Improve test and release process

[guilhermef]

It's the same build environment used in libthumbor and thumbor-aws.

This PR will add:

• Stalebot
• Dependabot
• CodeQL
• release workflow
• Linting on unittest workflow
• Unittest workflow dependency cache

[marcelometal]

Hi @guilhermef ,
Why re-migrate to poetry? PEP 517?

[guilhermef]

It's mostly to be able to reuse the cached dependencies, and it makes it easier to pin dependencies.
The unittest workflow was also updated to benefit from it.

[heynemann]

If noone opposes, I'm good with this. Just don't do it in thumbor's main repo. Other than that, it should be fine.

[marcelometal]

IMHO, we can go without poetry, there is no real gain and we are adding another third-party dependency to the project

[scorphus]

I also give poetry a strong 👎 We don't need it. And it's yet another dependency.

In fact, I think we should get rid of poetry entirely, thumbor-wise I mean. Yesterday I was debugging libthumbor and had to go over this loop:

• edit/save
• poetry build
• ...wait...
• pip install dist/libthumbor-x.y.z.tar.gz
• ...wait...
• experiment
• repeat

There's definitely no poetry in that, whatsoever. And, BTW, python-poetry/poetry#34 is a joke.

The other aspects of this PR are stellar.

[scorphus]

Also, thumbor/libthumbor#52 (comment)... meh.

[guilhermef]

@scorphus you don't need to install the library.
Normally, I use poetry run <bin>

[guilhermef]

Poetry does offer GIthub actions to cache the build environment, it helps to speed up the build process and it pins the version across builds.

[scorphus]

@scorphus you don't need to install the library. Normally, I use poetry run <bin>

There's also this. A whole collection of new commands and ideas. A few more slots dislodged in my brain. I don't think I want that. I already know how to work with Python and its ecosystem.

Poetry does offer GIthub actions to cache the build environment, it helps to speed up the build process and it pins the version across builds.

There are other less intrusive ways to achieve both these — arguably desirable — things.

[guilhermef]

@scorphus you don't need to install the library. Normally, I use poetry run <bin>

There's also this. A whole collection of new commands and ideas. A few more slots dislodged in my brain. I don't think I want that. I already know how to work with Python and its ecosystem.

Normally I would introduce a make run, to avoid this independent of the tool we choose.

Poetry does offer GIthub actions to cache the build environment, it helps to speed up the build process and it pins the version across builds.

There are other less intrusive ways to achieve both these — arguably desirable — things.

I agree, but I couldn't find an easier one that I didn't have to maintain.

[guilhermef]

@scorphus, my suggestion would be to keep poetry while we don't have a better solution for environment caching on builds, and I'll add more docs to avoid confusion on how to run the projects with poetry.

[scorphus]

@guilhermef, what could other options be in your view?

[...] Just don't do it in thumbor's main repo. Other than that, it should be fine.

@heynemann, why you think we shouldn't do this in thumbor's main repo?

[guilhermef]

@scorphus the other option would be copying exactly what's being done by poetry, but on our workflow.

[heynemann]

The only reason we can't do poetry in thumbor is that when I did it screwed the C integration for thumbor. So let's leave thumbor with setup.py as the way it handles C modules is quite particular.

[scorphus]

@marcelometal what are your thoughts? Apart from previous words...

Also, do we package remotecv? What's your experience with debian packages that use poetry?

[marcelometal]

Hi @scorphus , sorry for the late reply...

Would be nice packaging remoteCV for Debian =)

IMHO, we should avoid to include third-party libs, because it increase the complexity...
The latest upstream version is not the same in Debian and should not have all the features we will use, for example.

Debian: poetry: 1.0.7
Upstream: poetry: 1.1.13

[guilhermef]

Ok, then I'll remove poetry and the environment cache.

[guilhermef]

@scorphus @marcelometal I've removed Poetry dependency.

[scorphus]

LGTM 👍 Thanks, @guilhermef

Please consider a couple suggestions below.

[codeclimate]

Code Climate has analyzed commit 59b4b15 and detected 0 issues on this pull request.

View more on Code Climate.

[scorphus]