feature/mx-1509 update container build and push

.github/pull_request_template.md

@@ -1,5 +1,8 @@
 # PR Context
-<!-- Additional info for the reviewer -->
+<!-- Additional info for the reviewer
+
+Don't forget to explain how you tested the changes, i.e. by providing a link
+to a fork or sample repository where the changes were tried out. -->
 
 # Added
 <!-- New features and interfaces -->

.github/workflows/open-code.yml

@@ -6,6 +6,10 @@ on:
     tags: ["**"]
   workflow_dispatch:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   sync:
     runs-on: ubuntu-latest

.github/workflows/renovatebot.yml

@@ -4,10 +4,13 @@ on:
   push:
     branches: ["main"]
   schedule:
-    # * is a special character in YAML so you have to quote this string
     - cron: "14 3 * * 1-5"
   workflow_dispatch:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   renovate:
     runs-on: ubuntu-latest

.github/workflows/reviewing.yml

@@ -6,6 +6,10 @@ on:
       - opened
       - reopened
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   assignee:
     runs-on: ubuntu-latest

.gitignore

@@ -124,4 +124,5 @@ dmypy.json
 data/
 identity.csv
 schema.json
+tmp*/
 work/

CHANGELOG.md

@@ -14,24 +14,33 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - github action for releasing a new version in template packages
 - add `.web` folder to ignore files for reflex development
 - add commit signing to release pipeline
+- add more metadata labels to docker file
+- add hint to PR template to explain testing for template changes
+- configure sensible concurrency rules for all workflows
+- add distribution upload step to release pipeline
 
 ### Changes
 
 - harmonize git and docker ignore files
 - update requirements, actions and sample dependencies
 - set fixed versions in toml for renovatebot
+- trigger documentation on release pipeline instead of pushed tag
+- harmonize cron schedules
 
 ### Deprecated
 
 ### Removed
 
 - drop npm support from renovate pipeline
 - remove non-functional branch restriction from release pipeline
+- remove docker workflow and move into release pipeline
+- remove stale dependabot cve-scan config
 
 ### Fixed
 
 - fix `export-all` and `install-all` pdm scripts
 - fix wording of release pipeline title
+- fix tagging and pushing docker containers to ghcr.io
 
 ### Security
 

mex-{{ cookiecutter.project_name }}/.dockerignore

@@ -120,6 +120,7 @@ dmypy.json
 data/
 identity.csv
 schema.json
+tmp*/
 work/
 
 # Docker specifics

mex-{{ cookiecutter.project_name }}/.github/workflows/cookiecutter.yml

@@ -5,9 +5,13 @@ on:
     branches: ["main"]
     tags: ["**"]
   schedule:
-    - cron: '0 0 * * *'
+    - cron: "14 3 * * 1-5"
   workflow_dispatch:
 
+concurrency:
+  group: {% raw %}${{ github.workflow }}{% endraw %}
+  cancel-in-progress: true
+
 env:
   PIP_NO_OPTION: on
   PIP_NO_CLEAN: on

mex-{{ cookiecutter.project_name }}/.github/workflows/cve-scan.yml

@@ -2,20 +2,19 @@ name: CVE Scan
 
 on:
   push:
-    # Workflows triggered by Dependabot on the "push" event run with read-only access.
-    # Uploading Code Scanning results requires write access. We therefore only use the
-    # "pull_request" trigger for Dependabot branches.
-    branches-ignore:
-      - 'dependabot/**'
   pull_request:
     types:
       - opened
       - reopened
       - synchronize
   schedule:
-    - cron: '0 0 * * *'
+    - cron: "14 3 * * 1-5"
   workflow_dispatch:
 
+concurrency:
+  group: {% raw %}${{ github.workflow }}-${{ github.ref }}{% endraw %}
+  cancel-in-progress: true
+
 jobs:
   scan:
     runs-on: ubuntu-latest

mex-{{ cookiecutter.project_name }}/.github/workflows/documentation.yml

@@ -1,8 +1,10 @@
 name: Documentation
 
 on:
-  push:
-    tags: ["**"]
+  workflow_run:
+    workflows: [Release]
+    types:
+      - completed
   workflow_dispatch:
 
 env:
@@ -16,7 +18,7 @@ permissions:
   id-token: write
 
 concurrency:
-  group: "pages"
+  group: {% raw %}${{ github.workflow }}{% endraw %}
   cancel-in-progress: false
 
 jobs:

mex-{{ cookiecutter.project_name }}/.github/workflows/linting.yml

@@ -14,6 +14,10 @@ env:
   PIP_NO_CLEAN: on
   PIP_PREFER_BINARY: on
 
+concurrency:
+  group: {% raw %}${{ github.workflow }}-${{ github.ref }}{% endraw %}
+  cancel-in-progress: true
+
 jobs:
   lint:
     runs-on: ubuntu-latest

mex-{{ cookiecutter.project_name }}/.github/workflows/open-code.yml

@@ -6,6 +6,10 @@ on:
     tags: ["**"]
   workflow_dispatch:
 
+concurrency:
+  group: {% raw %}${{ github.workflow }}{% endraw %}
+  cancel-in-progress: true
+
 jobs:
   sync:
     runs-on: ubuntu-latest

mex-{{ cookiecutter.project_name }}/.github/workflows/release.yml

@@ -21,15 +21,18 @@ env:
 
 permissions:
   contents: write
+  packages: write
 
 concurrency:
-  group: "release"
+  group: {% raw %}${{ github.workflow }}-${{ github.ref }}{% endraw %}
   cancel-in-progress: false
 
 jobs:
   release:
     runs-on: ubuntu-latest
     timeout-minutes: 10
+    outputs:
+      tag: {% raw %}${{ steps.release.outputs.tag }}{% endraw %}
     steps:
       - name: Checkout repo
         uses: actions/checkout@v4
@@ -74,7 +77,57 @@ jobs:
           {%- endraw %}
 
       - name: Release new version
+        id: release
         env:
           {% raw %}GH_TOKEN: ${{ secrets.WORKFLOW_TOKEN }}{% endraw %}
         run: |
           pdm release {% raw %}${{ inputs.version }}{% endraw %}
+          echo "tag=$(git describe --abbrev=0 --tags)" >> "$GITHUB_OUTPUT"
+
+  containerize:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    needs: release
+    steps:
+      - name: Build, tag and push docker image to ghcr
+        uses: GlueOps/[email protected]
+        with:
+          tags: "${{ github.sha }},${{ needs.release.outputs.tag }},latest"
+
+  distribute:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    needs: release
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 1
+
+      - name: Cache requirements
+        uses: actions/cache@v4
+        env:
+          cache-name: cache-requirements
+        with:
+          path: ~/.cache/pip
+          key: ${{ env.cache-name }}-${{ hashFiles('requirements.txt') }}
+          restore-keys: |
+            ${{ env.cache-name }}-
+      - name: Setup python
+        uses: actions/setup-python@v5
+        with:
+          python-version: 3.11
+
+      - name: Install requirements
+        run: make setup
+
+      - name: Build wheel and sdist distros and create a github release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PDM_CHECK_UPDATE: False
+        run: |
+          pdm build --dest dist
+          gh release create ${{ needs.release.outputs.tag }} --generate-notes --latest --verify-tag
+          for filename in dist/*; do
+            gh release upload ${{ needs.release.outputs.tag }} ${filename};
+          done

mex-{{ cookiecutter.project_name }}/.github/workflows/renovatebot.yml

@@ -4,10 +4,13 @@ on:
   push:
     branches: ["main"]
   schedule:
-    # * is a special character in YAML so you have to quote this string
     - cron: "14 3 * * 1-5"
   workflow_dispatch:
 
+concurrency:
+  group: {% raw %}${{ github.workflow }}{% endraw %}
+  cancel-in-progress: true
+
 jobs:
   renovate:
     runs-on: ubuntu-latest

mex-{{ cookiecutter.project_name }}/.github/workflows/reviewing.yml

@@ -6,6 +6,10 @@ on:
       - opened
       - reopened
 
+concurrency:
+  group: {% raw %}${{ github.workflow }}-${{ github.ref }}{% endraw %}
+  cancel-in-progress: true
+
 jobs:
   assignee:
     runs-on: ubuntu-latest

mex-{{ cookiecutter.project_name }}/.github/workflows/testing.yml

@@ -14,6 +14,10 @@ env:
   PIP_NO_CLEAN: on
   PIP_PREFER_BINARY: on
 
+concurrency:
+  group: {% raw %}${{ github.workflow }}-${{ github.ref }}{% endraw %}
+  cancel-in-progress: true
+
 jobs:
   test:
     runs-on: ubuntu-latest

mex-{{ cookiecutter.project_name }}/.gitignore

@@ -124,4 +124,5 @@ dmypy.json
 data/
 identity.csv
 schema.json
+tmp*/
 work/

mex-{{ cookiecutter.project_name }}/.pre-commit-config.yaml

@@ -12,7 +12,7 @@ repos:
       - id: ruff
         args: [--fix, --exit-non-zero-on-fix]
   - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v4.5.0
+    rev: v4.6.0
     hooks:
       - id: pretty-format-json
         name: json

mex-{{ cookiecutter.project_name }}/Dockerfile

@@ -2,9 +2,11 @@
 
 FROM python:3.11 as base
 
-LABEL org.opencontainers.image.authors="RKI MEx Team <[email protected]>"
+LABEL org.opencontainers.image.authors="[email protected]"
 LABEL org.opencontainers.image.description="{{ cookiecutter.short_summary }}"
 LABEL org.opencontainers.image.licenses="MIT"
+LABEL org.opencontainers.image.url="https://github.com/robert-koch-institut/mex-{{ cookiecutter.project_name }}"
+LABEL org.opencontainers.image.vendor="robert-koch-institut"
 
 ENV PYTHONUNBUFFERED=1
 ENV PYTHONOPTIMIZE=1

mex-{{ cookiecutter.project_name }}/pyproject.toml

@@ -12,7 +12,7 @@ optional-dependencies.dev = [
     "black==24.4.2",
     "ipdb==0.13.13",
     "mypy==1.10.0",
-    "pytest-cov>=5.0.0",
+    "pytest-cov==5.0.0",
     "pytest-random-order==1.1.1",
     "pytest-xdist==3.6.1",
     "pytest==8.2.2",