Template 0.1.18: Tools pin v0.3.0-alpha.1, pinned GitHub Actions, template CI, install rules

.github/workflows/check_app_manifest.yml

@@ -32,10 +32,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Set up Python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # v4
         with:
           python-version: '3.11'
 

.github/workflows/check_schema_drift.yml

@@ -22,8 +22,8 @@ jobs:
     name: Schema copy equals the Site schema
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # v4
         with:
           python-version: '3.11'
       - run: pip install pytest pyyaml==6.0.2 jsonschema==4.23.0

.github/workflows/release_constructor.yml

@@ -25,7 +25,7 @@ jobs:
     if: github.event_name == 'release'
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Determine release version
         id: version
@@ -37,7 +37,7 @@ jobs:
           echo "RELEASE_VERSION=$RAW" >> "$GITHUB_ENV"
 
       - name: Set up Python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # v4
         with:
           python-version: '3.11'
 
@@ -64,14 +64,14 @@ jobs:
 
 
       - name: Commit updated versioned files
-        uses: stefanzweifel/git-auto-commit-action@v5
+        uses: stefanzweifel/git-auto-commit-action@b863ae1933cb653a53c021fe36dbb774e1fb9403 # v5
         with:
           branch: main
           commit_message: GitHub Action - Update version to ${{ github.event.release.tag_name }}
 
       - name: Upload diagnostics
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: release-bump-version-logs
           path: artifacts/error_log_document.log
@@ -102,7 +102,7 @@ jobs:
       OUTPUT_DIR: dist/${{ matrix.os_name }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Determine release version
         id: version
@@ -124,7 +124,7 @@ jobs:
           echo "RELEASE_VERSION=$RAW" >> "$GITHUB_ENV"
 
       - name: Set up Python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # v4
         with:
           python-version: '3.11'
 
@@ -150,7 +150,7 @@ jobs:
             python .tools/python/bump_Welcome_notebook.py "${{ github.repository_owner }}" "${{ github.event.repository.name }}"
 
       - name: Set up Miniconda
-        uses: conda-incubator/setup-miniconda@v3
+        uses: conda-incubator/setup-miniconda@fc2d68f6413eb2d87b895e92f8584b5b94a10167 # v3
         with:
           auto-activate: true
           miniforge-version: latest
@@ -174,15 +174,15 @@ jobs:
 
       - name: Upload diagnostics
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: build-installers-${{ matrix.os_name }}-logs
           path: artifacts/error_log_document_${{ matrix.os_name }}.log
           if-no-files-found: ignore
           archive: false
 
       - name: Upload installers to release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2
         with:
           files: dist/${{ matrix.os_name }}/*
           fail_on_unmatched_files: true

.github/workflows/sync_template.yml

@@ -21,7 +21,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           ref: main
           fetch-depth: 0
@@ -157,7 +157,7 @@ jobs:
 
       - name: Create pull request
         if: steps.check-changes.outputs.has_changes == 'true'
-        uses: peter-evans/create-pull-request@v6
+        uses: peter-evans/create-pull-request@c5a7806660adbe173f04e3e038b0ccdcd758773c # v6
         with:
           token: ${{ secrets.LABCONSTRICTOR_SYNC_TOKEN }}
           branch: template-sync-${{ steps.local-version.outputs.version }}-to-${{ steps.upstream-version.outputs.version }}

.github/workflows/tests.yml

@@ -0,0 +1,54 @@
+name: Template tests
+
+# Tests and static checks of the template repository itself (the migrations in .template_sync, the scripts in .tools/python and the tests).
+# They run on every pull request and every push to main, without a path filter: a change to any file (a workflow, a doc, a resource copy) can
+# break a test that compares files. It does not run in the apps created from the template.
+on:
+  pull_request:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: template-tests-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  tests:
+    if: github.repository == 'CellMigrationLab/LabConstrictor'
+    name: Tests, ruff and mypy
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # v4
+        with:
+          python-version: '3.11'
+      - name: Install the test and check tools
+        run: pip install pytest==9.1.1 pyyaml==6.0.2 jsonschema==4.23.0 ruff==0.15.20 mypy==1.20.2 types-PyYAML==6.0.12.20260906
+      - name: Tests (all tests/test_*.py, including the template_sync migration tests)
+        run: python -m pytest tests -q
+      - name: ruff (configuration in ruff.toml)
+        run: ruff check .template_sync .tools/python tests
+      - name: mypy (configuration in mypy.ini)
+        run: python -m mypy .template_sync .tools/python tests
+
+  smoke-install:
+    if: github.repository == 'CellMigrationLab/LabConstrictor'
+    name: Smoke install of post_install (${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 20
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # v4
+        with:
+          python-version: '3.11'
+      - name: Run the live post_install script in a fake prefix; the registry entry must carry the hosts of the app's manifest
+        run: python tests/smoke/post_install_hosts.py

.github/workflows/update_on_notebook_change.yml

@@ -22,12 +22,12 @@ jobs:
       contents: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           fetch-depth: 0  # Fetch all history for all branches and tags
 
       - name: Set up Python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # v4
         with:
           python-version: '3.11'
 
@@ -36,7 +36,7 @@ jobs:
 
       - name: Get changed files
         id: changed-files
-        uses: tj-actions/changed-files@v44
+        uses: tj-actions/changed-files@2d756ea4c53f7f6b397767d8723b3a10a9f35bf2 # v44
         with:
           separator: ","
           files: |
@@ -109,7 +109,7 @@ jobs:
 
       - name: Set up Miniconda for requirements test
         if: steps.check-changes.outputs.has_changes == 'true'
-        uses: conda-incubator/setup-miniconda@v3
+        uses: conda-incubator/setup-miniconda@fc2d68f6413eb2d87b895e92f8584b5b94a10167 # v3
         with:
           auto-activate: true
           miniforge-version: latest
@@ -129,7 +129,7 @@ jobs:
 
       - name: Upload diagnostics
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: notebook-debug-bundle
           path: artifacts/error_log_document.log
@@ -138,7 +138,7 @@ jobs:
       - name: Commit updated files
         id: auto-commit
         if: steps.check-changes.outputs.has_changes == 'true' && steps.test-conda-env.outcome == 'success'
-        uses: stefanzweifel/git-auto-commit-action@v5
+        uses: stefanzweifel/git-auto-commit-action@b863ae1933cb653a53c021fe36dbb774e1fb9403 # v5
         with:
           commit_message: GitHub Action - Updated files because of notebook and/or requirements changes
           file_pattern: requirements*.txt environment.yaml notebooks/* setup.py

.github/workflows/update_on_src_change.yaml

@@ -21,7 +21,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           fetch-depth: 0  # Fetch all history for all branches and tags
 
@@ -33,7 +33,7 @@ jobs:
 
       - name: Commit updated files
         id: auto-commit
-        uses: stefanzweifel/git-auto-commit-action@v5
+        uses: stefanzweifel/git-auto-commit-action@b863ae1933cb653a53c021fe36dbb774e1fb9403 # v5
         with:
           commit_message: GitHub Action - Updated src change file
 

.template_sync/manifest.yaml

@@ -1,4 +1,4 @@
-template_version: 0.1.17
+template_version: 0.1.18
 migrations:
   - from: 0.0.0
     to: 0.0.1
@@ -57,3 +57,6 @@ migrations:
   - from: 0.1.16
     to: 0.1.17
     script: migrations/v0_1_16_to_v0_1_17.py
+  - from: 0.1.17
+    to: 0.1.18
+    script: migrations/v0_1_17_to_v0_1_18.py