Poetry 2 upgrade (PEP612-conformity) and gh-actions renovation

.github/dependabot.yml

@@ -0,0 +1,9 @@
+# Please see the documentation for all configuration options:
+# https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
+
+version: 2
+updates:
+- package-ecosystem: github-actions
+  directory: "/"
+  schedule:
+    interval: monthly

.github/workflows/check-dependencies.yaml

@@ -13,7 +13,7 @@ jobs:
       fail-fast: false
       matrix:
         os: [ubuntu-latest, windows-latest]
-        python-version: ["3.8", "3.9", "3.10"]
+        python-version: ["3.8", "3.9", "3.10", "3.11", "3.12"]
         exclude:
         - os: windows-latest
           python-version: "3.8"
@@ -26,17 +26,23 @@ jobs:
       #          install poetry
       #----------------------------------------------
       - name: Install Poetry
-        # Pin to 1.3.2 to workaround https://github.com/python-poetry/poetry/issues/7611
-        run: pipx install poetry==1.3.2
+        run: pipx install poetry
+
+      # We install poetry-dynamic-versioning into pipx because the automatic installallation
+      # by poetry 2.x triggers a Windows issue https://github.com/pypa/installer/issues/260
+      - name: Install poetry-dynamic-versioning
+        if: runner.os == 'Windows'
+        run:
+          pipx inject poetry poetry-dynamic-versioning
 
       #----------------------------------------------
       #       check-out repo and set-up python
       #----------------------------------------------
       - name: Check out repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
 
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b
         with:
           python-version: ${{ matrix.python-version }}
           cache: 'poetry'
@@ -62,4 +68,5 @@ jobs:
         run: Remove-Item poetry.lock -Force
 
       - name: Run tests
-        run: poetry run python -m unittest discover
+        shell: bash
+        run: poetry run python -m pytest --with-slow

.github/workflows/main.yaml

@@ -1,40 +1,50 @@
-# Built from:
-# https://docs.github.com/en/actions/guides/building-and-testing-python
-# https://github.com/actions/setup-python/
-
+# Action passes pedantic check with zizmor 1.3.0, https://woodruffw.github.io/zizmor/
 name: Build and test linkml-runtime
 
 on: [pull_request]
 
+permissions: {}
+
 jobs:
   test:
     strategy:
       fail-fast: false
       matrix:
         os: [ubuntu-latest, windows-latest]
-        python-version: ["3.8", "3.9", "3.10", "3.12"]
+        python-version: ["3.8", "3.9", "3.10", "3.11", "3.12"]
         exclude:
         - os: windows-latest
           python-version: "3.8"
-
     runs-on: ${{ matrix.os }}
-
+    permissions:
+      contents: read
     steps:
 
       #----------------------------------------------
       #          install poetry
       #----------------------------------------------
       - name: Install Poetry
-        run: pipx install poetry==1.4.0
-
+        run: |
+          pipx install poetry
+
+      # We install poetry-dynamic-versioning into pipx because the automatic installallation
+      # by poetry 2.x triggers a Windows issue https://github.com/pypa/installer/issues/260
+      - name: Install poetry-dynamic-versioning
+        if: runner.os == 'Windows'
+        run:
+          pipx inject poetry poetry-dynamic-versioning
+
       #----------------------------------------------
       #       check-out repo and set-up python
       #----------------------------------------------
       - name: Check out repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        with:
+          fetch-depth: 0
+          persist-credentials: false
 
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b
         with:
           python-version: ${{ matrix.python-version }}
           cache: 'poetry'
@@ -43,12 +53,14 @@ jobs:
       #    install your root project, if required 
       #----------------------------------------------      
       - name: Install library
-        run: poetry install --no-interaction
+        run: |
+          poetry install --no-interaction
 
       #----------------------------------------------
       #              coverage report   
       #----------------------------------------------
       - name: Generate coverage results
+        shell: bash
         run: |
           poetry run coverage run -m pytest
           poetry run coverage xml
@@ -58,7 +70,7 @@ jobs:
       #           upload coverage results
       #----------------------------------------------
       - name: Upload coverage report
-        uses: codecov/codecov-action@v3
+        uses: codecov/codecov-action@13ce06bfc6bbe3ecf90edbbf1bc32fe5978ca1d3
         with:
           name: codecov-results-${{ matrix.os }}-${{ matrix.python-version }}
           token: ${{ secrets.CODECOV_TOKEN }}

.github/workflows/pypi-publish.yaml

@@ -1,21 +1,21 @@
 name: Publish Python Package
+# Publishes to PyPI triggered by creating a releases in GitHub UI
 
 on:
   release:
-    types: [created]
+    types: [published]
 
 jobs:
-  build-n-publish:
-    name: Build and publish Python 🐍 distributions 📦 to PyPI
+  build:
+    name: Build Python 🐍 distributions 📦 for publishing to PyPI
     runs-on: ubuntu-latest
-
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
 
     - name: Set up Python
-      uses: actions/setup-python@v2.2.2
+      uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b
       with:
-        python-version: 3.8
+        python-version: 3.12
 
     - name: Install Poetry
       run: pipx install poetry
@@ -28,8 +28,40 @@ jobs:
         poetry version $(git describe --tags --abbrev=0)
         poetry build
 
-    - name: Publish distribution 📦 to PyPI
-      uses: pypa/gh-action-pypi-publish@v1.2.2
+    - name: Store built distribution
+      uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b
       with:
-        user: __token__
-        password: ${{ secrets.pypi_password }}
+        name: distribution-files
+        path: dist/
+
+  pypi-publish:
+    name: Build and publish Python 🐍 package 📦 to PyPI
+    needs: build
+    runs-on: ubuntu-latest
+    # Next 5 lines prepare for trusted publishing: https://docs.pypi.org/trusted-publishers/adding-a-publisher/
+    # environment:
+    #   name: pypi-release
+    #   url: https://pypi.org/p/linkml-runtime
+    # permissions:
+    #   id-token: write  # this permission is mandatory for trusted publishing
+    steps:
+      - name: Download built distribution
+        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16
+        with:
+          name: distribution-files
+          path: dist
+
+      - name: Publish package 📦 to PyPI
+        if: github.event_name == 'release'
+        uses: pypa/gh-action-pypi-publish@76f52bc884231f62b9a034ebfe128415bbaabdfc
+        with:
+          user: __token__
+          password: ${{ secrets.pypi_password }}
+          # verbose: true
+
+# Used actions: (updates managed by dependabot)
+# - https://github.com/actions/checkout
+# - https://github.com/actions/setup-python
+# - https://github.com/actions/upload-artifact
+# - https://github.com/actions/download-artifact
+# - https://github.com/pypa/gh-action-pypi-publish/

.github/workflows/test-upstream.yaml

@@ -25,15 +25,15 @@ jobs:
     steps:
 
       - name: checkout upstream
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
         with:
           repository: linkml/linkml
           path: linkml
           ref: main
           fetch-depth: 0
 
       - name: checkout linkml-runtime
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
         with:
           # don't specify repository like this or else we won't get pull request branches correctly
           # repository: linkml/linkml-runtime
@@ -48,19 +48,23 @@ jobs:
           git fetch upstream --tags
 
       - name: set up python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b
         with:
           python-version: ${{ matrix.python-version }}
 
       - name: Install poetry
         run: pipx install poetry
 
-      - name: Install dynamic versioning plugin
-        run: poetry self add "poetry-dynamic-versioning[plugin]"
+      # We install poetry-dynamic-versioning into pipx because the automatic installallation
+      # by poetry 2.x triggers a Windows issue https://github.com/pypa/installer/issues/260
+      - name: Install poetry-dynamic-versioning
+        if: runner.os == 'Windows'
+        run:
+          pipx inject poetry poetry-dynamic-versioning
 
       - name: Load cached venv
         id: cached-poetry-dependencies
-        uses: actions/cache@v3
+        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57
         with:
           path: linkml/.venv
           key: venv-${{ matrix.python-version }}-${{ runner.os }}-${{ hashFiles('**/poetry.lock') }}
@@ -89,6 +93,7 @@ jobs:
         run: poetry run python -c 'import linkml_runtime; from importlib.metadata import version; print(linkml_runtime.__file__); print(version("linkml_runtime"))'
 
       - name: run tests
+        shell: bash
         working-directory: linkml
         run: poetry run python -m pytest --with-slow