drevalpy v2

.github/pull_request_template.md

@@ -7,7 +7,7 @@
 - [ ] This comment contains a description of changes (with reason)
 - [ ] Referenced issue is linked
 - [ ] If you've fixed a bug or added code that should be tested, add tests!
-- [ ] Documentation in `docs` is updated. If you've created a new file, add it to the API documentation pages.
+- [ ] Documentation in `docs` is updated. Public modules under documented packages are picked up automatically by the recursive API autosummary.
 
 <!-- Only applies to PRs for a new version release, delete the lines that don't apply -->
 

.github/workflows/build_package.yml

@@ -1,6 +1,16 @@
 name: Build DrEvalPy Package
 
-on: [push, pull_request]
+on:
+  # Same-repo PR branches were building twice (push + pull_request = 18 jobs).
+  # Keep the pull_request build and limit push builds to the branches that are
+  # not covered by a PR: the default branches and release branches, which
+  # feed python-publish.yml.
+  push:
+    branches:
+      - main
+      - master
+      - "release/*"
+  pull_request:
 
 jobs:
   build:
@@ -12,25 +22,15 @@ jobs:
         python: ["3.11", "3.12", "3.13"]
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         name: Check out source-code repository
 
-      - name: Setup Python
-        uses: actions/setup-python@v6
+      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
         with:
           python-version: ${{ matrix.python }}
 
-      - name: Install Poetry
-        run: |
-          pipx install poetry
-          pipx inject poetry poetry-plugin-export
-          poetry --version
-
       - name: Build package
-        run: poetry build --ansi
-
-      - name: Install required twine packaging dependencies
-        run: pip install setuptools wheel twine
+        run: uv build
 
-      - name: Check twine package
-        run: twine check dist/*
+      - name: Check package with twine
+        run: uvx twine check dist/*

.github/workflows/labeler.yml

@@ -10,9 +10,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out the repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Run Labeler
-        uses: crazy-max/ghaction-github-labeler@v6.0.0
+        uses: crazy-max/ghaction-github-labeler@548a7c3603594ec17c819e1239f281a3b801ab4d # v6.0.0
         with:
           skip-delete: true

.github/workflows/publish-docker.yml

@@ -1,61 +1,49 @@
 name: Create and publish a Docker image
 
-# Configures this workflow to run every time a release is published
 on:
   release:
     types: [published]
 
-# Defines two custom environment variables for the workflow.
-# These are used for the Container registry domain, and a name for the Docker image that this workflow builds.
 env:
   REGISTRY: ghcr.io
   IMAGE_NAME: ${{ github.repository }}
 
-# There is a single job in this workflow. It's configured to run on the latest available version of Ubuntu.
 jobs:
   build-and-push-image:
     runs-on: ubuntu-latest
 
-    # Sets the permissions granted to the `GITHUB_TOKEN` for the actions in this job.
     permissions:
       contents: read
       packages: write
       attestations: write
       id-token: write
 
     steps:
-      # Necessary for buildx
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Setup QEMU
-        uses: docker/setup-qemu-action@v4
+        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4
 
-      # Set up BuildKit Docker container builder to be able to build
-      # multi-platform images and export cache
-      # https://github.com/docker/setup-buildx-action
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
 
       - name: Log in to the Container registry
-        uses: docker/login-action@v4
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Extract metadata (tags, labels) for Docker
         id: meta
-        uses: docker/metadata-action@v6
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
 
-      # This step uses the `docker/build-push-action` action to build the image, based on your repository's `Dockerfile`. If the build succeeds, it pushes the image to GitHub Packages.
-      # It uses the `context` parameter to define the build's context as the set of files located in the specified path. For more information, see "[Usage](https://github.com/docker/build-push-action#usage)" in the README of the `docker/build-push-action` repository.
-      # It uses the `tags` and `labels` parameters to tag and label the image with the output from the "meta" step.
       - name: Build and push Docker image
         id: build-and-push
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
         with:
           context: .
           push: true

.github/workflows/publish_docs.yml

@@ -1,36 +1,32 @@
 name: Build Documentation
 
-on: [push]
+# PR-side docs builds are covered by the `docs` job in run_tests.yml.
+# This workflow exists to deploy, so it only runs on the branches that deploy.
+on:
+  push:
+    branches:
+      - main
+      - master
 
 jobs:
   build:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         name: Check out source-code repository
 
-      - name: Setup Python
-        uses: actions/setup-python@v6
-        with:
-          python-version: "3.13"
-
-      - name: Install pip
-        run: |
-          python -m pip install --upgrade pip
+      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
 
-      - name: Install doc dependencies
-        run: |
-          pip install -r docs/requirements.txt
+      - name: Install dependencies
+        run: uv sync --group docs
 
       - name: Build docs
-        run: |
-          cd docs
-          make html
+        run: uv run sphinx-build -W -b html docs docs/_build/html
 
       - name: Deploy
-        if: ${{ github.ref == 'refs/heads/master' || github.ref == 'refs/heads/main'}}
-        uses: peaceiris/actions-gh-pages@v4
+        if: ${{ github.ref == 'refs/heads/master' || github.ref == 'refs/heads/main' }}
+        uses: peaceiris/actions-gh-pages@84c30a85c19949d7eee79c4ff27748b70285e453 # v4.1.0
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           publish_dir: ./docs/_build/html

.github/workflows/python-publish.yml

@@ -1,11 +1,3 @@
-# This workflow will upload a Python Package using Twine when a release is created
-# For more information see: https://docs.github.com/en/actions/automating-builds-and-tests/building-and-testing-python#publishing-to-package-registries
-
-# This workflow uses actions that are not certified by GitHub.
-# They are provided by a third-party and are governed by
-# separate terms of service, privacy policy, and support
-# documentation.
-
 name: Upload Python Package
 
 on:
@@ -20,19 +12,15 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v6
-      - name: Set up Python
-        uses: actions/setup-python@v6
-        with:
-          python-version: "3.x"
-      - name: Install dependencies
-        run: |
-          python -m pip install --upgrade pip
-          pip install build
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+
+      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+
       - name: Build package
-        run: python -m build
+        run: uv build
+
       - name: Publish package
-        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
         with:
           user: __token__
           password: ${{ secrets.PYPI_API_TOKEN }}

.github/workflows/release_drafter.yml

@@ -1,12 +1,14 @@
 name: Release Drafter
+
 on:
   push:
     branches:
       - development
+
 jobs:
   update_release_draft:
     runs-on: ubuntu-latest
     steps:
-      - uses: release-drafter/release-drafter@v7
+      - uses: release-drafter/release-drafter@34d80673e067bdc0c24568d3af899c216adcfaa9 # v7.7.0
         env:
           GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"

.github/workflows/run_network_tests.yml

@@ -0,0 +1,59 @@
+name: Network Tests
+
+# The `network`-marked tests download pretrained weights and remote annotations
+# from the drevalpy artifacts bucket, so they are deselected everywhere else:
+# the pre-commit hook runs the fast tier and run_tests.yml runs
+# `-m "not network"`. Without this workflow they would never run at all.
+on:
+  schedule:
+    # Mondays 05:00 UTC. Weekly is enough: these tests guard artifact
+    # availability and loader wiring, neither of which changes per commit.
+    - cron: "0 5 * * 1"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: network-tests
+  cancel-in-progress: false
+
+jobs:
+  network-tests:
+    name: Network tests
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+
+      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+
+      # The bucket refuses anonymous reads (403), so without credentials every
+      # one of these tests fails for a reason that has nothing to do with the
+      # code. Detect that up front and skip instead, so a fork or a repo with no
+      # secrets configured does not carry a permanently red weekly badge.
+      - name: Check for artifact credentials
+        id: creds
+        env:
+          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+        run: |
+          if [ -n "$AWS_ACCESS_KEY_ID" ]; then
+            echo "available=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "available=false" >> "$GITHUB_OUTPUT"
+            echo "::notice title=Network tests skipped::AWS_ACCESS_KEY_ID is not configured, so the artifacts bucket is unreachable. Add the AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY secrets to enable the network tests."
+          fi
+
+      - name: Run network tests
+        if: steps.creds.outputs.available == 'true'
+        env:
+          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          AWS_DEFAULT_REGION: ${{ vars.AWS_DEFAULT_REGION }}
+          # Optional mirror. Empty is fine: get_artifacts_uri() strips blanks and
+          # falls back to the bundled default bucket.
+          DREVALPY_ARTIFACTS_URI: ${{ vars.DREVALPY_ARTIFACTS_URI }}
+        # The explicit `-m network` replaces the `addopts` marker expression
+        # rather than adding to it, so this selects exactly the 8 network tests.
+        # No coverage: run_tests.yml owns the coverage gate.
+        run: uv run pytest -m network