Ouranosinc / xclim / 41702131257
90%

DEFAULT BRANCH: main
Ran
Jobs 8
Files 63
Run time 1min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 90.575%. Remained the same
41702131257

push

github

web-flow 
Dependency and security updates, SLSA Attestations (#2455)

<!--Please ensure the PR fulfills the following requirements! -->
<!-- If this is your first PR, make sure to add your details to the
AUTHORS.rst! -->
### Pull Request Checklist:
- [ ] This PR addresses an already opened issue (for bug fixes /
features)
    - This PR fixes #xyz
- [ ] Tests for the changes have been added (for bug fixes / features)
- [x] (If applicable) Documentation has been added / updated (for bug
fixes / features)
- [x] CHANGELOG.rst has been updated (with summary of main changes)
- [x] Link to issue (:issue:`number`) and pull request (:pull:`number`)
has been added

### What kind of change does this PR introduce?

* Splits the PyPI/TestPyPI publishing workflows to ensure that the
publishing step is sanitized
* `tag-testpypi.yml` now stages the GitHub release with the attestation
files used for TestPyPI
* Adds the `actions/attest` action to automatically add SLSA
attestations to releases on GitHub
* Updates a few dependencies in CI environment to address security
advisories
* Updates `pytest` to v9.2+ and modifies the doctest call to use only
the `src/xclim/testing/conftest.py` setup file

### Does this PR introduce a breaking change?

Not really. Doctests triggered via `tox` were already skipping `pytest`
v9.1 due to issues with `conftest.py` discoverability. This change
removes that workaround.

Splitting the release workflow such that the
`pypa/gh-action-pypi-publish` step does not compile/build packages is
generally seen as a good idea.

The attestations generated by `actions/attest` are not technically
required, but provide another means for users to validate build
provenance of packages. This is likely much more useful for workflows
generating binaries or OCI images (Docker), but it doesn't hurt to have
it.

### Other information:

https://github.com/pytest-dev/pytest/issues/14683
https://docs.pypi.org/attestations/

Due to our release process, the artifacts used to ... (continued)

8140 of 8987 relevant lines covered (90.58%)

7.63 hits per line

Jobs
ID Job ID Ran Files Coverage
1 run-3.13-windows-latest-prefetch - 41702131257.1 63
89.1
GitHub Action Run
2 run-3.12-ubuntu-latest- - 41702131257.2 63
86.38
GitHub Action Run
3 run-{{ matrix.python-version }}-conda - 41702131257.3 63
89.86
GitHub Action Run
4 run-3.12-ubuntu-latest-offline - 41702131257.4 63
89.3
GitHub Action Run
5 run-3.13-ubuntu-latest- - 41702131257.5 63
86.9
GitHub Action Run
6 run-3.13-macos-latest- - 41702131257.6 63
89.85
GitHub Action Run
7 run-3.12-ubuntu-latest-doctests - 41702131257.7 63
55.87
GitHub Action Run
8 run-3.14-ubuntu-latest- - 41702131257.8 63
86.37
GitHub Action Run
Source Files on build 41702131257