Merge remote-tracking branch 'upstream/develop' into gitea_external_m…

…irror

.github/ISSUE_TEMPLATE/release_checklist.md

@@ -25,12 +25,10 @@ Refer to the [Deployment](https://data-safe-haven.readthedocs.io/en/latest/deplo
 ### For minor releases and above
 
 - [ ] Deploy an SHM from this branch and save a transcript of the deployment logs
-- [ ] Build an SRE compute image (SRD) and save transcripts of the logs
 - Using the new image, deploy a tier 2 and a tier 3 SRE
     - [ ] Save the transcript of your tier 2 SRE deployment
     - [ ] Save the transcript of your tier 3 SRE deployment
 - [ ] Complete the [Security evaluation checklist](https://data-safe-haven.readthedocs.io/en/latest/deployment/security_checklist.html) from the deployment documentation
-- [ ] Update [SECURITY.md](../../SECURITY.md) and [VERSIONING.md](../../VERSIONING.md)
 - [ ] Add the new versions tag as an active build on [Read The Docs](https://readthedocs.org) (You can add as a hidden build, before release, to preview)
 
 ### For major releases only

.github/dependabot.yml

@@ -7,3 +7,13 @@ updates:
     directory: "/"  # The exact logic is unclear, but it recursively searches at least .github/workflows/
     schedule:
       interval: "weekly"
+  # Python package update PRs
+  - package-ecosystem: pip  # This will update 'pyproject.toml'
+    directory: "/"
+    schedule:
+      interval: weekly
+    groups:
+      production-dependencies:
+        dependency-type: "production"
+      development-dependencies:
+        dependency-type: "development"

.github/workflows/dependabot_amend.yaml

@@ -0,0 +1,46 @@
+---
+name: Amend Dependabot PRs
+
+on:  # yamllint disable-line rule:truthy
+  push:
+    branches:
+      - dependabot/pip/**
+  pull_request:
+    branches:
+      - dependabot/pip/**
+  workflow_dispatch:  # allow this workflow to be manually triggered
+
+# checkout needs 'contents:read'
+# pull request needs 'pull-requests:write' and 'contents:write'
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  amend_dependabot_prs:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Setup Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install hatch
+        run: pip install hatch
+
+      - name: Update hatch requirements
+        run: |
+          rm .hatch/requirements*.txt
+          hatch run true
+          hatch -e docs run true
+          hatch -e lint run true
+          hatch -e test run true
+
+      - name: Commit changes
+        uses: stefanzweifel/[email protected]
+        with:
+          commit_message: "[dependabot skip] :wrench: Update Python requirements files"
+          branch: ${{ github.head_ref }}

.github/workflows/lint_code.yaml

@@ -48,9 +48,13 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: '3.3'
       - name: Install requirements
         shell: bash
-        run: sudo gem install mdl
+        run: gem install mdl
       - name: Lint Markdown
         run: mdl --style .mdlstyle.rb .
 

.github/workflows/update_docker_versions.yaml

@@ -40,7 +40,7 @@ jobs:
       - name: Create pull request
         if: ${{ ! env.ACT }}
         id: pull-request
-        uses: peter-evans/create-pull-request@v6.1.0
+        uses: peter-evans/create-pull-request@v7.0.1
         with:
           author: ${{ github.actor }} <${{ github.actor }}@users.noreply.github.com>
           base: develop

.gitignore

@@ -15,6 +15,7 @@ environment_configs/package_lists/dependency-cache.json
 # Python build caches
 __pycache__/
 .venv/
+dist/
 
 # Development tools
 .vscode