Further adoption of uv in ci

plugin-template

@@ -185,6 +185,8 @@ DEPRECATED_FILES = {
         ".github/workflows/scripts/publish_client_gem.sh",
         ".github/workflows/scripts/publish_client_pypi.sh",
         ".github/workflows/scripts/publish_plugin_pypi.sh",
+        ".github/workflows/scripts/push_branch_and_tag_to_github.sh",
+        ".github/workflows/scripts/secrets.py",
         ".travis",
         ".travis.yml",
         "dev_requirements.txt",

scripts/update_ci.sh

@@ -18,19 +18,22 @@ then
     "template_config.yml"
 fi
 
-PLUGIN_NAME="$(python ../plugin_template/scripts/get_template_config_value.py plugin_name)"
-CI_UPDATE_DOCS="$(python ../plugin_template/scripts/get_template_config_value.py ci_update_docs)"
+if [[ $(git status --porcelain) ]]
+then
+  echo "Working directory not clean. Aborting."
+  exit 1
+fi
+
+PLUGIN_NAME="$(uv run --script ../plugin_template/scripts/get_template_config_value.py plugin_name)"
+CI_UPDATE_DOCS="$(uv run --script ../plugin_template/scripts/get_template_config_value.py ci_update_docs)"
 
 if [[ "${CI_UPDATE_DOCS}" == "True" ]]; then
   DOCS=("--docs")
 else
   DOCS=()
 fi
 
-pushd ../plugin_template
-  pip install -r requirements.txt
-  ./plugin-template --github "${DOCS[@]}" "${PLUGIN_NAME}"
-popd
+uv run --script ../plugin_template/plugin-template --github "${DOCS[@]}"
 
 if [[ $(git status --porcelain) ]]; then
   git add -A
@@ -41,7 +44,7 @@ fi
 
 # Check that pulpcore lowerbounds is set to a supported branch
 if [[ "${PLUGIN_NAME}" != "pulpcore" ]]; then
-  python ../plugin_template/scripts/update_core_lowerbound.py
+  uv run --script ../plugin_template/scripts/update_core_lowerbound.py
   if [[ $(git status --porcelain) ]]; then
     git add -A
     git commit -m "Bump pulpcore lowerbounds to supported branch"

templates/github/.github/workflows/create-branch.yml.j2

@@ -2,7 +2,6 @@
 {% from 'macros.j2' import
   checkout,
   setup_python,
-  set_secrets,
   install_python_deps
 with context %}
 ---
@@ -23,18 +22,17 @@ jobs:
 
     permissions:
       contents: "write"
+      pull-requests: "write"
 
     steps:
       {{ checkout(depth=0, path=plugin_name) | indent(6) }}
 
       {{ checkout(repository="pulp/plugin_template", path="plugin_template") | indent(6) }}
 
-      {{ setup_python() | indent(6) }}
+      {{ setup_python(pyversion="3.12") | indent(6) }}
 
       {{ install_python_deps(["bump-my-version", "packaging", "-r", "plugin_template/requirements.txt"]) | indent(6) }}
 
-      {{ set_secrets(path=plugin_name) | indent(6) }}
-
       - name: "Determine new branch name"
         working-directory: "{{ plugin_name }}"
         run: |
@@ -73,9 +71,6 @@ jobs:
         uses: "peter-evans/create-pull-request@v8"
         with:
           path: "{{ plugin_name }}"
-          {%- raw %}
-          token: "${{ secrets.RELEASE_TOKEN }}"
-          {%- endraw %}
           committer: "{{release_user}} <{{ release_email }}>"
           author: "{{release_user}} <{{ release_email }}>"
           branch: "minor-version-bump"

templates/github/.github/workflows/nightly.yml.j2

@@ -2,15 +2,11 @@
 {% from 'macros.j2' import
   checkout,
   configure_git,
-  display_logs,
-  install_python_deps,
   matrix_env,
-  run_script,
-  setup_env,
   setup_python,
 with context %}
 ---
-name: "{{ plugin_app_label | camel }} Nightly CI"
+name: "Nightly CI"
 on:
   schedule:
     # * is a special character in YAML so you have to quote this string
@@ -49,36 +45,37 @@ jobs:
 
       {{ setup_python(pyversion="3.13") | indent(6) }}
 
-      {{ install_python_deps(["gitpython", "packaging", "toml"]) | indent(6) }}
-
       {{ configure_git() | indent(6) }}
 
       - name: "Collect changes from all branches"
         run: |
-          python .ci/scripts/collect_changes.py
+          uv run --script .ci/scripts/collect_changes.py
 
       - name: "Create Pull Request"
         uses: "peter-evans/create-pull-request@v8"
         id: "create_pr_changelog"
+        permissions:
+          contents: "write"
+          pull-requests: "write"
         with:
-          {%- raw %}
-          token: "${{ secrets.RELEASE_TOKEN }}"
-          {%- endraw %}
           title: "Update Changelog"
           body: ""
           branch: "changelog/update"
           delete-branch: true
           path: "{{ plugin_name }}"
       - name: "Mark PR automerge"
         working-directory: "{{ plugin_name }}"
+        permissions:
+          contents: "write"
+          pull-requests: "write"
         run: |
           {%- raw %}
           gh pr merge --rebase --auto "${{ steps.create_pr_changelog.outputs.pull-request-number }}"
           {%- endraw %}
         if: "steps.create_pr_changelog.outputs.pull-request-number"
         env:
           {%- raw %}
-          GH_TOKEN: "${{ secrets.RELEASE_TOKEN }}"
+          GH_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
           {%- endraw %}
         continue-on-error: true
 ...

templates/github/.github/workflows/publish.yml.j2

@@ -1,17 +1,12 @@
 {% include 'header.j2' %}
 {% from 'macros.j2' import
-  set_env_vars,
   checkout,
   setup_python,
   setup_ruby,
-  display_logs,
   run_script,
-  set_secrets,
-  install_python_deps,
-  configure_git,
 with context %}
 ---
-name: "{{ plugin_app_label | camel }} Publish Release"
+name: "Publish Release"
 on:
   push:
     tags:
@@ -149,17 +144,13 @@ jobs:
 
       {{ setup_python(pyversion="3.11") | indent(6) }}
 
-      - name: "Install towncrier"
-        run: |
-          uv pip install towncrier
-
       - name: "Get release notes"
         id: "get_release_notes"
         shell: "bash"
         run: |
           # The last commit before the release commit contains the release CHANGES fragments
           git checkout "${TAG_NAME}~"
-          NOTES=$(towncrier build --draft --version $TAG_NAME | .ci/scripts/clean_gh_release_notes.py {{ plugin_name }} $TAG_NAME)
+          NOTES=$(uvx towncrier build --draft --version $TAG_NAME | uv run --script .ci/scripts/clean_gh_release_notes.py {{ plugin_name }} $TAG_NAME)
           echo "body<<EOF" >> $GITHUB_OUTPUT
           echo "$NOTES" >> $GITHUB_OUTPUT
           echo "EOF" >> $GITHUB_OUTPUT

templates/github/.github/workflows/release.yml.j2

@@ -1,17 +1,13 @@
 {% include 'header.j2' %}
 {% from 'macros.j2' import
-  set_env_vars,
   checkout,
   setup_python,
-  setup_ruby,
-  display_logs,
   run_script,
-  set_secrets,
   install_python_deps,
   configure_git,
 with context %}
 ---
-name: {{ plugin_app_label | camel }} Release Pipeline
+name: "Tag Release"
 on:
   workflow_dispatch:
 
@@ -29,16 +25,15 @@ jobs:
     strategy:
       fail-fast: false
 
-    steps:
-      {{ checkout(depth=0, path=plugin_name, use_release_token=true) | indent(6) }}
+    permissions:
+      contents: "write"
 
-      {{ setup_python() | indent(6) }}
+    steps:
+      {{ checkout(depth=0, path=plugin_name) | indent(6) }}
 
-      {{ install_python_deps(["bump-my-version", "towncrier"]) | indent(6) }}
+      {{ setup_python(pyversion="3.12") | indent(6) }}
 
       {{ configure_git() | indent(6) }}
 
-      {{ set_secrets() | indent(6) }}
-
       {{ run_script(name="Tag the release", file="release.sh") | indent(6) }}
 ...

templates/github/.github/workflows/sanity.yml.j2

@@ -28,23 +28,21 @@ jobs:
 
       {{ setup_python(pyversion="3.12") | indent(6) }}
 
-      {{ install_python_deps(["-r", "lint_requirements.txt"]) | indent(6) }}
-
       - name: "Verify bump version config"
         run: |
-          bump-my-version bump --dry-run release
-          bump-my-version show-bump
+          uvx bump-my-version bump --dry-run release
+          uvx bump-my-version show-bump
       {%- if check_manifest %}
 
       - name: "Check for any files unintentionally left out of MANIFEST.in"
         run: |
-          check-manifest
+          uvx check-manifest
       {%- endif %}
       {%- if lint_requirements %}
 
       - name: "Verify requirements files"
         run: |
-          python .ci/scripts/check_requirements.py
+          uv run --script .ci/scripts/check_requirements.py
       {%- endif %}
       {%- if check_stray_pulpcore_imports %}
 

templates/github/.github/workflows/scripts/release.sh

@@ -11,7 +11,7 @@ then
 fi
 
 # The tail is a necessary workaround to remove the warning from the output.
-NEW_VERSION="$(bump-my-version show new_version --increment release | tail -n -1)"
+NEW_VERSION="$(uvx bump-my-version show new_version --increment release | tail -n -1)"
 echo "Release ${NEW_VERSION}"
 
 if ! [[ "${NEW_VERSION}" == "${BRANCH}"* ]]
@@ -20,9 +20,9 @@ then
   exit 1
 fi
 
-towncrier build --yes --version "${NEW_VERSION}"
-bump-my-version bump release --commit --message "Release {new_version}" --tag --tag-name "{new_version}" --tag-message "Release {new_version}" --allow-dirty
-bump-my-version bump patch --commit
+uvx towncrier build --yes --version "${NEW_VERSION}"
+uvx bump-my-version bump release --commit --message "Release {new_version}" --tag --tag-name "{new_version}" --tag-message "Release {new_version}" --allow-dirty
+uvx bump-my-version bump patch --commit
 
 # Git push is not atomic by default!
 git push --atomic origin "${BRANCH}" "${NEW_VERSION}"

templates/github/.github/workflows/scripts/update_backport_labels.py.j2

@@ -10,11 +10,12 @@
 
 # This script is running with elevated privileges from the main branch against pull requests.
 
-import requests
-import yaml
 import random
 import os
 
+import requests
+import yaml
+
 
 def random_color():
     """Generates a random 24-bit number in hex"""

templates/github/.github/workflows/update-labels.yml.j2

@@ -1,12 +1,10 @@
 {% include 'header.j2' %}
 {% from 'macros.j2' import
   setup_python,
-  configure_git,
-  install_python_deps,
 with context %}
 
 ---
-name: "{{ plugin_app_label | camel }} Update Labels"
+name: "Update Labels"
 on:
   push:
     branches:
@@ -22,13 +20,14 @@ jobs:
     runs-on: "ubuntu-latest"
     steps:
       {{ setup_python(pyversion="3.12") | indent(6) }}
-      {{ configure_git() | indent(6) }}
       - uses: "actions/checkout@v6"
       - name: "Update labels"
+        permissions:
+          issues: "write"
         run: |
           uv run --script .github/workflows/scripts/update_backport_labels.py
         env:
           {%- raw %}
-          GITHUB_TOKEN: "${{ secrets.RELEASE_TOKEN }}"
+          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
           {%- endraw %}
 ...

templates/github/.github/workflows/update_ci.yml.j2

@@ -2,7 +2,6 @@
 {% from 'macros.j2' import
   checkout,
   setup_python,
-  install_python_deps,
   configure_git,
 with context %}
 
@@ -30,9 +29,7 @@ jobs:
     steps:
       {{ checkout(repository="pulp/plugin_template", path="plugin_template", depth=0) | indent(6) }} %# "depth=0" is needed to run "git describe".
 
-      {{ setup_python() | indent(6) }}
-
-      {{ install_python_deps(["gitpython", "packaging", "-r", "plugin_template/requirements.txt"]) | indent(6) }}
+      {{ setup_python(pyversion="3.12") | indent(6) }}
 
       {{ configure_git() | indent(6) }}
 
@@ -48,10 +45,10 @@ jobs:
       - name: "Create Pull Request for CI files"
         uses: "peter-evans/create-pull-request@v8"
         id: "create_pr_{{ branch_slug }}"
+        permissions:
+          contents: "write"
+          pull-requests: "write"
         with:
-          {%- raw %}
-          token: "${{ secrets.RELEASE_TOKEN }}"
-          {%- endraw %}
           path: "{{ plugin_name }}"
           committer: "{{ release_user }} <{{ release_email }}>"
           author: "{{ release_user }} <{{ release_email }}>"
@@ -61,12 +58,15 @@ jobs:
           delete-branch: true
       - name: "Mark PR automerge"
         working-directory: "{{ plugin_name }}"
+        permissions:
+          contents: "write"
+          pull-requests: "write"
         run: |
           gh pr merge --rebase --auto "{{ '${{ steps.create_pr_' + branch_slug + '.outputs.pull-request-number }}' }}"
         if: "steps.create_pr_{{ branch_slug }}.outputs.pull-request-number"
         env:
           {%- raw %}
-          GH_TOKEN: "${{ secrets.RELEASE_TOKEN }}"
+          GH_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
           {%- endraw %}
         continue-on-error: true
       {%- endfor %}