Install raven-hydro from official git sources (#341)

* install raven-hydro from upstream branch * move upstream install to commands * update version pins, add secruity hardening to workflows, update pre-commit, update HISTORY.rst * Create dependabot.yml * update versions to support Python3.12, drop Python3.8 support, upgrade xclim, xarray, and others * simplify builds, include windows * point to main branch * disable windows for now * fix failing tests * fix matrix * use newer build system conventions * adjust test expectations * update HISTORY.rst * fix the test expectations * Update dependabot.yml * move concurrency higher in workflow * remove token for Trusted Publishing * update raven-hydro version to v0.3.0 --------- Co-authored-by: David Huard <huard.david@ouranos.ca>
CSHS-CWRA · Mar 7, 2024 · a984886 · a984886
1 parent a8c71c9
commit a984886
Show file tree

Hide file tree

Showing 13 changed files with 208 additions and 109 deletions.
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
@@ -0,0 +1,18 @@
+# To get started with Dependabot version updates, you'll need to specify which
+# package ecosystems to update and where the package manifests are located.
+# Please see the documentation for all configuration options:
+# https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
+
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 10
+
+  - package-ecosystem: pip
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 10
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
@@ -9,51 +9,62 @@ on:
 env:
   RAVEN_TESTING_DATA_BRANCH: master
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/master' }}
+
+permissions:
+  contents: read
+
 jobs:
-  black:
+  lint:
     name: Code linting
     runs-on: ubuntu-latest
-    concurrency:
-      group: ${{ github.workflow }}-${{ github.ref }}
-      cancel-in-progress: ${{ github.ref != 'refs/heads/master' }}
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-python@v4
         with:
-          python-version: "3.9"
+          python-version: "3.x"
       - name: Install tox and setuptools
         run: |
           pip install tox
-          pip install --upgrade "setuptools<65.6"
       - name: Run linting suite
         run: tox -e black
 
   pip:
-    name: Python${{ matrix.python-version }} (${{ matrix.os }})
-    needs: black
+    name: Python${{ matrix.python-version }} (${{ matrix.os }}, upstream=${{ matrix.upstream-branch }})
+    needs: lint
     runs-on: ${{ matrix.os }}
     strategy:
       fail-fast: false
       matrix:
         include:
-          - tox-env: py38-linux
-            python-version: "3.8"
-            os: ubuntu-latest
-          - tox-env: py38-macos
-            python-version: "3.8"
-            os: macos-latest
           - tox-env: py39-linux
             python-version: "3.9"
             os: ubuntu-latest
-          - tox-env: py310-linux
+          - tox-env: py39-macos
+            python-version: "3.9"
+            os: macos-latest
+          - tox-env: py310-linux-upstream
             python-version: "3.10"
             os: ubuntu-latest
+            upstream-branch: "main"
+          - tox-env: py310-macos-upstream
+            python-version: "3.10"
+            os: macos-latest
+            upstream-branch: "main"
           - tox-env: py311-linux
             python-version: "3.11"
             os: ubuntu-latest
           - tox-env: py311-macos
             python-version: "3.11"
             os: macos-latest
+          - tox-env: py312-linux
+            python-version: "3.12"
+            os: ubuntu-latest
+          - tox-env: py312-macos
+            python-version: "3.12"
+            os: macos-latest
     steps:
     - uses: actions/checkout@v4
     - name: Set up Python ${{ matrix.python-version }}
@@ -83,7 +94,7 @@ jobs:
 
     - name: Install tox
       run: |
-        pip install tox~=4.0
+        python3 -m pip install tox~=4.5.0
     - name: Test with tox and report coverage
       run: |
         python3 -m tox -e ${{ matrix.tox-env }}
@@ -92,23 +103,17 @@ jobs:
         COVERALLS_FLAG_NAME: run-${{ matrix.tox-env }}
         COVERALLS_PARALLEL: true
         COVERALLS_SERVICE_NAME: github
+        UPSTREAM_BRANCH: ${{ matrix.upstream-branch }}
 
   conda:
     name: Python${{ matrix.python-version }} (${{ matrix.os }}) (Conda)
-    needs: black
+    needs: lint
     runs-on: ${{ matrix.os }}
     strategy:
       fail-fast: false
       matrix:
-        include:
-          - os: ubuntu-latest
-            python-version: "3.9"
-          - os: ubuntu-latest
-            python-version: "3.10"
-          - os: ubuntu-latest
-            python-version: "3.11"
-          - os: macos-latest
-            python-version: "3.9"
+        os: [ubuntu-latest, macos-latest]  # windows-latest  # disabled until xesmf is available
+        python-version: ["3.9", "3.10", "3.11", "3.12"]
     defaults:
       run:
         shell: bash -l {0}
@@ -134,15 +139,17 @@ jobs:
           echo "micromamba: $(micromamba --version)"
       - name: Install RavenPy
         run: |
-          pip install -e ".[dev]"
+          python -m pip install -e ".[dev]"
       - name: List installed packages
         run: |
           conda list
+          python -m pip check || true
       - name: Test RavenPy
         run: |
-          pytest --cov --numprocesses=logical
+          python -m pytest --cov --numprocesses=logical
       - name: Report coverage
-        run: coveralls --service=github
+        run: |
+          python -m coveralls
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           COVERALLS_FLAG_NAME: run-conda_${{ matrix.python-version }}_${{ matrix.os }}
@@ -158,8 +165,8 @@ jobs:
     steps:
     - name: Coveralls Finished
       run: |
-        pip install --upgrade coveralls
-        coveralls --finish
+        python -m pip install --upgrade coveralls
+        python -m coveralls --finish
       env:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         COVERALLS_SERVICE_NAME: github
diff --git a/.github/workflows/publish-pypi.yml b/.github/workflows/publish-pypi.yml
@@ -5,25 +5,36 @@ on:
     types:
       - published
 
+permissions:
+  contents: read
+
 jobs:
   build-n-publish-pypi:
     name: Build and publish Python 🐍 distributions 📦 to PyPI
     runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        python-version: ["3.8"]
+    environment: production
+    permissions:
+      # IMPORTANT: this permission is mandatory for trusted publishing
+      id-token: write
     steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
+        with:
+          disable-sudo: true
+          egress-policy: block
+          allowed-endpoints: >
+            files.pythonhosted.org:443
+            github.com:443
+            pypi.org:443
+            upload.pypi.org:443
       - uses: actions/checkout@v3
       - name: Set up Python
         uses: actions/setup-python@v4
         with:
-          python-version: ${{ matrix.python-version }}
+          python-version: "3.x"
       - name: Install packaging libraries
         run: pip install flit
       - name: Build a binary wheel and a source tarball
         run: flit build
       - name: Publish distribution 📦 to PyPI
         uses: pypa/gh-action-pypi-publish@release/v1
-        with:
-          user: __token__
-          password: ${{ secrets.PYPI_API_TOKEN }}
diff --git a/.github/workflows/remove-obsolete-cache.yml b/.github/workflows/remove-obsolete-cache.yml
@@ -6,10 +6,23 @@ on:
     types:
       - closed
 
+permissions:
+  contents: read
+
 jobs:
   cleanup:
     runs-on: ubuntu-latest
     steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
+        with:
+          disable-sudo: true
+          egress-policy: block
+          allowed-endpoints: >
+            api.github.com:443
+            github.com:443
+            objects.githubusercontent.com:443
+
       - name: Check out code
         uses: actions/checkout@v3
 

diff --git a/.github/workflows/tag-testpypi.yml b/.github/workflows/tag-testpypi.yml
@@ -5,19 +5,33 @@ on:
     tags:
       - '*'
 
+permissions:
+  contents: read
+
 jobs:
   build-n-publish-testpypi:
     name: Build and publish Python 🐍 distributions 📦 to TestPyPI
     runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        python-version: ["3.8"]
+    environment: staging
+    permissions:
+      # IMPORTANT: this permission is mandatory for trusted publishing
+      id-token: write
     steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
+        with:
+          disable-sudo: true
+          egress-policy: block
+          allowed-endpoints: >
+            files.pythonhosted.org:443
+            github.com:443
+            pypi.org:443
+            test.pypi.org:443
       - uses: actions/checkout@v3
       - name: Set up Python
         uses: actions/setup-python@v4
         with:
-          python-version: ${{ matrix.python-version }}
+          python-version: "3.x"
       - name: Install packaging libraries
         run: pip install flit
       - name: Build a binary wheel and a source tarball
@@ -27,5 +41,5 @@ jobs:
         with:
           user: __token__
           password: ${{ secrets.TEST_PYPI_API_TOKEN }}
-          repository_url: https://test.pypi.org/legacy/
-          skip_existing: true
+          repository-url: https://test.pypi.org/legacy/
+          skip-existing: true
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
@@ -3,7 +3,7 @@ default_language_version:
 
 repos:
   - repo: https://github.com/asottile/pyupgrade
-    rev: v3.15.0
+    rev: v3.15.1
     hooks:
       - id: pyupgrade
         args: [ '--py38-plus' ]
@@ -32,7 +32,7 @@ repos:
     hooks:
       - id: toml-sort-fix
   - repo: https://github.com/psf/black-pre-commit-mirror
-    rev: 24.1.1
+    rev: 24.2.0
     hooks:
       - id: black
         exclude: ^docs/
@@ -46,21 +46,21 @@ repos:
     hooks:
       - id: isort
   - repo: https://github.com/nbQA-dev/nbQA
-    rev: 1.7.1
+    rev: 1.8.3
     hooks:
       - id: nbqa-pyupgrade
         args: [ '--py38-plus' ]
-        additional_dependencies: [ 'pyupgrade==3.15.0' ]
+        additional_dependencies: [ 'pyupgrade==3.15.1' ]
       - id: nbqa-black
-        additional_dependencies: [ 'black==24.1.1' ]
+        additional_dependencies: [ 'black==24.2.0' ]
       - id: nbqa-isort
         additional_dependencies: [ 'isort==5.13.2' ]
   - repo: https://github.com/kynan/nbstripout
     rev: 0.7.1
     hooks:
       - id: nbstripout
         files: ".ipynb"
-        args: [ '--extra-keys', 'metadata.kernelspec' ]
+        args: [ '--extra-keys=metadata.kernelspec' ]
   - repo: https://github.com/pycqa/pydocstyle
     rev: 6.3.0
     hooks:
@@ -70,9 +70,9 @@ repos:
     rev: v0.3.9
     hooks:
       - id: blackdoc
-        additional_dependencies: [ 'black==24.1.1' ]
+        additional_dependencies: [ 'black==24.2.0' ]
   - repo: https://github.com/adrienverge/yamllint.git
-    rev: v1.34.0
+    rev: v1.35.1
     hooks:
       - id: yamllint
         args: [ '--config-file=.yamllint.yaml' ]

diff --git a/HISTORY.rst b/HISTORY.rst
@@ -2,22 +2,36 @@
 History
 =======
 
-0.13 (2023-01-10)
------------------
-* Fixed problem with scalar elevation in netCDF files parsed with `nc_specs` (issue #279, PR #323)
-* Added notebook on sensitivity analysis (PR #320)
-* Updated Notebooks 03 and 04 (PR #319)
-* Upgrade to pydantic v2 (PR #326)
-* Pin cf-xarray for Python3.8 (PR #325)
-* Fix Coveralls Workflows (PR #328)
-* Fix notebook execution (PR #329)
-* Refactor and simplify testing data fetching (PR #332)
+0.14.0 (2024--soon)
+-------------------
+* Added support for Python 3.12 and dropped support for Python3.8.
+* Upgraded `raven-hydro` to v0.3.0 and `RavenHydroFramework` to v3.8.
+* `ravenpy` now requires `xclim` >= v0.48.2, `xarray` >= v2023.11.0, and `pandas` >= 2.2.0.
+
+Internal changes
+^^^^^^^^^^^^^^^^
+* Updated GitHub publishing workflows to use Trusted Publisher for TestPyPI/PyPI releases.
+* Added Dependabot to keep dependencies up-to-date.
+* Now using step-security/harden-runner action to harden GitHub Actions runners.
+* Adjusted GitHub Workflows to test against Python 3.9, 3.10, 3.11, and 3.12.
+* Updated the build-system requirements when testing with `tox` to use newer `setuptools` and `wheel` versions when building `gdal`.
+
+0.13.0 (2024-01-10)
+-------------------
+* Fixed problem with scalar elevation in netCDF files parsed with `nc_specs`. (issue #279, PR #323)
+* Added notebook on sensitivity analysis. (PR #320)
+* Updated Notebooks 03 and 04. (PR #319)
+* Upgrade to `pydantic` v2.0. (PR #326)
+* Pin `cf-xarray` for Python3.8. (PR #325)
+* Fix `Coveralls` Workflows. (PR #328)
+* Fix notebook execution. (PR #329)
+* Refactor and simplify testing data fetching. (PR #332)
 
 Breaking changes
 ^^^^^^^^^^^^^^^^
-* Update to Pydantic v2.
-* Added `h5netcdf` as a core dependency to provide a stabler backend for `xarray.open_dataset`.
-* Switched from `autodoc_pydantic` to `autodoc-pydantic` for `pydantic` v2.0+ support in documentation.
+* Update to `pydantic` v2.0. (PR #326)
+* Added `h5netcdf` as a core dependency to provide a stabler backend for `xarray.open_dataset`. (PR #332)
+* Switched from `autodoc_pydantic` to `autodoc-pydantic` for `pydantic` v2.0+ support in documentation. (PR #326)
 
 Internal changes
 ^^^^^^^^^^^^^^^^

diff --git a/environment-rtd.yml b/environment-rtd.yml
@@ -4,7 +4,7 @@ channels:
 - defaults
 dependencies:
   - python >=3.9,<3.10  # fixed to reduce solver time
-  - raven-hydro ==0.2.4
+  - raven-hydro ==0.2.4  # FIXME: Update when raven-hydro 0.3.0 is available on conda-forge
   - autodoc-pydantic
   - click
 #  - clisops  # mocked