feat: initial implementation

Add an initial implementation copied from my components database.

.editorconfig

@@ -0,0 +1,15 @@
+root=true
+
+[*.md]
+indent_style=space
+indent_size=4
+max_line_length=89
+
+[*.py]
+max_line_length=99
+indent_style=space
+indent_size=4
+
+[*.{toml,json,yml,yaml}]
+indent_style=space
+indent_size=2

.flake8

@@ -0,0 +1,6 @@
+[flake8]
+max-line-length=99
+exclude = venv,.tox
+# Ignore E203, see explanation here:
+# https://black.readthedocs.io/en/stable/guides/using_black_with_other_tools.html#id1
+extend-ignore = E203

.github/actions/install-deps/action.yml

@@ -0,0 +1,33 @@
+name: install dependencies
+description: install poetry and package dependencies in a dedicated venv
+inputs:
+  python-version:
+    description: Version of Python to use to install poetry
+    required: false
+    default: "3.13"
+  cache-key-prefix:
+    description: Prefix used to form dependency cache key
+    required: false
+    default: "poetry"
+runs:
+  using: composite
+  steps:
+    - name: Set up Python
+      uses: actions/setup-python@v5
+      with:
+        python-version: "3.13"
+    - name: Install poetry
+      uses: abatilo/actions-poetry@v3
+    - name: Setup a local virtual environment
+      shell: bash
+      run: |
+        poetry config virtualenvs.create true --local
+        poetry config virtualenvs.in-project true --local
+    - uses: actions/cache@v4
+      name: Define a cache for the virtual environment based on the dependencies lock file
+      with:
+        path: ./.venv
+        key: ${{ inputs.cache-key-prefix }}|${{ env.pythonLocation }}|${{ hashFiles('poetry.lock') }}
+    - name: Install the project dependencies
+      shell: bash
+      run: poetry install

.github/actions/pre-commit/action.yml

@@ -0,0 +1,35 @@
+name: pre-commit
+description: run pre-commit
+inputs:
+  extra-args:
+    description: options to pass to pre-commit run
+    required: false
+    default: "--all-files"
+  python-version:
+    description: Version of Python to use to install pre-commit
+    required: false
+    default: "3.13"
+  cache-key-prefix:
+    description: Prefix used to form pre-commit cache key
+    required: false
+    default: "pre-commit"
+runs:
+  using: composite
+  steps:
+    - name: Set up Python
+      uses: actions/setup-python@v5
+      with:
+        python-version: "${{ inputs.python-version }}"
+    - name: Install pre-commit
+      run: pipx install pre-commit
+      shell: bash
+    - run: python -m pip install pre-commit
+      shell: bash
+    - run: python -m pip freeze --local
+      shell: bash
+    - uses: actions/cache@v4
+      with:
+        path: ~/.cache/pre-commit
+        key: ${{ inputs.cache-key-prefix}}|${{ env.pythonLocation }}|${{ hashFiles('.pre-commit-config.yaml') }}
+    - run: pre-commit run --show-diff-on-failure --color=always ${{ inputs.extra-args }}
+      shell: bash

.github/actions/release-bumper/action.yml

@@ -0,0 +1,15 @@
+name: prepare release
+description: modify working directory as if a release is going to be made
+runs:
+  using: composite
+  steps:
+    - uses: actions/setup-node@v4
+      with:
+        cache: npm
+        node-version: lts/*
+        cache-dependency-path: "./.github/workflows/*.yml"
+    - name: Prepare release
+      shell: bash
+      run: |
+        npx -p @release-it/bumper -p @release-it/conventional-changelog release-it \
+          --no-git.commit --no-git.push --no-git.tag --no-github

.github/workflows/main.yml

@@ -0,0 +1,84 @@
+name: Default branch
+
+on:
+  push:
+    branches: [main]
+
+jobs:
+  tests:
+    name: Run tests
+    uses: ./.github/workflows/tests.yml
+  release:
+    name: Publish release
+    needs: [tests]
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Configure git
+        run: |
+          git config user.name "${GITHUB_ACTOR}"
+          git config user.email "${GITHUB_ACTOR}@users.noreply.github.com"
+      - name: Download release artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: python-dist
+          path: dist/
+      - name: Create release
+        run: npx -p @release-it/bumper -p @release-it/conventional-changelog release-it
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+  pages:
+    name: GitHub pages
+    needs: [release]
+    permissions:
+      pages: write      # to deploy to Pages
+      id-token: write   # to verify the deployment originates from an appropriate source
+    environment:
+      name: github-pages
+      url: https://rjw57.github.io/verify-oidc-identity/
+    runs-on: ubuntu-latest
+    steps:
+      - name: Deploy to GitHub Pages
+        id: deployment
+        uses: actions/deploy-pages@v4
+  test-pypi:
+    name: Publish to Test PyPI
+    needs: [release]
+    runs-on: ubuntu-24.04
+    permissions:
+      id-token: write
+    environment:
+      name: test-pypi
+      url: https://test.pypi.org/p/verify-oidc-identity
+    steps:
+      - name: Download release artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: python-dist
+          path: dist/
+      - name: Upload
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          repository-url: https://test.pypi.org/legacy/
+  pypi:
+    name: Publish to PyPI
+    needs: [test-pypi]
+    runs-on: ubuntu-24.04
+    permissions:
+      id-token: write
+    environment:
+      name: pypi
+      url: https://pypi.org/p/verify-oidc-identity
+    steps:
+      - name: Download release artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: python-dist
+          path: dist/
+      - name: Upload
+        uses: pypa/gh-action-pypi-publish@release/v1

.github/workflows/tests.yml

@@ -0,0 +1,64 @@
+name: Tests
+
+on:
+  workflow_call:
+  push:
+    branches-ignore: [main]
+
+jobs:
+  pre-commit:
+    name: pre-commit
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ./.github/actions/pre-commit
+  commitlint:
+    name: commitlint
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: wagoid/commitlint-github-action@v6
+  pytest:
+    name: pytest
+    runs-on: ubuntu-24.04
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.10", "3.11", "3.12", "3.13"]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ./.github/actions/install-deps
+        with:
+          python-version: ${{ matrix.python-version }}
+      - name: Run tests
+        run: poetry run pytest -v
+  build:
+    name: build distribution artifacts
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0  # required for release-bumper action
+      - uses: ./.github/actions/release-bumper
+      - uses: ./.github/actions/install-deps
+      - name: Build the Python package
+        run: poetry build
+      - name: Upload Python build artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: python-dist
+          path: dist/*
+  mkdocs:
+    name: build documentation
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0  # required for release-bumper action
+      - uses: ./.github/actions/install-deps
+      - uses: ./.github/actions/release-bumper
+      - name: Build the documentation
+        run: poetry run mkdocs build
+      - name: Upload GitHub pages artefact
+        uses: actions/upload-pages-artifact@v3
+        with:
+          path: site/