feat: initial application release

.github/actions/setup-poetry/action.yml

@@ -0,0 +1,68 @@
+---
+name: Cached Python and Poetry setup
+description: Cache Poetry with additional extras key
+
+inputs:
+    python-version:
+        description: >
+            Version range or exact version of a Python version to use, using SemVer's version range syntax.
+        required: false
+        default: 3.x
+
+outputs:
+    python-version:
+        description: The installed python version. Useful when given a version range as input.
+        value: ${{ steps.setup-python.outputs.python-version }}
+    cache-hit:
+        description: A boolean value to indicate projects dependencies were cached
+        value: ${{ steps.setup-python.outputs.cache-hit }}
+    poetry-cache-hit:
+        description: A boolean value to indicate Poetry installation was cached
+        value: ${{ steps.pipx-cache.outputs.cache-hit }}
+
+runs:
+    using: composite
+    steps:
+        - name: Get pipx env vars
+          id: pipx-env-vars
+          shell: bash
+          run: |
+              echo "pipx-home=${PIPX_HOME}" >> $GITHUB_OUTPUT
+              echo "pipx-bin-dir=${PIPX_BIN_DIR}" >> $GITHUB_OUTPUT
+
+        - name: Load pipx cache
+          # If env vars are not defined do not load cache
+          if: >
+              steps.pipx-env-vars.outputs.pipx-home != ''
+              && steps.pipx-env-vars.outputs.pipx-bin-dir != ''
+          id: pipx-cache
+          uses: actions/cache@v3
+          with:
+              path: |
+                  ${{ steps.pipx-env-vars.outputs.pipx-home }}/venvs/poetry
+                  ${{ steps.pipx-env-vars.outputs.pipx-bin-dir }}/poetry
+              key: ${{ runner.os }}-${{ inputs.python-version }}-pipx-${{ hashFiles('**/poetry.lock') }}
+
+        - name: Install poetry
+          # If env vars are not defined or we missed pipx cache, install poetry
+          if: >
+              (
+              steps.pipx-env-vars.outputs.pipx-home == ''
+              && steps.pipx-env-vars.outputs.pipx-bin-dir == ''
+              )
+              || steps.pipx-cache.outputs.cache-hit != 'true'
+          shell: bash
+          run: pipx install poetry
+
+        - name: Load poetry cache
+          uses: actions/setup-python@v4
+          id: setup-python
+          with:
+              python-version: ${{ inputs.python-version }}
+              cache: poetry
+
+        - name: Install poetry dependencies
+          # If we missed poetry cache install dependencies
+          if: steps.setup-python.outputs.cache-hit != 'true'
+          shell: bash
+          run: poetry install --all-extras

.github/dependabot.yml

@@ -0,0 +1,23 @@
+---
+version: 2
+
+updates:
+    - package-ecosystem: github-actions
+      directory: /
+      schedule:
+          interval: monthly
+      commit-message:
+          prefix: "ci"
+          prefix-development: "ci"
+          include: "scope"
+    - package-ecosystem: pip
+      directory: /
+      schedule:
+          interval: monthly
+      commit-message:
+          prefix: "build"
+          prefix-development: "build"
+          include: "scope"
+      versioning-strategy: lockfile-only
+      allow:
+          - dependency-type: "all"

.github/labeler.yml

@@ -0,0 +1,21 @@
+---
+github_actions:
+    - ".github/**"
+dev_container:
+    - ".devcontainer/**"
+configuration:
+    - ".*"
+    - "*.js"
+    - "*.json"
+    - "*.toml"
+    - "*.yaml"
+    - "*.yml"
+documentation:
+    - "**.md"
+    - "docs/**"
+    - LICENSE
+python:
+    - "src/**"
+    - "tests/**"
+dependencies:
+    - "*.lock"

.github/workflows/commit-linter.yml

@@ -0,0 +1,36 @@
+---
+name: Commit Linter
+
+on:
+    pull_request:
+        types: [opened, reopened]
+    push:
+        branches:
+            - main
+
+permissions: # added using https://github.com/step-security/secure-workflows
+    contents: read
+
+jobs:
+    lint-commits:
+        if: "!contains(github.event.head_commit.message, 'bump(release)')"
+        permissions:
+            contents: read # for actions/checkout to fetch code
+            pull-requests: read # for wagoid/commitlint-github-action to get commits in PR
+        runs-on: ubuntu-latest
+        steps:
+            - name: Harden Runner
+              uses: step-security/harden-runner@18bf8ad2ca49c14cbb28b91346d626ccfb00c518 # v2.1.0
+              with:
+                  egress-policy: block
+                  allowed-endpoints: >
+                      api.github.com:443
+                      github.com:443
+
+            - name: Checkout repository
+              uses: actions/checkout@v3
+              with:
+                  fetch-depth: 0
+
+            - name: Lint commits
+              uses: wagoid/commitlint-github-action@v5

.github/workflows/create-release.yml

@@ -0,0 +1,91 @@
+---
+name: Create Release
+
+on:
+    push:
+        tags:
+            - "v*" # Push events to matching v*, i.e. v1.0, v20.15.10
+
+concurrency:
+    group: ${{ github.workflow }}-${{ github.ref }}
+    cancel-in-progress: true
+
+permissions:
+    contents: write
+
+jobs:
+    autorelease:
+        name: Create Release
+        runs-on: "ubuntu-latest"
+        strategy:
+            fail-fast: true
+            matrix:
+                python-version: ["3.11"]
+        steps:
+            - uses: step-security/harden-runner@18bf8ad2ca49c14cbb28b91346d626ccfb00c518 # v2.1.0
+              with:
+                  egress-policy: block
+                  disable-sudo: true
+                  allowed-endpoints: >
+                      api.github.com:443
+                      files.pythonhosted.org:443
+                      github.com:443
+                      install.python-poetry.org:443
+                      pypi.org:443
+                      python-poetry.org:443
+                      uploads.github.com:443
+
+            - name: Checkout repository
+              uses: actions/checkout@v3
+              with:
+                  fetch-depth: 0
+
+            - name: Setup Python and Poetry
+              uses: ./.github/actions/setup-poetry
+
+            - name: Add version to environment vars
+              run: |
+                  PROJECT_VERSION=$(poetry version --short)
+                  echo "PROJECT_VERSION=$PROJECT_VERSION" >> $GITHUB_ENV
+
+            # ----------------------------------------------
+            # Confirm we did, in fact, update the version
+            # ----------------------------------------------
+
+            - name: Check if tag version matches project version
+              run: |
+                  TAG=$(git describe HEAD --tags --abbrev=0)
+                  echo $TAG
+                  echo $PROJECT_VERSION
+                  if [[ "$TAG" != "v$PROJECT_VERSION" ]]; then exit 1; fi
+
+            # ----------------------------------------------
+            # Generate release notes
+            # ----------------------------------------------
+
+            - name: Release Notes
+              run: git log $(git describe HEAD~ --tags --abbrev=0)..HEAD --pretty='format:* %h %s' --no-merges >> ".github/RELEASE-TEMPLATE.md"
+
+            # ----------------------------------------------
+            # Test and then build the package
+            # ----------------------------------------------
+            - name: run poetry build
+              run: |
+                  poetry run poetry check
+                  poetry run coverage run
+                  poetry build
+
+            # ----------------------------------------------
+            # Build draft release (Note: Will need to manually publish)
+            # ----------------------------------------------
+
+            - name: Create Release Draft
+              uses: softprops/action-gh-release@v1
+              with:
+                  body_path: ".github/RELEASE-TEMPLATE.md"
+                  draft: true
+                  files: |
+                      dist/*-${{env.PROJECT_VERSION}}-py3-none-any.whl
+                      dist/*-${{env.PROJECT_VERSION}}.tar.gz
+              env:
+                  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/devcontainer-checker.yml

@@ -0,0 +1,60 @@
+---
+name: "Dev Container Checker"
+
+on:
+    workflow_dispatch:
+    pull_request:
+        types: [opened, reopened]
+        paths:
+            - ".devcontainer/**"
+            - ".github/workflows/devcontainer-checker.yml"
+    push:
+        paths:
+            - ".devcontainer/**"
+            - ".github/workflows/devcontainer-checker.yml"
+
+concurrency:
+    group: ${{ github.workflow }}-${{ github.ref }}
+    cancel-in-progress: true
+
+jobs:
+    dev-container-checker:
+        runs-on: ubuntu-latest
+
+        steps:
+            - uses: step-security/harden-runner@18bf8ad2ca49c14cbb28b91346d626ccfb00c518 # v2.1.0
+              with:
+                  egress-policy: block
+                  allowed-endpoints: >
+                      api.snapcraft.io:443
+                      auth.docker.io:443
+                      centralus.data.mcr.microsoft.com:443
+                      deb.debian.org:443
+                      deb.debian.org:80
+                      dl.yarnpkg.com:443
+                      eastus.data.mcr.microsoft.com:443
+                      files.pythonhosted.org:443
+                      ghcr.io:443
+                      git.rootprojects.org:443
+                      github.com:443
+                      mcr.microsoft.com:443
+                      nodejs.org:443
+                      objects.githubusercontent.com:443
+                      pkg-containers.githubusercontent.com:443
+                      production.cloudflare.docker.com:443
+                      pypi.org:443
+                      registry-1.docker.io:443
+                      registry.npmjs.org:443
+                      webi.sh:443
+                      westcentralus.data.mcr.microsoft.com:443
+                      westus.data.mcr.microsoft.com:443
+
+            - name: Checkout
+              uses: actions/checkout@v3
+
+            - name: Build and run dev container task
+              uses: devcontainers/ci@v0.2
+              with:
+                  runCmd: |
+                      poe lint
+                      poe test

.github/workflows/labeler.yml

@@ -0,0 +1,23 @@
+---
+name: Pull Request Labeler
+on:
+    - pull_request_target
+
+jobs:
+    label:
+        permissions:
+            contents: read
+            pull-requests: write
+        runs-on: ubuntu-latest
+        steps:
+            - name: Harden Runner
+              uses: step-security/harden-runner@18bf8ad2ca49c14cbb28b91346d626ccfb00c518 # v2.1.0
+              with:
+                  egress-policy: block
+                  allowed-endpoints: >
+                      api.github.com:443
+                      github.com:443
+
+            - uses: actions/labeler@v4
+              with:
+                  repo-token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/pr-linter.yml

@@ -0,0 +1,53 @@
+---
+name: Pull Request Linter
+
+on:
+    pull_request_target:
+        types:
+            - opened
+            - edited
+            - synchronize
+        branches:
+            - main
+
+permissions: # added using https://github.com/step-security/secure-workflows
+    contents: read
+
+jobs:
+    lint:
+        permissions:
+            pull-requests: read # for amannn/action-semantic-pull-request to analyze PRs
+            statuses: write # for amannn/action-semantic-pull-request to mark status of analyzed PR
+        runs-on: ubuntu-latest
+
+        steps:
+            - name: Harden Runner
+              uses: step-security/harden-runner@18bf8ad2ca49c14cbb28b91346d626ccfb00c518 # v2.1.0
+              with:
+                  egress-policy: block
+                  allowed-endpoints: >
+                      api.github.com:443
+
+            - name: Lint Pull Request
+              uses: amannn/action-semantic-pull-request@v5
+              with:
+                  validateSingleCommit: true
+                  wip: true
+                  types: |
+                      fix
+                      feat
+                      docs
+                      style
+                      refactor
+                      perf
+                      test
+                      build
+                      ci
+                  requireScope: false
+                  subjectPattern: ^(?![A-Z]).+$
+                  subjectPatternError: |
+                      The subject "{subject}" found in the pull request title "{title}"
+                      didn't match the configured pattern. Please ensure that the subject
+                      doesn't start with an uppercase character.
+              env:
+                  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/pypi-release.yml

@@ -0,0 +1,48 @@
+---
+name: Publish to PyPi
+on:
+    workflow_dispatch:
+    release:
+        types:
+            - published
+
+concurrency:
+    group: ${{ github.workflow }}-${{ github.ref }}
+    cancel-in-progress: true
+
+jobs:
+    publish-to-pypi:
+        runs-on: ubuntu-latest
+        strategy:
+            fail-fast: true
+            matrix:
+                python-version: ["3.11"]
+        steps:
+            - uses: step-security/harden-runner@18bf8ad2ca49c14cbb28b91346d626ccfb00c518 # v2.1.0
+              with:
+                  egress-policy: audit
+                  disable-sudo: true
+
+            - name: Checkout repository
+              uses: actions/checkout@v3
+
+            - name: Setup Python and Poetry
+              uses: ./.github/actions/setup-poetry
+
+            # ----------------------------------------------
+            # Test and then build the package
+            # ----------------------------------------------
+            - name: run poetry build
+              run: |
+                  poetry run poetry check
+                  poetry run coverage run
+
+            # ----------------------------------------------
+            # Publish to PyPi
+            # ----------------------------------------------
+            - name: Publish
+              env:
+                  PYPI_TOKEN: ${{ secrets.PYPI_TOKEN }}
+              run: |
+                  poetry config pypi-token.pypi $PYPI_TOKEN
+                  poetry publish --build

.github/workflows/python-code-checker.yml

@@ -0,0 +1,92 @@
+---
+name: "Python Code Checker"
+
+on:
+    workflow_dispatch:
+    push:
+        paths:
+            - ".github/workflows/python-code-checker.yml"
+            - ".github/actions/**"
+            - "src/**"
+            - "tests/**"
+            - "pyproject.toml"
+            - "poetry.lock"
+    pull_request:
+        types: [opened, reopened]
+        paths:
+            - ".github/workflows/python-code-checker.yml"
+            - ".github/actions/**"
+            - "src/**"
+            - "tests/**"
+            - "pyproject.toml"
+            - "poetry.lock"
+
+concurrency:
+    group: ${{ github.workflow }}-${{ github.ref }}
+    cancel-in-progress: true
+
+jobs:
+    test-python-code:
+        runs-on: ubuntu-latest
+        strategy:
+            fail-fast: true
+            matrix:
+                python-version: ["3.10", "3.11"]
+        steps:
+            - uses: step-security/harden-runner@18bf8ad2ca49c14cbb28b91346d626ccfb00c518 # v2.1.0
+              with:
+                  egress-policy: block
+                  disable-sudo: true
+                  allowed-endpoints: >
+                      api.snapcraft.io:443
+                      api.github.com:443
+                      codecov.io:443
+                      files.pythonhosted.org:443
+                      github.com:443
+                      install.python-poetry.org:443
+                      pypi.org:443
+                      python-poetry.org:443
+                      storage.googleapis.com:443
+                      uploader.codecov.io:443
+
+            - name: Checkout repository
+              uses: actions/checkout@v3
+
+            - name: Setup Python and Poetry
+              uses: ./.github/actions/setup-poetry
+
+            # ----------------------------------------------
+            #    run linters
+            # ----------------------------------------------
+
+            - name: Lint with Mypy
+              run: poetry run mypy src/
+            - name: lint with ruff
+              run: poetry run ruff --extend-ignore=I001,D301 src/
+            - name: check pyproject.toml
+              run: poetry run poetry check
+            - name: lint with black
+              run: poetry run black --check src/
+            - name: run vulture
+              run: poetry run vulture src/
+            - name: run interrogate
+              run: poetry run interrogate -c pyproject.toml .
+
+            # ----------------------------------------------
+            #    run test suite
+            # ----------------------------------------------
+            - name: Run tests with pytest
+              run: |
+                  poetry run coverage run
+                  poetry run coverage report
+                  poetry run coverage xml
+            # ----------------------------------------------
+            #             upload coverage stats
+            # ----------------------------------------------
+            - name: Upload coverage
+              if: github.ref == 'refs/heads/main' && matrix.python-version == '3.11'
+              uses: codecov/codecov-action@v3
+              with:
+                  # token: ${{ secrets.CODECOV_TOKEN }} # Only required for private repositories
+                  files: reports/coverage.xml
+                  fail_ci_if_error: false