[WIP] apply new cookiecutter template from stsci-package-template

.cruft.json

@@ -0,0 +1,23 @@
+{
+  "template": "https://github.com/zacharyburnett/stsci-package-template",
+  "commit": "4503bbf380a0471fc60ea92118ca384407aa2ea0",
+  "checkout": "modernize",
+  "context": {
+    "cookiecutter": {
+      "project_name": "stpipe",
+      "package_name": "stpipe",
+      "repository_url": "https://github.com/spacetelescope/stpipe",
+      "project_description": "Provides base classes and command-line tools for implementing calibration pipeline software.",
+      "manage_changelog_with_towncrier": true,
+      "publish_docs_to": "readthedocs.io",
+      "task_runner": "tox",
+      "python_version": ">=3.10",
+      "python_c_extensions": false,
+      "python_build_backend": "setuptools",
+      "crds_observatory": "none",
+      "_template": "https://github.com/zacharyburnett/stsci-package-template",
+      "_commit": "4503bbf380a0471fc60ea92118ca384407aa2ea0"
+    }
+  },
+  "directory": "python-package"
+}

.github/actionlint.yml

@@ -0,0 +1,5 @@
+paths:
+  .github/workflows/**/*.{yml,yaml}:
+    ignore:
+      - "SC2086"
+      - "SC2046"

.github/dependabot.yml

@@ -1,20 +1,16 @@
 version: 2
-updates:
-
-  # Maintain dependencies for GitHub Actions
-  - package-ecosystem: "github-actions"
-    directory: "/"
-    target-branch: "main"
-    schedule:
-      interval: "weekly"
-    reviewers:
-      - "zacharyburnett"
 
-  # Maintain dependencies for pip
+updates:
   - package-ecosystem: "pip"
     directory: "/"
+    labels:
+      - no-changelog-entry-needed
     target-branch: "main"
     schedule:
-      interval: "weekly"
-    reviewers:
-      - "zacharyburnett"
+      interval: "monthly"
+    cooldown:
+      default-days: 7
+    groups:
+      actions:
+        patterns:
+          - "*"

.github/labeler.yml

@@ -0,0 +1,44 @@
+breaking-change:
+  - changed-files:
+      - any-glob-to-any-file:
+          - "changes/*.breaking.rst"
+
+feature:
+  - changed-files:
+      - any-glob-to-any-file:
+          - "changes/*.feature.rst"
+
+fix:
+  - changed-files:
+      - any-glob-to-any-file:
+          - "changes/*.fix.rst"
+
+documentation:
+  - changed-files:
+      - all-globs-to-any-file: ["*.rst", "!CHANGES.rst", "!changes/*"]
+      - any-glob-to-any-file:
+          - "docs/**/*"
+          - "*.md"
+          - ".readthedocs.yaml"
+          - "LICENSE"
+          - "changes/*.docs.rst"
+
+packaging:
+  - changed-files:
+      - any-glob-to-any-file:
+          - "pyproject.toml"
+
+# --------------------------------------- testing ---------------------------------------
+
+automation:
+  - changed-files:
+      - any-glob-to-any-file:
+          - ".github/**"
+
+testing:
+  - changed-files:
+      - any-glob-to-any-file:
+          - "**/tests/**"
+          - "**/regtest/**"
+          - ".github/workflows/test*.yml"
+          - "**/conftest.py"

.github/pull_request_template.md

@@ -1,20 +1,24 @@
-<!-- If this PR closes a JIRA ticket, make sure the title starts with the JIRA issue number,
-for example JP-1234: <Fix a bug> -->
-Resolves [JP-nnnn](https://jira.stsci.edu/browse/JP-nnnn)
-Resolves [RCAL-nnnn](https://jira.stsci.edu/browse/RCAL-nnnn)
+<!-- If this PR addresses a JIRA ticket: -->
+<!-- Resolves [JP-nnnn](https://jira.stsci.edu/browse/JP-nnnn) -->
+<!-- Resolves [RCAL-nnnn](https://jira.stsci.edu/browse/RCAL-nnnn) -->
 
-<!-- If this PR closes a GitHub issue, reference it here by its number -->
-Closes #
+<!-- If this PR will close an existing GitHub issue (that is not already attached to a JIRA ticket): -->
+<!-- Closes # -->
 
-<!-- describe the changes comprising this PR here -->
-This PR addresses ...
+<!-- Describe your changes here: -->
+
+## Description
+
+This change ...
+
+<!-- If you can't perform these tasks due to permissions, reach out to a maintainer. -->
 
-<!-- if you can't perform these tasks due to permissions, please ask a maintainer to do them -->
 ## Tasks
+
 - [ ] update or add relevant tests
 - [ ] update relevant docstrings and / or `docs/` page
-- [ ] Does this PR change any API used downstream? (if not, label with `no-changelog-entry-needed`)
-  - [ ] write news fragment(s) in `changes/`: `echo "changed something" > changes/<PR#>.<changetype>.rst` (see [changelog readme](https://github.com/spacetelescope/stpipe/blob/main/changes/README.rst) for instructions)
+- [ ] If this change affects user-facing code or public API, add news fragment file(s) to `changes/` (see [the changelog instructions](https://github.com/spacetelescope/stpipe/blob/main/changes/README.md)).
+      Otherwise, add the `no-changelog-entry-needed` label.
   - [ ] run regression tests with this branch installed (`stpipe@git+https://github.com/<fork>/stpipe.git@<branch>`)
     - [ ] [`jwst` regression test](https://github.com/spacetelescope/RegressionTests/actions/workflows/jwst.yml)
     - [ ] [`romancal` regression test](https://github.com/spacetelescope/RegressionTests/actions/workflows/romancal.yml)

.github/release.yml

@@ -0,0 +1,17 @@
+changelog:
+  categories:
+    - title: Breaking Changes
+      labels:
+        - breaking-change
+    - title: New Features
+      labels:
+        - feature
+    - title: Fixes
+      labels:
+        - fix
+    - title: Documentation Changes
+      labels:
+        - documentation
+    - title: Other Changes
+      labels:
+        - "*"

.github/workflows/build.yml

@@ -1,15 +1,52 @@
 name: build
 
 on:
+  pull_request:
   release:
     types: [released]
-  pull_request:
   workflow_dispatch:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 jobs:
   build:
-    uses: OpenAstronomy/github-actions-workflows/.github/workflows/publish_pure_python.yml@v2
-    with:
-      upload_to_pypi: ${{ (github.event_name == 'release') && (github.event.action == 'released') }}
-    secrets:
-      pypi_token: ${{ secrets.PYPI_PASSWORD_STSCI_MAINTAINER }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-tags: true
+          persist-credentials: false
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version: "3"
+      - run: pip install build
+      - run: python -m build --sdist --wheel
+      - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        with:
+          name: dist
+          path: ./dist/
+  publish:
+    if: (github.event_name == 'release') && (github.event.action == 'released')
+    needs: [build]
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      attestations: write
+    # Requires environment protection rules in GitHub Settings:
+    # Settings > Environments > pypi > Add required reviewers
+    environment:
+      name: pypi
+      url: https://pypi.org/p/stpipe
+    steps:
+      - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
+        with:
+          pattern: dist*
+          path: dist/
+          merge-multiple: true
+      - uses: actions/attest-build-provenance@96278af6caaf10aea03fd8d33a09a777ca52d62f # v3.2.0
+        with:
+          subject-path: "dist/*"
+      # To upload to PyPI without a token, add this workflow file as a Trusted Publisher in the project settings on the PyPI website
+      - uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0

.github/workflows/changelog.yml

@@ -10,30 +10,21 @@ on:
       - reopened
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
 jobs:
-  changelog-check:
+  check:
     if: ${{ !contains(github.event.pull_request.labels.*.name, 'no-changelog-entry-needed') }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/setup-python@v6
-        with:
-          python-version: 3.12
       - uses: actions/checkout@v6
         with:
-          fetch-depth: 0
-      - run: pip install .
-      - run: pip install towncrier
-      - run: towncrier check
-      - run: towncrier build --draft | grep -P '#${{ github.event.number }}'
-  changelog-prevent-manual-edit:
-    if: ${{ !contains(github.event.pull_request.labels.*.name, 'allow-manual-changelog-edit') }}
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6
+          persist-credentials: false
+      - uses: actions/setup-python@v6
         with:
-          fetch-depth: 0
-      - name: prevent direct changes to `CHANGES.rst` (write a towncrier fragment in `changes/` instead; you can override this with the `allow-manual-changelog-edit` label)
-        run: git diff HEAD ${{ github.event.pull_request.base.sha }} --no-patch --exit-code CHANGES.rst
+          python-version: "3"
+      - run: pip install . towncrier
+      - run: towncrier check
+      - name: search for news fragment matching pull request number
+        run: towncrier build --draft | grep -P '#${{ github.event.number }}'

.github/workflows/label.yml

@@ -0,0 +1,15 @@
+on:
+  pull_request_target:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  label:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/labeler@v6
+        if: github.event_name == 'pull_request_target' || github.event_name == 'pull_request'
+        with:
+          repo-token: "${{ secrets.GITHUB_TOKEN }}"

.github/workflows/tests.yml

@@ -1,20 +1,21 @@
 name: tests
 
 on:
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - ready_for_review
   push:
     branches:
       - main
-    tags:
-      - "*"
-  pull_request:
-  schedule:
-    # Weekly Monday 9AM build
-    # * is a special character in YAML so you have to quote this string
-    - cron: "0 9 * * 1"
   workflow_dispatch:
 
+permissions: {}
+
 concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
 jobs:
@@ -23,15 +24,17 @@ jobs:
     with:
       envs: |
         - linux: py310-oldestdeps-cov-xdist
-        - linux: py310-xdist
-        - linux: py311-xdist
         - linux: py311-downstreamdeps-cov-xdist
           coverage: 'codecov'
         - linux: py312-xdist-nolegacypath
-        - linux: py313-xdist
         - linux: py314-cov-xdist
           coverage: 'codecov'
         - macos: py314-xdist
+      fill: true
+      fill_platforms: linux
+      fill_factors: xdist
+      artifact-path: |
+        results.xml
   test_downstream:
     uses: OpenAstronomy/github-actions-workflows/.github/workflows/tox.yml@v2
     with:
@@ -42,4 +45,4 @@ jobs:
       envs: |
         - linux: py313-jwst-cov
         - linux: py313-romancal-cov
-      coverage: codecov
+      coverage: github

.github/workflows/tests_extra.yml

@@ -2,30 +2,34 @@ name: extra tests
 
 on:
   schedule:
-    # Weekly Monday 6AM build
-    - cron: "0 0 * * 1"
+    - cron: "6 0 * * 1" # every Monday at 6a
   pull_request:
-    # We also want this workflow triggered if the `Weekly CI` label is
-    # added or present when PR is updated
     types:
       - opened
+      - synchronize
       - reopened
+      - ready_for_review
       - labeled
       - unlabeled
-      - synchronize
   push:
     tags:
       - "*"
   workflow_dispatch:
 
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 jobs:
   test:
     uses: OpenAstronomy/github-actions-workflows/.github/workflows/tox.yml@v2
     if: (github.repository == 'spacetelescope/stpipe' && (github.event_name == 'schedule' || github.event_name == 'push' || github.event_name == 'workflow_dispatch' || contains(github.event.pull_request.labels.*.name, 'run extra tests')))
     with:
       envs: |
-        - macos: py311-xdist
-        - macos: py312-xdist
-        - macos: py313-xdist
         - linux: py314-devdeps-xdist
         - macos: py314-devdeps-xdist
+      fill: true
+      fill_platforms: macos
+      fill_factors: xdist