Update cookiecutter

.ci/scripts/check_changelog_snippets.py

@@ -0,0 +1,36 @@
+#!/bin/env python3
+# /// script
+# requires-python = ">=3.11"
+# dependencies = [
+# ]
+# ///
+import re
+import sys
+from pathlib import Path
+
+import tomllib
+
+EXCEPTIONS = [
+    ".TEMPLATE.md",
+    ".gitkeep",
+    "pulp-glue-workflow",
+]
+
+
+def snippet_valid(path: Path, changelog_exts: list[str]) -> bool:
+    return (path.name in EXCEPTIONS) or (
+        path.suffix in changelog_exts
+        and (path.stem.startswith("+") or re.fullmatch(r"\d*", path.stem))
+    )
+
+
+if __name__ == "__main__":
+    with Path("pyproject.toml").open("rb") as fp:
+        pyproject_toml = tomllib.load(fp)
+    changelog_exts = [
+        f".{item['directory']}" for item in pyproject_toml["tool"]["towncrier"]["type"]
+    ]
+    matches = Path("CHANGES").rglob("*")
+    invalid_snippets = ", ".join(f"'{s}'" for s in matches if not snippet_valid(s, changelog_exts))
+    if invalid_snippets:
+        sys.exit(f"LINT: Invalid changelog entries: {invalid_snippets}.")

.ci/scripts/pr_labels.py

@@ -16,7 +16,7 @@
 from git import Repo
 
 
-def main():
+def main() -> None:
     assert len(sys.argv) == 3
 
     with Path("pyproject.toml").open("rb") as fp:

.ci/scripts/release.sh

@@ -23,4 +23,4 @@ towncrier build --yes --version "${NEW_VERSION}"
 bump-my-version bump release --commit --message "Release {new_version}" --tag --tag-name "{new_version}" --tag-message "Release {new_version}" --allow-dirty
 bump-my-version bump patch --commit
 
-git push origin "${BRANCH}" "${NEW_VERSION}"
+git push --atomic origin "${BRANCH}" "${NEW_VERSION}"

.ci/scripts/validate_commit_message.py

@@ -62,15 +62,17 @@ def check_changelog(issue: str) -> None:
 print(f"Checking commit message for {sha[0:7]}.")
 
 # validate the issue attached to the commit
-issue_regex = r"(?:{keywords})[\s:]+#(\d+)".format(keywords=("|").join(KEYWORDS))
+issue_regex = r"(?:{keywords})[\s:]+#(\d+)".format(
+    keywords=("|").join(re.escape(k) for k in KEYWORDS)
+)
 issues = re.findall(issue_regex, message, re.IGNORECASE)
 cherry_pick_regex = r"^\s*\(cherry picked from commit [0-9a-f]*\)\s*$"
 cherry_pick = re.search(cherry_pick_regex, message, re.MULTILINE)
 
 if issues:
     for issue in issues:
         if not cherry_pick:
-            check_status(issue)
             check_changelog(issue)
+            check_status(issue)
 
 print(f"Commit message for {sha[0:7]} passed.")

.github/workflows/build.yml

@@ -4,12 +4,18 @@ name: "Build"
 on:
   workflow_call:
 
+defaults:
+  run:
+    working-directory: "pulp-cli-workflow"
+
 jobs:
   build:
     runs-on: "ubuntu-latest"
     steps:
       - name: "Checkout"
         uses: "actions/checkout@v6"
+        with:
+          path: "pulp-cli-workflow"
       - name: "Set up Python"
         uses: "actions/setup-python@v6"
         with:
@@ -22,14 +28,14 @@ jobs:
       - name: "Build wheels"
         run: |
           make build
-          touch .root
+          touch ../.root
       - name: "Upload wheels"
         uses: "actions/upload-artifact@v6"
         with:
           name: "pulp_cli_packages"
           path: |
             .root
-            dist/
+            pulp-cli-workflow/dist/
           if-no-files-found: "error"
           retention-days: 5
 ...

.github/workflows/codeql.yml

@@ -2,11 +2,12 @@
 name: "CodeQL"
 
 on:
-  push:
-    branches:
-      - "main"
   workflow_call:
 
+defaults:
+  run:
+    working-directory: "pulp-cli-workflow"
+
 jobs:
   analyze:
     name: "Analyze"
@@ -19,6 +20,8 @@ jobs:
     steps:
       - name: "Checkout"
         uses: "actions/checkout@v6"
+        with:
+          path: "pulp-cli-workflow"
       - name: "Initialize CodeQL"
         uses: "github/codeql-action/init@v4"
         with:

.github/workflows/collect_changes.yml

@@ -4,13 +4,21 @@ on:
   workflow_call:
   workflow_dispatch:
 
+defaults:
+  run:
+    working-directory: "pulp-cli-workflow"
+
 jobs:
   collect-changes:
+    permissions:
+      contents: "write"
+      pull-requests: "write"
     runs-on: "ubuntu-latest"
     steps:
       - name: "Checkout"
         uses: "actions/checkout@v6"
         with:
+          path: "pulp-cli-workflow"
           fetch-depth: 0
       - name: "Set up Python"
         uses: "actions/setup-python@v6"
@@ -32,16 +40,16 @@ jobs:
         uses: "peter-evans/create-pull-request@v8"
         id: "create_pr"
         with:
-          token: "${{ secrets.RELEASE_TOKEN }}"
           title: "Update Changelog"
           body: ""
           branch: "update_changes"
           delete-branch: true
+          path: "pulp-cli-workflow"
       - name: "Mark PR automerge"
         run: |
           gh pr merge --rebase --auto "${{ steps.create_pr.outputs.pull-request-number }}"
         if: "steps.create_pr.outputs.pull-request-number"
         env:
-          GH_TOKEN: "${{ secrets.RELEASE_TOKEN }}"
+          GH_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
         continue-on-error: true
 ...

.github/workflows/cookiecutter.yml

@@ -11,16 +11,21 @@ defaults:
 
 jobs:
   update-ci:
+    permissions:
+      contents: "write"
+      pull-requests: "write"
     runs-on: "ubuntu-latest"
     steps:
       - uses: "actions/checkout@v6"
         with:
           repository: "pulp/pulp-cli"
-          path: "pulp-cli"
-      - uses: "actions/checkout@v6"
+          ref: "main"
+          path: "pulp-cli_cc"
+      - name: "Checkout"
+        uses: "actions/checkout@v6"
         with:
-          token: "${{ secrets.RELEASE_TOKEN }}"
           path: "pulp-cli-workflow"
+          token: "${{ secrets.RELEASE_TOKEN }}"
       - name: "Set up Python"
         uses: "actions/setup-python@v6"
         with:
@@ -36,7 +41,7 @@ jobs:
           git config user.email pulp-infra@redhat.com
       - name: "Apply cookiecutter templates"
         run: |
-          uv run ../pulp-cli/cookiecutter/apply_templates.py
+          uv run ../pulp-cli_cc/cookiecutter/apply_templates.py
           if [ "$(git status --porcelain)" ]
           then
             git add .
@@ -46,29 +51,33 @@ jobs:
         uses: "peter-evans/create-pull-request@v8"
         id: "create_pr"
         with:
-          token: "${{ secrets.RELEASE_TOKEN }}"
           title: "Update cookiecutter"
           body: ""
           branch: "update_cookiecutter"
           delete-branch: true
           path: "pulp-cli-workflow"
+          token: "${{ secrets.RELEASE_TOKEN }}"
       - name: "Mark PR automerge"
         run: |
           gh pr merge --rebase --auto "${{ steps.create_pr.outputs.pull-request-number }}"
         if: "steps.create_pr.outputs.pull-request-number"
         env:
-          GH_TOKEN: "${{ secrets.RELEASE_TOKEN }}"
+          GH_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
         continue-on-error: true
   update-dependencies:
+    permissions:
+      contents: "write"
+      pull-requests: "write"
     runs-on: "ubuntu-latest"
     steps:
       - uses: "actions/checkout@v6"
         with:
           repository: "pulp/pulp-cli"
-          path: "pulp-cli"
-      - uses: "actions/checkout@v6"
+          branch: "main"
+          path: "pulp-cli_cc"
+      - name: "Checkout"
+        uses: "actions/checkout@v6"
         with:
-          token: "${{ secrets.RELEASE_TOKEN }}"
           path: "pulp-cli-workflow"
       - name: "Set up Python"
         uses: "actions/setup-python@v6"
@@ -85,7 +94,7 @@ jobs:
           git config user.email pulp-infra@redhat.com
       - name: "Apply cookiecutter templates"
         run: |
-          uv run ../pulp-cli/cookiecutter/update_pulp_cli.py
+          uv run ../pulp-cli_cc/cookiecutter/update_pulp_cli.py
           if [ "$(git status --porcelain)" ]
           then
             git add .
@@ -95,7 +104,6 @@ jobs:
         uses: "peter-evans/create-pull-request@v8"
         id: "create_pr"
         with:
-          token: "${{ secrets.RELEASE_TOKEN }}"
           title: "Update CLI and GLUE"
           body: ""
           branch: "update_cli"
@@ -106,6 +114,6 @@ jobs:
           gh pr merge --rebase --auto "${{ steps.create_pr.outputs.pull-request-number }}"
         if: "steps.create_pr.outputs.pull-request-number"
         env:
-          GH_TOKEN: "${{ secrets.RELEASE_TOKEN }}"
+          GH_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
         continue-on-error: true
 ...

.github/workflows/lint.yml

@@ -4,6 +4,10 @@ name: "Lint"
 on:
   workflow_call:
 
+defaults:
+  run:
+    working-directory: "pulp-cli-workflow"
+
 jobs:
   lint:
     runs-on: "ubuntu-latest"
@@ -16,6 +20,8 @@ jobs:
     steps:
       - name: "Checkout"
         uses: "actions/checkout@v6"
+        with:
+          path: "pulp-cli-workflow"
       - name: "Set up Python"
         uses: "actions/setup-python@v6"
         with:

.github/workflows/nightly.yml

@@ -1,5 +1,5 @@
 ---
-name: "pulp-cli Nightly"
+name: "Nightly"
 
 on:
   schedule:
@@ -14,8 +14,14 @@ jobs:
       - "build"
     uses: "./.github/workflows/test.yml"
   codeql:
+    permissions:
+      actions: "read"
+      contents: "read"
+      security-events: "write"
     uses: "./.github/workflows/codeql.yml"
   collect_changes:
+    permissions:
+      contents: "write"
+      pull-requests: "write"
     uses: "./.github/workflows/collect_changes.yml"
-    secrets: "inherit"
 ...

.github/workflows/pr.yml

@@ -1,5 +1,5 @@
 ---
-name: "pulp-cli CI"
+name: "Pull Request"
 
 on:
   pull_request:
@@ -22,13 +22,18 @@ jobs:
   codeql:
     needs:
       - "lint"
+    permissions:
+      actions: "read"
+      contents: "read"
+      security-events: "write"
     uses: "./.github/workflows/codeql.yml"
   check-commits:
     runs-on: "ubuntu-latest"
     steps:
       - name: "Checkout"
         uses: "actions/checkout@v6"
         with:
+          path: "pulp-cli-workflow"
           fetch-depth: 0
       - name: "Set up Python"
         uses: "actions/setup-python@v6"
@@ -53,6 +58,7 @@ jobs:
             fi
           done
         shell: "bash"
+        working-directory: "pulp-cli-workflow"
   ready-to-ship:
     # This is a dummy dependent task to have a single entry for the branch protection rules.
     runs-on: "ubuntu-latest"

.github/workflows/pr_checks.yml

@@ -1,5 +1,5 @@
 ---
-name: "Pulp CLI PR static checks"
+name: "PR static checks"
 on:
   pull_request_target:
     types: ["opened", "synchronize", "reopened"]
@@ -12,16 +12,21 @@ concurrency:
   group: "${{ github.event.pull_request.number }}-${{ github.workflow }}"
   cancel-in-progress: true
 
+defaults:
+  run:
+    working-directory: "pulp-cli-workflow"
+
 jobs:
   apply_labels:
-    runs-on: "ubuntu-latest"
-    name: "Label PR"
     permissions:
       pull-requests: "write"
+    runs-on: "ubuntu-latest"
+    name: "Label PR"
     steps:
       - name: "Checkout"
         uses: "actions/checkout@v6"
         with:
+          path: "pulp-cli-workflow"
           fetch-depth: 0
       - name: "Set up Python"
         uses: "actions/setup-python@v6"