Set branch protection rules. (#207)

Co-authored-by: Jens Vagelpohl <[email protected]>
zopefoundation · May 6, 2024 · 93902d8 · 93902d8
1 parent 7aeb864
commit 93902d8
Show file tree

Hide file tree

Showing 11 changed files with 270 additions and 46 deletions.
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
@@ -10,16 +10,16 @@ repos:
           - id: check-yaml
           - id: debug-statements
             language_version: python3
+    - repo: https://github.com/pre-commit/mirrors-autopep8
+      rev: v2.0.4
+      hooks:
+          - id: autopep8
     - repo: https://github.com/PyCQA/flake8
       rev: 6.1.0
       hooks:
           - id: flake8
             language_version: python3
             additional_dependencies: [flake8-typing-imports==1.15.0]
-    - repo: https://github.com/pre-commit/mirrors-autopep8
-      rev: v2.0.4
-      hooks:
-          - id: autopep8
     - repo: https://github.com/timothycrosley/isort
       rev: 5.12.0
       hooks:

diff --git a/config/README.rst b/config/README.rst
@@ -334,7 +334,7 @@ updated. Example:
         "\"${PYBIN}/tox\" -e py",
         "cd ..",
         ]
-    require-cffi = True
+    require-cffi = true
 
     [zest-releaser]
     options = [

diff --git a/config/c-code/tests-strategy.j2 b/config/c-code/tests-strategy.j2
@@ -3,7 +3,7 @@
       matrix:
         python-version:
 {% if with_pypy %}
-          - "pypy-3.10"
+          - "pypy-%(pypy_version)s"
 {% endif %}
           - "3.7"
           - "3.8"
@@ -15,17 +15,22 @@
           - "%(future_python_version)s"
 {% endif %}
 {% if with_windows %}
-        os: [ubuntu-20.04, macos-11, windows-latest]
+        os: [ubuntu-latest, macos-latest, windows-latest]
 {% else %}
-        os: [ubuntu-20.04, macos-11]
+        os: [ubuntu-latest, macos-latest]
 {% endif %}
 {% if with_pypy or gha_additional_exclude %}
         exclude:
 {% endif %}
+          - os: macos-latest
+            python-version: "3.7"
 {% if with_pypy %}
-          - os: macos-11
-            python-version: "pypy-3.10"
+          - os: macos-latest
+            python-version: "pypy-%(pypy_version)s"
 {% endif %}
 {% for line in gha_additional_exclude %}
           %(line)s
 {% endfor %}
+        include:
+          - os: macos-12
+            python-version: "3.7"
diff --git a/config/c-code/tests.yml.j2 b/config/c-code/tests.yml.j2
@@ -322,7 +322,7 @@ jobs:
 
   coveralls_finish:
     needs: test
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-latest
     steps:
     - name: Coveralls Finished
       uses: AndreMiras/coveralls-python-action@develop
@@ -335,8 +335,8 @@ jobs:
     runs-on: ${{ matrix.os }}
     strategy:
       matrix:
-        python-version: ["3.9"]
-        os: [ubuntu-20.04]
+        python-version: ["%(manylinux_python_version)s"]
+        os: [ubuntu-latest]
 
     steps:
 {% include 'tests-cache.j2' %}
@@ -361,8 +361,8 @@ jobs:
     runs-on: ${{ matrix.os }}
     strategy:
       matrix:
-        python-version: ["3.9"]
-        os: [ubuntu-20.04]
+        python-version: ["%(manylinux_python_version)s"]
+        os: [ubuntu-latest]
 
     steps:
 {% include 'tests-cache.j2' %}
@@ -381,13 +381,13 @@ jobs:
           # python -m pylint --limit-inference-results=1 --rcfile=.pylintrc %(package_name)s -f parseable -r n
 
   manylinux:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-latest
     if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.event.pull_request.base.repo.full_name
     # We use a regular Python matrix entry to share as much code as possible.
     strategy:
       matrix:
-        python-version: ["3.9"]
-        image: [manylinux2014_x86_64, manylinux2014_i686, manylinux2014_aarch64]
+        python-version: ["%(manylinux_python_version)s"]
+        image: [%(manylinux_x86_64)s, %(manylinux_i686)s, %(manylinux_aarch64)s]
 
     steps:
 {% set cache_key = "${{ runner.os }}-pip_manylinux-${{ matrix.image }}-${{ matrix.python-version }}" %}
@@ -396,7 +396,7 @@ jobs:
       - name: Update pip
         run: pip install -U pip
       - name: Build %(package_name)s (x86_64)
-        if: matrix.image == 'manylinux2014_x86_64'
+        if: matrix.image == '%(manylinux_x86_64)s'
         # An alternate way to do this is to run the container directly with a uses:
         # and then the script runs inside it. That may work better with caching.
         # See https://github.com/pyca/bcrypt/blob/f6b5ee2eda76d077c531362ac65e16f045cf1f29/.github/workflows/wheel-builder.yml
@@ -405,14 +405,14 @@ jobs:
         run: |
           bash .manylinux.sh
       - name: Build %(package_name)s (i686)
-        if: matrix.image == 'manylinux2014_i686'
+        if: matrix.image == '%(manylinux_i686)s'
         env:
           DOCKER_IMAGE: quay.io/pypa/${{ matrix.image }}
           PRE_CMD: linux32
         run: |
           bash .manylinux.sh
       - name: Build %(package_name)s (aarch64)
-        if: matrix.image == 'manylinux2014_aarch64'
+        if: matrix.image == '%(manylinux_aarch64)s'
         env:
           DOCKER_IMAGE: quay.io/pypa/${{ matrix.image }}
         run: |

diff --git a/config/config-package.py b/config/config-package.py
@@ -12,11 +12,18 @@
 #
 ##############################################################################
 from functools import cached_property
+from set_branch_protection_rules import set_branch_protection
 from shared.call import abort
 from shared.call import call
 from shared.git import get_branch_name
 from shared.git import get_commit_id
 from shared.git import git_branch
+from shared.packages import FUTURE_PYTHON_VERSION
+from shared.packages import MANYLINUX_AARCH64
+from shared.packages import MANYLINUX_I686
+from shared.packages import MANYLINUX_PYTHON_VERSION
+from shared.packages import MANYLINUX_X86_64
+from shared.packages import PYPY_VERSION
 from shared.path import change_dir
 import argparse
 import collections
@@ -34,7 +41,6 @@
 Generated from:
 https://github.com/zopefoundation/meta/tree/master/config/{config_type}
 --> """
-FUTURE_PYTHON_VERSION = "3.13.0-alpha - 3.13.0"
 DEFAULT = object()
 
 
@@ -502,6 +508,11 @@ def tests_yml(self):
             with_pypy=self.with_pypy,
             with_macos=self.with_macos,
             with_windows=self.with_windows,
+            manylinux_python_version=MANYLINUX_PYTHON_VERSION,
+            manylinux_aarch64=MANYLINUX_AARCH64,
+            manylinux_i686=MANYLINUX_I686,
+            manylinux_x86_64=MANYLINUX_X86_64,
+            pypy_version=PYPY_VERSION,
         )
 
     def manifest_in(self):
@@ -625,6 +636,20 @@ def configure(self):
                     call('git', 'push', '--set-upstream',
                          'origin', self.branch_name)
             print()
+            print('If you are an admin and are logged in via `gh auth login`')
+            print('update branch protection rules? (y/N)?', end=' ')
+            if input().lower() == 'y':
+                remote_url = call(
+                    'git', 'config', '--get', 'remote.origin.url',
+                    capture_output=True).stdout.strip()
+                package_name = remote_url.rsplit('/')[-1].removesuffix('.git')
+                success = set_branch_protection(
+                    package_name, self.path / '.meta.toml')
+                if success:
+                    print('Successfully updated branch protection rules.')
+                else:
+                    abort(-1)
+            print()
             print('If everything went fine up to here:')
             if updating:
                 print('Updated the previously created PR.')

diff --git a/config/default/tests.yml.j2 b/config/default/tests.yml.j2
@@ -26,12 +26,12 @@ jobs:
       fail-fast: false
       matrix:
         os:
-        - ["ubuntu", "ubuntu-20.04"]
+        - ["ubuntu", "ubuntu-latest"]
 {% if with_windows %}
         - ["windows", "windows-latest"]
 {% endif %}
 {% if with_macos %}
-        - ["macos", "macos-11"]
+        - ["macos", "macos-latest"]
 {% endif %}
         config:
         # [Python version, tox env]
@@ -70,18 +70,18 @@ jobs:
           - { os: ["windows", "windows-latest"], config: ["3.9",   "coverage"] }
 {% endif %}
 {% if with_macos %}
-          - { os: ["macos", "macos-11"], config: ["3.9",   "release-check"] }
-          - { os: ["macos", "macos-11"], config: ["3.9",   "lint"] }
+          - { os: ["macos", "macos-latest"], config: ["3.9",   "release-check"] }
+          - { os: ["macos", "macos-latest"], config: ["3.9",   "lint"] }
   {% if with_docs %}
-          - { os: ["macos", "macos-11"], config: ["3.9",   "docs"] }
+          - { os: ["macos", "macos-latest"], config: ["3.9",   "docs"] }
   {% endif %}
-          - { os: ["macos", "macos-11"], config: ["3.9",   "coverage"] }
+          - { os: ["macos", "macos-latest"], config: ["3.9",   "coverage"] }
           # macOS/Python 3.11+ is set up for universal2 architecture
           # which causes build and package selection issues.
-          - { os: ["macos", "macos-11"], config: ["3.11",  "py311"] }
-          - { os: ["macos", "macos-11"], config: ["3.12",  "py312"] }
+          - { os: ["macos", "macos-latest"], config: ["3.11",  "py311"] }
+          - { os: ["macos", "macos-latest"], config: ["3.12",  "py312"] }
   {% if with_future_python %}
-          - { os: ["macos", "macos-11"], config: ["%(future_python_version)s",  "py313"] }
+          - { os: ["macos", "macos-latest"], config: ["%(future_python_version)s",  "py313"] }
   {% endif %}
 {% endif %}
 {% for line in gha_additional_exclude %}

diff --git a/config/re-enable-actions.py b/config/re-enable-actions.py
@@ -12,16 +12,14 @@
 #
 ##############################################################################
 from shared.call import call
-from shared.packages import list_packages
+from shared.packages import ALL_REPOS
+from shared.packages import ORG
 import argparse
-import itertools
 import pathlib
 
 
-org = 'zopefoundation'
-base_url = f'https://github.com/{org}'
-base_path = pathlib.Path(__file__).parent
-types = ['buildout-recipe', 'c-code', 'pure-python', 'zope-product', 'toolkit']
+base_url = f'https://github.com/{ORG}'
+BASE_PATH = pathlib.Path(__file__).parent
 
 
 parser = argparse.ArgumentParser(
@@ -33,9 +31,6 @@
     action='store_true')
 
 args = parser.parse_args()
-repos = itertools.chain(
-    *[list_packages(base_path / type / 'packages.txt')
-      for type in types])
 
 
 def run_workflow(base_url, org, repo):
@@ -50,18 +45,18 @@ def run_workflow(base_url, org, repo):
     return True
 
 
-for repo in repos:
+for repo in ALL_REPOS:
     print(repo)
     wfs = call(
-        'gh', 'workflow', 'list', '--all', '-R', f'{org}/{repo}',
+        'gh', 'workflow', 'list', '--all', '-R', f'{ORG}/{repo}',
         capture_output=True).stdout
     test_line = [x for x in wfs.splitlines() if x.startswith('test')][0]
     if 'disabled_inactivity' not in test_line:
         print('    ☑️  already enabled')
         if args.force_run:
-            run_workflow(base_url, org, repo)
+            run_workflow(base_url, ORG, repo)
         continue
     test_id = test_line.split()[-1]
-    call('gh', 'workflow', 'enable', test_id, '-R', f'{org}/{repo}')
-    if run_workflow(base_url, org, repo):
+    call('gh', 'workflow', 'enable', test_id, '-R', f'{ORG}/{repo}')
+    if run_workflow(base_url, ORG, repo):
         print('    ✅ enabled')
diff --git a/config/requirements.txt b/config/requirements.txt
@@ -3,4 +3,5 @@ Jinja2==3.1.3
 pyupgrade==3.3.2
 tomlkit==0.12.1
 tox==4.8.0
+requests==2.31.0
 zest.releaser==8.0.0