.github/workflows/check-generated-files.yml

@@ -27,7 +27,7 @@ jobs:
         uses: actions/checkout@v4
 
       - name: install python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v5
         id: install_python
         with:
           python-version: "3.11"
@@ -39,7 +39,7 @@ jobs:
         run: sudo apt-get install -y -q build-essential graphviz libgeos-dev libkrb5-dev krb5-config freetds-dev
 
       - name: install poetry
-        run: pip install 'poetry==1.6.1'
+        run: pip install 'poetry==1.7.1'
 
       - name: check consistency with pyproject.toml
         run: poetry check --lock

.github/workflows/ci-data.yml

@@ -7,6 +7,7 @@ on:
 
 jobs:
   gcs_insert:
+    if: github.repository_owner == 'ibis-project'
     runs-on: ubuntu-latest
     steps:
       - name: set date
@@ -39,11 +40,11 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
-      - uses: google-github-actions/auth@v1
+      - uses: google-github-actions/auth@v2
         with:
           credentials_json: ${{ secrets.GCP_CREDENTIALS }}
 
-      - uses: google-github-actions/setup-gcloud@v1
+      - uses: google-github-actions/setup-gcloud@v2
 
       - run: gcloud info
 

.github/workflows/codeql-analysis.yml

@@ -10,6 +10,7 @@ concurrency:
 
 jobs:
   analyze:
+    if: github.repository_owner == 'ibis-project'
     runs-on: ubuntu-latest
     permissions:
       actions: read
@@ -24,8 +25,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@v4
-      - uses: github/codeql-action/init@v2
+      - uses: github/codeql-action/init@v3
         with:
           languages: ${{ matrix.language }}
-      - uses: github/codeql-action/autobuild@v2
-      - uses: github/codeql-action/analyze@v2
+      - uses: github/codeql-action/autobuild@v3
+      - uses: github/codeql-action/analyze@v3

.github/workflows/conda-lock.yml

@@ -8,6 +8,7 @@ on:
 
 jobs:
   condalock:
+    if: github.repository_owner == 'ibis-project'
     runs-on: ubuntu-latest
     strategy:
       matrix:
@@ -24,7 +25,7 @@ jobs:
           repository: ${{ github.event.client_payload.pull_request.head.repo.full_name }}
           ref: ${{ github.event.client_payload.pull_request.head.ref }}
 
-      - uses: conda-incubator/setup-miniconda@v2
+      - uses: conda-incubator/setup-miniconda@v3
         with:
           miniforge-variant: Mambaforge
           miniforge-version: latest
@@ -43,13 +44,13 @@ jobs:
         run: mamba create --name ibis${{ matrix.python-version }} --file conda-lock/linux-64/${{ matrix.python-version }}.lock
 
       - name: upload conda lock files
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
         with:
           name: conda-lock-files-${{ github.run_attempt }}
           path: ci/conda-lock/*/${{ matrix.python-version }}.lock
 
   condalock_pr:
-    if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
+    if: (github.repository_owner == 'ibis-project') && (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch')
     runs-on: ubuntu-latest
     needs:
       - condalock
@@ -71,7 +72,7 @@ jobs:
           token: ${{ steps.generate_pr_token.outputs.token }}
 
       - name: download conda lock files
-        uses: actions/download-artifact@v3
+        uses: actions/download-artifact@v4
         with:
           name: conda-lock-files-${{ github.run_attempt }}
           path: ci/conda-lock

.github/workflows/create-rotate-key-issue.yml

@@ -7,6 +7,7 @@ on:
 
 jobs:
   rotate_private_key:
+    if: github.repository_owner == 'ibis-project'
     runs-on: ubuntu-latest
     steps:
       - name: Generate a GitHub token

.github/workflows/docs-preview.yml

@@ -0,0 +1,68 @@
+name: Docs Preview
+
+on:
+  pull_request_target:
+    types:
+      - labeled
+
+jobs:
+  docs_preview:
+    runs-on: ubuntu-latest
+    if: github.event.label.name == 'docs-preview'
+    steps:
+      - uses: tibdex/github-app-token@v2
+        id: generate_token
+        with:
+          app_id: ${{ secrets.DOCS_BOT_APP_ID }}
+          private_key: ${{ secrets.DOCS_BOT_APP_PRIVATE_KEY }}
+
+      - name: reset label
+        uses: actions-ecosystem/action-remove-labels@v1
+        with:
+          labels: docs-preview
+          github_token: ${{ steps.generate_token.outputs.token }}
+
+      - name: install nix
+        uses: cachix/install-nix-action@v24
+        with:
+          extra_nix_config: |
+            access-tokens = github.com=${{ steps.generate_token.outputs.token }}
+
+      - name: setup cachix
+        uses: cachix/cachix-action@v13
+        with:
+          name: ibis
+          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
+          extraPullNames: nix-community,poetry2nix
+
+      - name: checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          ref: ${{ github.event.pull_request.head.sha }}
+
+      - name: build docs
+        run: nix develop --ignore-environment --keep HOME -c just docs-build-all
+
+      - name: install netlify cli
+        run: npm install -g netlify-cli
+
+      - name: generate url alias
+        id: get_alias
+        run: |
+          echo "id=pr-${{ github.event.pull_request.number }}-${{ github.event.pull_request.head.sha }}" >> "$GITHUB_OUTPUT"
+
+      - name: build and push quarto docs to preview url
+        run: netlify deploy --dir=docs/_output --alias="${{ steps.get_alias.outputs.id }}"
+        env:
+          NETLIFY_SITE_ID: ${{ secrets.NETLIFY_SITE_ID }}
+          NETLIFY_AUTH_TOKEN: ${{ secrets.NETLIFY_AUTH_TOKEN }}
+
+      - name: create preview link comment
+        if: success()
+        uses: peter-evans/create-or-update-comment@v3
+        with:
+          token: ${{ steps.generate_token.outputs.token }}
+          issue-number: ${{ github.event.pull_request.number }}
+          body: |
+            Docs preview: https://${{ steps.get_alias.outputs.id }}--ibis-quarto.netlify.app

.github/workflows/ibis-backends-cloud.yml

@@ -49,7 +49,7 @@ jobs:
         uses: actions/checkout@v4
 
       - name: install python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v5
         id: install_python
         with:
           python-version: ${{ matrix.python-version }}
@@ -60,7 +60,7 @@ jobs:
           custom_cache_key_element: ${{ matrix.backend.name }}-${{ steps.install_python.outputs.python-version }}
 
       - name: upgrade pip and install poetry
-        run: python -m pip install --upgrade pip 'poetry==1.6.1'
+        run: python -m pip install --upgrade pip 'poetry==1.7.1'
 
       - uses: syphar/restore-pip-download-cache@v1
         with:
@@ -77,8 +77,7 @@ jobs:
       - name: download backend data
         run: just download-data
 
-      - uses: google-github-actions/auth@v1
-        if: matrix.backend.name == 'bigquery'
+      - uses: google-github-actions/auth@v2
         with:
           credentials_json: ${{ secrets.GCP_CREDENTIALS }}