Enable better testing

.github/workflows/_reusable-package-release.yml

@@ -94,13 +94,13 @@ jobs:
           echo "The `python-versions-array` input is required when `build-and-publish-python-package` is set to `true`."
           exit 1
       - if: ${{ endsWith(github.repository, '/python-package-ci-cd') }}  # Run the local action when this is run in the python-package-ci-cd repository
-        uses: ./actions/find-unreleased-changelog-items
+        uses: ./actions/find_unreleased_changelog_items
         with:
           release-level: ${{ inputs.release-level }}
           previous-changelog-filename: ${{ inputs.previous-changelog-filename }}
           previous-release-notes-filename: ${{ inputs.previous-release-notes-filename }}
       - if: ${{ !endsWith(github.repository, '/python-package-ci-cd') }}  # Run the public action when this is run outside the python-package-ci-cd repository
-        uses: tektronix/python-package-ci-cd/actions/find-unreleased-changelog-items@main  # TODO: update branch to tag
+        uses: tektronix/python-package-ci-cd/actions/[email protected]
         with:
           release-level: ${{ inputs.release-level }}
           previous-changelog-filename: ${{ inputs.previous-changelog-filename }}
@@ -125,12 +125,12 @@ jobs:
           fetch-depth: 0
           token: ${{ secrets.checkout-token }}
       - if: ${{ endsWith(github.repository, '/python-package-ci-cd') }}  # Run the local action when this is run in the python-package-ci-cd repository
-        uses: ./actions/find-unreleased-changelog-items
+        uses: ./actions/find_unreleased_changelog_items
         with:
           previous-changelog-filename: ${{ inputs.previous-changelog-filename }}
           previous-release-notes-filename: ${{ inputs.previous-release-notes-filename }}
       - if: ${{ !endsWith(github.repository, '/python-package-ci-cd') }}  # Run the public action when this is run outside the python-package-ci-cd repository
-        uses: tektronix/python-package-ci-cd/actions/find-unreleased-changelog-items@main  # TODO: update branch to tag
+        uses: tektronix/python-package-ci-cd/actions/[email protected]
         with:
           previous-changelog-filename: ${{ inputs.previous-changelog-filename }}
           previous-release-notes-filename: ${{ inputs.previous-release-notes-filename }}
@@ -225,7 +225,7 @@ jobs:
           name: Packages
           path: dist
       - name: Publish package distributions to GitHub Releases
-        uses: python-semantic-release/upload-to-gh-release@main
+        uses: python-semantic-release/upload-to-gh-release@v9.8.7
         with:
           root_options: -v --strict
           github_token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/_reusable-package-testpypi.yml

@@ -28,12 +28,12 @@ jobs:
         with:
           fetch-depth: 0
       - if: ${{ endsWith(github.repository, '/python-package-ci-cd') }}  # Run the local action when this is run in the python-package-ci-cd repository
-        uses: ./actions/create-unique-testpypi-version
+        uses: ./actions/create_unique_testpypi_version
         id: create-version
         with:
           package-name: ${{ inputs.package-name }}
       - if: ${{ !endsWith(github.repository, '/python-package-ci-cd') }}  # Run the public action when this is run outside the python-package-ci-cd repository
-        uses: tektronix/python-package-ci-cd/actions/create-unique-testpypi-version@main  # TODO: update branch to tag
+        uses: tektronix/python-package-ci-cd/actions/[email protected]
         id: create-version
         with:
           package-name: ${{ inputs.package-name }}

.github/workflows/_reusable-update-python-and-pre-commit-dependencies.yml

@@ -78,15 +78,15 @@ jobs:
           git_user_signingkey: true
           git_commit_gpgsign: true
       - if: ${{ endsWith(github.repository, '/python-package-ci-cd') }}  # Run the local action when this is run in the python-package-ci-cd repository
-        uses: ./actions/update-development-dependencies
+        uses: ./actions/update_development_dependencies
         with:
           dependency-dict: ${{ inputs.dependency-dict }}
           update-pre-commit: ${{ inputs.update-pre-commit }}
           run-pre-commit: ${{ inputs.run-pre-commit }}
           pre-commit-hook-skip-list: ${{ inputs.pre-commit-hook-skip-list }}
           export-dependency-groups: ${{ inputs.export-dependency-groups }}
       - if: ${{ !endsWith(github.repository, '/python-package-ci-cd') }}  # Run the public action when this is run outside the python-package-ci-cd repository
-        uses: tektronix/python-package-ci-cd/actions/update-development-dependencies@main  # TODO: update branch to tag
+        uses: tektronix/python-package-ci-cd/actions/[email protected]
         with:
           dependency-dict: ${{ inputs.dependency-dict }}
           update-pre-commit: ${{ inputs.update-pre-commit }}

.github/workflows/dependency-review.yml

@@ -0,0 +1,17 @@
+---
+name: Pull Request Dependency Review
+on:
+  pull_request:
+    branches: [main]
+permissions:
+  contents: read
+  pull-requests: write
+jobs:
+  dependency-review:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/dependency-review-action@v4
+        with:
+          fail-on-severity: low
+          comment-summary-in-pr: on-failure

.github/workflows/package-release.yml

@@ -1,5 +1,5 @@
 ---
-name: Package Release
+name: Publish to GitHub
 on:
   workflow_dispatch:
     inputs:
@@ -16,7 +16,7 @@ concurrency:
   group: pypi
 jobs:
   package-release:
-    uses: tektronix/tm_devices/.github/workflows/package-release.yml@main
+    uses: ./.github/workflows/_reusable-package-release.yml
     with:
       package-name: python-package-ci-cd
       repo-name: tektronix/python-package-ci-cd

.github/workflows/publish-test-results.yml

@@ -0,0 +1,14 @@
+---
+name: Publish Test Results
+on:
+  workflow_run:
+    workflows: [Test code]
+    types: [completed]
+jobs:
+  publish-test-results:
+    uses: ./.github/workflows/check-api-for-breaking-changes.yml
+    with:
+      operating-systems-array: '["ubuntu"]'  # this needs to match the operating-systems-array in the test-code.yml file
+    permissions:
+      checks: write
+      pull-requests: write

.github/workflows/test-actions.yml

@@ -11,11 +11,11 @@ concurrency:
   cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
 # IMPORTANT: Any new jobs need to be added to the check-tests-passed job to ensure they correctly gate code changes
 jobs:
-  test-create-unique-testpypi-version:
+  test-create_unique_testpypi_version:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: ./actions/create-unique-testpypi-version
+      - uses: ./actions/create_unique_testpypi_version
         id: create-version
         with:
           package-name: example-package  # this is an example package that is never updated
@@ -27,7 +27,7 @@ jobs:
             echo "Actual: ${{ steps.create-version.outputs.new-version }}"
             exit 1
           fi
-  test-find-unreleased-changelog-items:
+  test-find_unreleased_changelog_items:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -46,7 +46,7 @@ jobs:
           - Something was done here in the past
           EOF
           cp temp_changelog.md CHANGELOG.md
-      - uses: ./actions/find-unreleased-changelog-items
+      - uses: ./actions/find_unreleased_changelog_items
         with:
           release-level: patch
           previous-changelog-filename: .testing_previous_changelog_for_template.md
@@ -115,24 +115,24 @@ jobs:
             diff <(echo "$MULTILINE_STRING") "$FILE_PATH"
             exit 1
           fi
-  test-update-development-dependencies:
+  test-update_development_dependencies:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: ./actions/update-development-dependencies
+      - uses: ./actions/update_development_dependencies
         with:
           update-pre-commit: true
           run-pre-commit: true
           dependency-dict: '{"dev": ["pyright"]}'
           pre-commit-hook-skip-list: remove-tabs,forbid-tabs,check-readthedocs,check-dependabot,check-github-actions,check-github-workflows,commitizen,blacken-docs,yamlfix,hadolint,mdformat,markdown-link-check,check-poetry,toml-sort-fix,pyright,poetry-audit,ruff,ruff-format,docformatter
-          export-dependency-groups: udd:actions/update-development-dependencies,cutv:actions/create-unique-testpypi-version,fci:actions/find-unreleased-changelog-items
+          export-dependency-groups: udd:actions/update_development_dependencies,cutv:actions/create_unique_testpypi_version,fci:actions/find_unreleased_changelog_items
   # Check that all jobs passed
   check-action-tests-passed:
     if: ${{ !cancelled() }}
     needs:
-      - test-create-unique-testpypi-version
-      - test-find-unreleased-changelog-items
-      - test-update-development-dependencies
+      - test-create_unique_testpypi_version
+      - test-find_unreleased_changelog_items
+      - test-update_development_dependencies
     runs-on: ubuntu-latest
     steps:
       - name: Decide whether the needed jobs succeeded or failed

.github/workflows/test-code.yml

@@ -0,0 +1,21 @@
+---
+name: Test code
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+# Cancel running jobs for the same workflow and branch.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+jobs:
+  test-code:
+    uses: ./.github/workflows/_reusable-test-code.yml
+    with:
+      repo-name: tektronix/python-package-ci-cd
+      operating-systems-array: '["ubuntu"]'  # this needs to match the operating-systems-array in the publish-test-results.yml file
+      python-versions-array: '["3.12"]'  # this needs to match the [tool.poetry.dependencies.python] version in the pyproject.toml file
+      upload-to-codecov: true
+    secrets:
+      codecov-token: ${{ secrets.CODECOV_TOKEN }}

.github/workflows/update-python-and-pre-commit-dependencies.yml

@@ -13,7 +13,7 @@ jobs:
       update-pre-commit: true
       run-pre-commit: true
       pre-commit-hook-skip-list: pyright,poetry-audit
-      export-dependency-groups: udd:actions/update-development-dependencies,cutv:actions/create-unique-testpypi-version,fci:actions/find-unreleased-changelog-items
+      export-dependency-groups: udd:actions/update_development_dependencies,cutv:actions/create_unique_testpypi_version,fci:actions/find_unreleased_changelog_items
     permissions:
       contents: write
     secrets:

.gitignore

@@ -15,6 +15,15 @@ ENV*/
 env.bak/
 venv.bak/
 
+# Unit test / coverage reports
+htmlcov/
+.tox/
+.coverage*
+.cache
+coverage.xml
+.pytest_cache/
+.results*/
+
 # ruff
 .ruff_cache/
 

.pre-commit-config.yaml

@@ -51,10 +51,9 @@ repos:
         additional_dependencies: [black==24.4.2]  # This may need to be updated/removed in the future once ruff supports formatting Python code blocks in markdown
         args: [--line-length=100]
   - repo: https://github.com/lyz-code/yamlfix
-    rev: 47039c9bf8039e81f092c9777a1bc8be32fb7870  # frozen: 1.16.0
+    rev: 8072181c0f2eab9f2dd8db2eb3b9556d7cd0bd74  # frozen: 1.17.0
     hooks:
       - id: yamlfix
-        additional_dependencies: [maison<2.0.0]
   - repo: https://github.com/AleksaC/hadolint-py
     rev: e70baeefd566058716df2f29eae8fe8ffc213a9f  # frozen: v2.12.1b3
     hooks:

CHANGELOG.md

@@ -1,19 +1,33 @@
 # Changelog
 
----
+The format is based on [Keep a Changelog](https://keepachangelog.com), and this
+project adheres to [Semantic Versioning](https://semver.org).
 
-## Unreleased
+Valid subsections within a version are:
 
-Things to be included in the next release go here.
-
-### Added
-
-- Something will be added
+- Added
+- Changed
+- Deprecated
+- Removed
+- Fixed
+- Security
 
 ---
 
-## v0.0.1
+## Unreleased
+
+Things to be included in the next release go here.
 
 ### Added
 
-- Something was done here in the past
+- Added a reusable workflow to check the Python API for breaking changes: [`check-api-for-breaking-changes.yml`](./workflows/check-api-for-breaking-changes.md)
+- Added a reusable workflow to perform CodeQL analysis: [`codeql-analysis.yml`](./workflows/codeql-analysis.md)
+- Added a reusable workflow to enforce Open-Source community standards: [`enforce-community-standards.yml`](./workflows/enforce-community-standards.md)
+- Added a reusable workflow to build a Python package: [`package-build.yml`](./workflows/package-build.md)
+- Added a reusable workflow to upload a Python package to TestPyPI: [`package-testpypi.yml`](./workflows/package-testpypi.md)
+- Added a reusable workflow to publish API comparison results as a Pull Request comment: [`publish-api-comparison.yml`](./workflows/publish-api-comparison.md)
+- Added a reusable workflow to publish test results as a Pull Request comment: [`publish-test-results.yml`](./workflows/publish-test-results.md)
+- Added a reusable workflow to create a Software Bill of Materials (SBOM) and scan it: [`sbom-scan.yml`](./workflows/sbom-scan.md)
+- Added a reusable workflow to run tests and linting against Python package code: [`test-code.yml`](./workflows/test-code.md)
+- Added a reusable workflow to run documentation builds and tests for a Python package: [`test-docs.yml`](./workflows/test-docs.md)
+- Added a reusable workflow to update Python and `pre-commit` dependencies: [`update-python-and-pre-commit-dependencies.yml`](./workflows/update-python-and-pre-commit-dependencies.md)

CONTRIBUTING.md

@@ -55,7 +55,7 @@ Ready to contribute? Here's how to set up `python-package-ci-cd` for local devel
 
     - Using the helper script (recommended):
         ```console
-        python contributor_setup.py
+        python scripts/contributor_setup.py
         ```
 
 4. Check to see if there are any [open issues](https://github.com/tektronix/python-package-ci-cd/issues) or [pull requests](https://github.com/tektronix/python-package-ci-cd/pulls) that are related to the change you wish to make.