Cookiecutter update

.cruft.json

@@ -1,11 +1,12 @@
 {
   "template": "https://github.com/bird-house/cookiecutter-birdhouse.git",
-  "commit": "3320c68367f8e88839a21a331cb5c75e65162f4a",
+  "commit": "3ee7c9d17dfeb516333ae113d2aa9fc31466f854",
   "context": {
     "cookiecutter": {
       "full_name": "Carsten Ehbrecht",
       "email": "ehbrecht@dkrz.de",
       "github_username": "roocs",
+      "orcid_id": "N/A",
       "project_name": "rook",
       "project_slug": "rook",
       "project_repo_name": "rook",
@@ -22,8 +23,8 @@
       ],
       "__gh_slug": "https://github.com/roocs/rook",
       "_template": "https://github.com/bird-house/cookiecutter-birdhouse.git",
-      "_commit": "3320c68367f8e88839a21a331cb5c75e65162f4a"
+      "_commit": "3ee7c9d17dfeb516333ae113d2aa9fc31466f854"
     }
   },
-  "checkout": "v2.0.0"
+  "checkout": null
 }

.github/dependabot.yml

@@ -21,7 +21,7 @@ updates:
       default-days: 7
 
   - package-ecosystem: pip
-    directory: /CI
+    directory: /.github
     schedule:
       interval: "quarterly"
     groups:
@@ -34,3 +34,14 @@ updates:
           - major
     cooldown:
       default-days: 7
+
+  - package-ecosystem: docker
+    directory: /
+    schedule:
+      interval: "quarterly"
+    groups:
+      docker:
+        patterns:
+          - "Dockerfile"
+    cooldown:
+      default-days: 7

.github/labeler.yml

@@ -13,7 +13,7 @@
       - 'tox.toml'
 
 'dependencies':
-  - changes-files:
+  - changed-files:
     - any-glob-to-any-file:
       - 'requirements*.txt'
       - 'environment*.yml'

.github/workflows/auto-accept-ci-changes.yml

@@ -0,0 +1,79 @@
+name: Dependabot CI Updates
+
+on:
+  pull_request:
+    branches:
+      - main
+    paths:
+      - ".github/**/*.yml"
+      - ".github/requirements_ci.*"
+    types:
+      - opened
+      - synchronize
+
+permissions:
+  contents: read
+
+jobs:
+  dependabot-auto-approve:
+    name: Auto-approve and set auto-merge safe Dependabot updates
+    runs-on: ubuntu-latest
+    if: >
+      github.event.pull_request.user.login == 'dependabot[bot]'
+    permissions:
+      contents: write
+      pull-requests: write
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        with:
+          disable-sudo: true
+          egress-policy: audit
+
+      - name: Generate GitHub App token
+        id: token_generator
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          client-id: ${{ secrets.ROOCS_HELPER_BOT_ID }}
+          private-key: ${{ secrets.ROOCS_HELPER_BOT_KEY }}
+          permission-contents: write
+          permission-pull-requests: write
+
+      - name: Fetch Dependabot metadata
+        id: dependabot-metadata
+        uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0
+        with:
+          github-token: ${{ steps.token_generator.outputs.token }}
+
+      - name: Stop workflow if not minor update or patch update
+        id: skip-condition
+        if: >
+          steps.dependabot-metadata.outputs.update-type == 'version-update:semver-major'
+        run: |
+          echo "Not a minor or patch update; Skipping auto-approval."
+          echo "skip=true" >> $GITHUB_OUTPUT
+
+      - name: Checkout Repository
+        if: steps.skip-condition.outputs.skip != 'true'
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          token: ${{ steps.token_generator.outputs.token }}
+          persist-credentials: false
+
+      - name: Approve Changes
+        if: >
+          steps.skip-condition.outputs.skip != 'true' &&
+          !contains(github.event.pull_request.labels.*.name, 'approved')
+        run: |
+          gh pr review --approve "$PR_URL"
+        env:
+          GITHUB_TOKEN: ${{ steps.token_generator.outputs.token }}
+          PR_URL: ${{github.event.pull_request.html_url}}
+
+      - name: Enable auto-merge on Pull Request
+        if: steps.skip-condition.outputs.skip != 'true'
+        run: |
+          gh pr merge --auto --merge "$PR_URL"
+        env:
+          GITHUB_TOKEN: ${{ steps.token_generator.outputs.token }}
+          PR_URL: ${{ github.event.pull_request.html_url }}

.github/workflows/bump-version.yml

@@ -1,24 +1,65 @@
 name: Conditional Bump Version
 
 on:
+  push:
+    branches:
+      - main
+    paths-ignore:
+      - .*
+      - .github/*.in
+      - .github/*.txt
+      - .github/*/*.md
+      - .github/*/*.yml
+      - AUTHORS.rst
+      - CHANGELOG.rst
+      - Dockerfile
+      - Makefile
+      - docs/*/*.ipynb
+      - docs/*/*.py
+      - docs/*/*.rst
+      - docs/Makefile
+      - docs/source/_images/*
+      - docs/source/_static/*
+      - environment-dev.yml
+      - environment-docs.yml
+      - environment.yml
+      - pyproject.toml
+      - src/rook/__version__.py
   workflow_dispatch:
 
 permissions:
   contents: read
 
 jobs:
-  skip_without_bot_secrets:
-    name: Skip version bump
-    if: ${{ secrets.BIRDHOUSE_HELPER_BOT_ID == '' || secrets.BIRDHOUSE_HELPER_BOT_KEY == '' || secrets.BIRDHOUSE_HELPER_BOT_GPG_PRIVATE_KEY == '' || secrets.BIRDHOUSE_HELPER_BOT_GPG_PRIVATE_KEY_PASSWORD == '' }}
+  check_bot_secrets:
+    name: Check helper bot secrets
     runs-on: ubuntu-latest
+    outputs:
+      configured: ${{ steps.check.outputs.configured }}
     steps:
-      - name: Explain skipped bump
+      - name: Check required secrets
+        id: check
+        env:
+          BOT_ID: ${{ secrets.ROOCS_HELPER_BOT_ID }}
+          BOT_KEY: ${{ secrets.ROOCS_HELPER_BOT_KEY }}
+          GPG_KEY: ${{ secrets.ROOCS_HELPER_BOT_GPG_PRIVATE_KEY }}
+          GPG_PASSWORD: ${{ secrets.ROOCS_HELPER_BOT_GPG_PRIVATE_KEY_PASSWORD }}
         run: |
-          echo "Version bump skipped because one or more Birdhouse helper bot secrets are not configured."
+          if [[ -n "$BOT_ID" &&
+                -n "$BOT_KEY" &&
+                -n "$GPG_KEY" &&
+                -n "$GPG_PASSWORD" ]]; then
+            echo "configured=true" >> "$GITHUB_OUTPUT"
+            echo "All helper bot secrets are configured."
+          else
+            echo "configured=false" >> "$GITHUB_OUTPUT"
+            echo "One or more helper bot secrets are missing."
+          fi
 
   bump_patch_version:
     name: Bump build/patch version
-    if: ${{ secrets.BIRDHOUSE_HELPER_BOT_ID != '' && secrets.BIRDHOUSE_HELPER_BOT_KEY != '' && secrets.BIRDHOUSE_HELPER_BOT_GPG_PRIVATE_KEY != '' && secrets.BIRDHOUSE_HELPER_BOT_GPG_PRIVATE_KEY_PASSWORD != '' }}
+    needs: check_bot_secrets
+    if: needs.check_bot_secrets.outputs.configured == 'true'
     runs-on: ubuntu-latest
     permissions:
       contents: write
@@ -41,8 +82,8 @@ jobs:
         id: token_generator
         uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         with:
-          app-id: ${{ secrets.BIRDHOUSE_HELPER_BOT_ID }}
-          private-key: ${{ secrets.BIRDHOUSE_HELPER_BOT_KEY }}
+          app-id: ${{ secrets.ROOCS_HELPER_BOT_ID }}
+          private-key: ${{ secrets.ROOCS_HELPER_BOT_KEY }}
           permission-contents: write
 
       - name: Checkout Repository
@@ -59,15 +100,15 @@ jobs:
       - name: Import GPG Key
         uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7.0.0
         with:
-          gpg_private_key: ${{ secrets.BIRDHOUSE_HELPER_BOT_GPG_PRIVATE_KEY }}
-          passphrase: ${{ secrets.BIRDHOUSE_HELPER_BOT_GPG_PRIVATE_KEY_PASSWORD }}
+          gpg_private_key: ${{ secrets.ROOCS_HELPER_BOT_GPG_PRIVATE_KEY }}
+          passphrase: ${{ secrets.ROOCS_HELPER_BOT_GPG_PRIVATE_KEY_PASSWORD }}
           git_user_signingkey: true
           git_commit_gpgsign: true
           trust_level: 5
 
       - name: Install CI libraries
         run: |
-          python -m pip install --require-hashes -r CI/requirements_ci.txt
+          python -m pip install --require-hashes -r .github/requirements_ci.txt
 
       - name: Conditional Bump
         run: |

.github/workflows/conda-lock-health.yml

@@ -12,6 +12,9 @@ jobs:
   lock-health:
     name: Lock Refresh Health Check
     runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python-version: [ "3.12" ]
     steps:
       - name: Checkout Repository
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
@@ -26,7 +29,8 @@ jobs:
           post-cleanup: none
           environment-name: lockcheck
           create-args: >-
-            python=3.12 conda-lock=4.0.0
+            conda-lock=4.0.0
+            python=${{ matrix.python-version }}
           channels: conda-forge
 
       - name: Try lock/spec generation

.github/workflows/docker-publish.yml

@@ -0,0 +1,92 @@
+name: Docker Hub
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - "Dockerfile"
+      - "src/rook/__version__.py"
+    tags:
+      - "v*"
+  pull_request:
+  workflow_dispatch:
+
+concurrency:
+  # For a given workflow, if we push to the same branch, cancel all previous builds on that branch except on master.
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+
+permissions:
+  contents: read
+
+
+jobs:
+  build-publish:
+    name: Test and Publish image
+    runs-on: ubuntu-latest
+    env:
+      IMAGE_NAME: roocs/rook
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        with:
+          disable-sudo: true
+          egress-policy: audit
+
+      - name: Checkout Repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Gather Docker metadata
+        id: meta
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
+        with:
+          images: ${{ env.IMAGE_NAME }}
+          tags: |
+            type=raw,value=latest,enable={{is_default_branch}}
+            type=ref,event=tag
+            type=raw,value=latest,enable=${{ startsWith(github.ref, 'refs/tags/') }}
+
+      - name: Login to Docker Hub
+        if: ${{ github.event.pull_request.user.login != 'dependabot[bot]' }}
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+
+      - name: Build Docker image
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        with:
+          cache-to: type=gha,mode=max
+          file: Dockerfile
+          labels: ${{ steps.meta.outputs.labels }}
+          load: true
+          push: false
+          tags: ${{ env.IMAGE_NAME }}:test
+
+      - name: Inspect image labels
+        run: |
+          docker inspect --format='{{json .Config.Labels}}' ${{ env.IMAGE_NAME }}:test
+
+      - name: Run Docker image
+        run: |
+          docker run -d --name rook-test -p 5000:5000 ${{ env.IMAGE_NAME }}:test
+          sleep 5
+          curl -fsS "http://localhost:5000/wps?service=WPS&version=1.0.0&request=GetCapabilities" > /dev/null
+          docker logs rook-test
+          docker rm -f rook-test
+
+      - name: Publish image to Docker Hub
+        if: ${{ github.event_name != 'pull_request' }}  # Never push image for pull requests
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        with:
+          cache-from: type=gha
+          file: Dockerfile
+          labels: ${{ steps.meta.outputs.labels }}
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}