import pathlib
           import os
@@ -131,14 +146,15 @@ jobs:
           print(versions)
 
           # Remove "latest" from list of versions
-          versions.remove("latest")
-          os.system("rm latest")
+          if "latest" in versions:
+            versions.remove("latest")
+            os.system("rm latest")
 
           # Sort versions, ignoring the initial 'v'
-          def sort_version(version):
+          def sort_version(version: str):
             if "x" in version:
               version = version.replace("x", "1000")
-            return StrictVersion(version[1:])
+            return Version(version[1:])  # strip leading 'v'
           versions = sorted(versions, key=sort_version, reverse=True)
 
           list_of_dicts = []
@@ -160,6 +176,8 @@ jobs:
 
       - run: git status
 
+      - run: git diff --stat
+
       - uses: stefanzweifel/git-auto-commit-action@v4
         with:
           commit_message: Deploy ${{ github.sha }}

.github/workflows/lint.yaml

@@ -10,29 +10,33 @@ on:
       - main
       - 'release/*'
 
+# Cancel any in-progress runs on new pushes to the same branch/PR
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
 jobs:
   run-linter:
     name: Ruff Lint
     runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        python-version: [3.8, 3.9, '3.10', 3.11, 3.12, 3.13]
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 
-      - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v4
+      - name: Set up Python 3.13
+        uses: actions/setup-python@v5
         with:
-          python-version: ${{ matrix.python-version }}
+          python-version: '3.13'
+          cache: 'pip'
+          cache-dependency-path: requirements-lint.txt
 
       - name: Upgrade pip
         run: python3 -m pip install --upgrade pip
 
       - name: Install the dev requirements
-        run: python3 -m pip install -r requirements-dev.txt
-
-      - name: Install the `sdr` package
-        run: python3 -m pip install .
+        run: python3 -m pip install -r requirements-lint.txt
 
       - name: Lint with ruff
         run: python3 -m ruff check --output-format=github .
@@ -41,21 +45,20 @@ jobs:
     name: Ruff Format
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 
       - name: Set up Python 3.13
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v5
         with:
-          python-version: 3.13
+          python-version: '3.13'
+          cache: 'pip'
+          cache-dependency-path: requirements-lint.txt
 
       - name: Upgrade pip
         run: python3 -m pip install --upgrade pip
 
-      - name: Install the dev requirements
-        run: python3 -m pip install -r requirements-dev.txt
-
-      - name: Install the `sdr` package
-        run: python3 -m pip install .
+      - name: Install lint requirements
+        run: python3 -m pip install -r requirements-lint.txt
 
       - name: Format with ruff
         run: python3 -m ruff format --check .

.github/workflows/release.yaml

@@ -5,20 +5,27 @@ on:
     tags:
       - v*
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Build the package
     uses: ./.github/workflows/build.yaml
+    secrets: inherit
 
   docs:
     name: Build the docs
     uses: ./.github/workflows/docs.yaml
+    secrets: inherit
 
   release:
     name: Create GitHub release
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           fetch-depth: 0  # Fetch all commits and tags
           ref: ${{ github.ref }}
@@ -63,7 +70,7 @@ jobs:
           path: dist/
 
       - name: Publish to TestPyPI
-        uses: pypa/gh-action-pypi-publish@v1.4.2
+        uses: pypa/gh-action-pypi-publish@v1
         with:
           user: __token__
           password: ${{ secrets.TEST_PYPI_API_TOKEN }}
@@ -72,7 +79,7 @@ jobs:
           verbose: true
 
       - name: Publish to PyPI
-        uses: pypa/gh-action-pypi-publish@v1.4.2
+        uses: pypa/gh-action-pypi-publish@v1
         with:
           user: __token__
           password: ${{ secrets.PYPI_API_TOKEN }}