dycw-actions 0.8.11__py3-none-any.whl → 0.14.0__py3-none-any.whl

actions/pre_commit/conformalize_repo/lib.py

@@ -14,13 +14,16 @@ from typing import TYPE_CHECKING, Literal, assert_never
 import tomlkit
 from tomlkit import TOMLDocument, table
 from tomlkit.exceptions import NonExistentKey
+from utilities.functions import get_func_name
 from utilities.inflect import counted_noun
 from utilities.re import extract_groups
 from utilities.subprocess import ripgrep
+from utilities.tabulate import func_param_desc
 from utilities.text import repr_str, strip_and_dedent
 from utilities.throttle import throttle
 from utilities.version import ParseVersionError, Version, parse_version
 
+from actions import __version__
 from actions.constants import (
     ACTIONS_URL,
     BUMPVERSION_TOML,
@@ -28,6 +31,7 @@ from actions.constants import (
     ENVRC,
     GITEA_PULL_REQUEST_YAML,
     GITEA_PUSH_YAML,
+    GITHUB,
     GITHUB_PULL_REQUEST_YAML,
     GITHUB_PUSH_YAML,
     GITIGNORE,
@@ -62,7 +66,7 @@ from actions.pre_commit.conformalize_repo.constants import (
     UV_URL,
 )
 from actions.pre_commit.conformalize_repo.settings import SETTINGS
-from actions.pre_commit.constants import THROTTLE_DELTA
+from actions.pre_commit.constants import THROTTLE_DURATION
 from actions.pre_commit.format_requirements.constants import FORMAT_REQUIREMENTS_SUB_CMD
 from actions.pre_commit.replace_sequence_strs.constants import (
     REPLACE_SEQUENCE_STRS_SUB_CMD,
@@ -71,23 +75,24 @@ from actions.pre_commit.touch_empty_py.constants import TOUCH_EMPTY_PY_SUB_CMD
 from actions.pre_commit.touch_py_typed.constants import TOUCH_PY_TYPED_SUB_CMD
 from actions.pre_commit.update_requirements.constants import UPDATE_REQUIREMENTS_SUB_CMD
 from actions.pre_commit.utilities import (
-    ensure_aot_contains,
     ensure_contains,
     ensure_contains_partial_dict,
     ensure_contains_partial_str,
     ensure_not_contains,
-    get_aot,
-    get_array,
-    get_dict,
-    get_list,
-    get_table,
+    get_set_aot,
+    get_set_array,
+    get_set_dict,
+    get_set_list_dicts,
+    get_set_list_strs,
+    get_set_table,
     path_throttle_cache,
     yield_json_dict,
+    yield_pyproject_toml,
     yield_text_file,
     yield_toml_doc,
     yield_yaml_dict,
 )
-from actions.utilities import log_func_call, logged_run
+from actions.utilities import logged_run
 
 if TYPE_CHECKING:
     from collections.abc import Iterator, MutableSet
@@ -99,9 +104,10 @@ if TYPE_CHECKING:
 
 def conformalize_repo(
     *,
-    ci__ca_certificates: bool = SETTINGS.ci__ca_certificates,
+    ci__certificates: bool = SETTINGS.ci__certificates,
     ci__gitea: bool = SETTINGS.ci__gitea,
-    ci__token: str | None = SETTINGS.ci__token,
+    ci__token_checkout: Secret[str] | None = SETTINGS.ci__token_checkout,
+    ci__token_github: Secret[str] | None = SETTINGS.ci__token_github,
     ci__pull_request__pre_commit: bool = SETTINGS.ci__pull_request__pre_commit,
     ci__pull_request__pre_commit__submodules: str
     | None = SETTINGS.ci__pull_request__pre_commit__submodules,
@@ -110,15 +116,26 @@ def conformalize_repo(
     ci__pull_request__pytest__ubuntu: bool = SETTINGS.ci__pull_request__pytest__ubuntu,
     ci__pull_request__pytest__windows: bool = SETTINGS.ci__pull_request__pytest__windows,
     ci__pull_request__pytest__all_versions: bool = SETTINGS.ci__pull_request__pytest__all_versions,
-    ci__pull_request__pytest__sops_age_key: str
+    ci__pull_request__pytest__sops_age_key: Secret[str]
     | None = SETTINGS.ci__pull_request__pytest__sops_age_key,
     ci__pull_request__ruff: bool = SETTINGS.ci__pull_request__ruff,
-    ci__push__publish: bool = SETTINGS.ci__push__publish,
-    ci__push__publish__username: str | None = SETTINGS.ci__push__publish__username,
-    ci__push__publish__password: Secret[str]
-    | None = SETTINGS.ci__push__publish__password,
-    ci__push__publish__publish_url: Secret[str]
-    | None = SETTINGS.ci__push__publish__publish_url,
+    ci__push__publish__github: bool = SETTINGS.ci__push__publish__github,
+    ci__push__publish__primary: bool = SETTINGS.ci__push__publish__primary,
+    ci__push__publish__primary__job_name: str = SETTINGS.ci__push__publish__primary__job_name,
+    ci__push__publish__primary__username: str
+    | None = SETTINGS.ci__push__publish__primary__username,
+    ci__push__publish__primary__password: Secret[str]
+    | None = SETTINGS.ci__push__publish__primary__password,
+    ci__push__publish__primary__publish_url: str
+    | None = SETTINGS.ci__push__publish__primary__publish_url,
+    ci__push__publish__secondary: bool = SETTINGS.ci__push__publish__secondary,
+    ci__push__publish__secondary__job_name: str = SETTINGS.ci__push__publish__secondary__job_name,
+    ci__push__publish__secondary__username: str
+    | None = SETTINGS.ci__push__publish__secondary__username,
+    ci__push__publish__secondary__password: Secret[str]
+    | None = SETTINGS.ci__push__publish__secondary__password,
+    ci__push__publish__secondary__publish_url: str
+    | None = SETTINGS.ci__push__publish__secondary__publish_url,
     ci__push__tag: bool = SETTINGS.ci__push__tag,
     ci__push__tag__all: bool = SETTINGS.ci__push__tag__all,
     coverage: bool = SETTINGS.coverage,
@@ -136,9 +153,6 @@ def conformalize_repo(
     pre_commit__uv: bool = SETTINGS.pre_commit__uv,
     pyproject: bool = SETTINGS.pyproject,
     pyproject__project__optional_dependencies__scripts: bool = SETTINGS.pyproject__project__optional_dependencies__scripts,
-    pyproject__tool__uv__indexes: list[
-        tuple[str, str]
-    ] = SETTINGS.pyproject__tool__uv__indexes,
     pyright: bool = SETTINGS.pyright,
     pytest: bool = SETTINGS.pytest,
     pytest__asyncio: bool = SETTINGS.pytest__asyncio,
@@ -151,58 +165,70 @@ def conformalize_repo(
     ruff: bool = SETTINGS.ruff,
     run_version_bump: bool = SETTINGS.run_version_bump,
     script: str | None = SETTINGS.script,
+    uv__indexes: list[tuple[str, str]] = SETTINGS.uv__indexes,
     uv__native_tls: bool = SETTINGS.uv__native_tls,
 ) -> None:
-    variables = [
-        f"{ci__ca_certificates=}",
-        f"{ci__gitea=}",
-        f"{ci__token=}",
-        f"{ci__pull_request__pre_commit=}",
-        f"{ci__pull_request__pre_commit__submodules=}",
-        f"{ci__pull_request__pyright=}",
-        f"{ci__pull_request__pytest__macos=}",
-        f"{ci__pull_request__pytest__ubuntu=}",
-        f"{ci__pull_request__pytest__windows=}",
-        f"{ci__pull_request__pytest__all_versions=}",
-        f"{ci__pull_request__pytest__sops_age_key=}",
-        f"{ci__pull_request__ruff=}",
-        f"{ci__push__publish=}",
-        f"{ci__push__publish__username=}",
-        f"{ci__push__publish__password=}",
-        f"{ci__push__publish__publish_url=}",
-        f"{ci__push__tag=}",
-        f"{ci__push__tag__all=}",
-        f"{coverage=}",
-        f"{description=}",
-        f"{envrc=}",
-        f"{envrc__uv=}",
-        f"{gitignore=}",
-        f"{package_name=}",
-        f"{pre_commit__dockerfmt=}",
-        f"{pre_commit__prettier=}",
-        f"{pre_commit__python=}",
-        f"{pre_commit__ruff=}",
-        f"{pre_commit__shell=}",
-        f"{pre_commit__taplo=}",
-        f"{pre_commit__uv=}",
-        f"{pyproject=}",
-        f"{pyproject__project__optional_dependencies__scripts=}",
-        f"{pyproject__tool__uv__indexes=}",
-        f"{pyright=}",
-        f"{pytest=}",
-        f"{pytest__asyncio=}",
-        f"{pytest__ignore_warnings=}",
-        f"{pytest__timeout=}",
-        f"{python_package_name=}",
-        f"{python_version=}",
-        f"{readme=}",
-        f"{repo_name=}",
-        f"{ruff=}",
-        f"{run_version_bump=}",
-        f"{script=}",
-        f"{uv__native_tls=}",
-    ]
-    LOGGER.info(log_func_call(conformalize_repo, *variables))
+    LOGGER.info(
+        func_param_desc(
+            conformalize_repo,
+            __version__,
+            f"{ci__certificates=}",
+            f"{ci__gitea=}",
+            f"{ci__token_checkout=}",
+            f"{ci__token_github=}",
+            f"{ci__pull_request__pre_commit=}",
+            f"{ci__pull_request__pre_commit__submodules=}",
+            f"{ci__pull_request__pyright=}",
+            f"{ci__pull_request__pytest__macos=}",
+            f"{ci__pull_request__pytest__ubuntu=}",
+            f"{ci__pull_request__pytest__windows=}",
+            f"{ci__pull_request__pytest__all_versions=}",
+            f"{ci__pull_request__pytest__sops_age_key=}",
+            f"{ci__pull_request__ruff=}",
+            f"{ci__push__publish__github=}",
+            f"{ci__push__publish__primary=}",
+            f"{ci__push__publish__primary__job_name=}",
+            f"{ci__push__publish__primary__username=}",
+            f"{ci__push__publish__primary__password=}",
+            f"{ci__push__publish__primary__publish_url=}",
+            f"{ci__push__publish__secondary=}",
+            f"{ci__push__publish__secondary__job_name=}",
+            f"{ci__push__publish__secondary__username=}",
+            f"{ci__push__publish__secondary__password=}",
+            f"{ci__push__publish__secondary__publish_url=}",
+            f"{ci__push__tag=}",
+            f"{ci__push__tag__all=}",
+            f"{coverage=}",
+            f"{description=}",
+            f"{envrc=}",
+            f"{envrc__uv=}",
+            f"{gitignore=}",
+            f"{package_name=}",
+            f"{pre_commit__dockerfmt=}",
+            f"{pre_commit__prettier=}",
+            f"{pre_commit__python=}",
+            f"{pre_commit__ruff=}",
+            f"{pre_commit__shell=}",
+            f"{pre_commit__taplo=}",
+            f"{pre_commit__uv=}",
+            f"{pyproject=}",
+            f"{pyproject__project__optional_dependencies__scripts=}",
+            f"{pyright=}",
+            f"{pytest=}",
+            f"{pytest__asyncio=}",
+            f"{pytest__ignore_warnings=}",
+            f"{pytest__timeout=}",
+            f"{python_package_name=}",
+            f"{python_version=}",
+            f"{readme=}",
+            f"{repo_name=}",
+            f"{ruff=}",
+            f"{run_version_bump=}",
+            f"{script=}",
+            f"{uv__indexes=}",
+            f"{uv__native_tls=}",
+        )
+    )
     modifications: set[Path] = set()
     add_bumpversion_toml(
         modifications=modifications,
@@ -225,55 +251,70 @@ def conformalize_repo(
         taplo=pre_commit__taplo,
         uv=pre_commit__uv,
         script=script,
+        uv__indexes=uv__indexes,
+        uv__native_tls=uv__native_tls,
     )
     if (
         ci__pull_request__pre_commit
-        or ci__pull_request__pre_commit__submodules
         or ci__pull_request__pyright
         or ci__pull_request__pytest__macos
         or ci__pull_request__pytest__ubuntu
         or ci__pull_request__pytest__windows
-        or (ci__pull_request__pytest__sops_age_key is not None)
         or ci__pull_request__ruff
     ):
         add_ci_pull_request_yaml(
-            certificates=ci__ca_certificates,
             gitea=ci__gitea,
-            token=ci__token,
             modifications=modifications,
+            certificates=ci__certificates,
             pre_commit=ci__pull_request__pre_commit,
             pre_commit__submodules=ci__pull_request__pre_commit__submodules,
             pyright=ci__pull_request__pyright,
             pytest__macos=ci__pull_request__pytest__macos,
             pytest__ubuntu=ci__pull_request__pytest__ubuntu,
             pytest__windows=ci__pull_request__pytest__windows,
+            pytest__all_versions=ci__pull_request__pytest__all_versions,
             pytest__sops_age_key=ci__pull_request__pytest__sops_age_key,
             pytest__timeout=pytest__timeout,
             python_version=python_version,
             repo_name=repo_name,
             ruff=ruff,
             script=script,
+            token_checkout=ci__token_checkout,
+            token_github=ci__token_github,
             uv__native_tls=uv__native_tls,
         )
     if (
-        ci__push__publish
-        or (ci__push__publish__username is not None)
-        or (ci__push__publish__password is not None)
-        or (ci__push__publish__publish_url is not None)
+        ci__push__publish__github
+        or ci__push__publish__primary
+        or (ci__push__publish__primary__username is not None)
+        or (ci__push__publish__primary__password is not None)
+        or (ci__push__publish__primary__publish_url is not None)
+        or ci__push__publish__secondary
+        or (ci__push__publish__secondary__username is not None)
+        or (ci__push__publish__secondary__password is not None)
+        or (ci__push__publish__secondary__publish_url is not None)
         or ci__push__tag
         or ci__push__tag__all
     ):
         add_ci_push_yaml(
-            certificates=ci__ca_certificates,
             gitea=ci__gitea,
-            token=ci__token,
             modifications=modifications,
-            publish=ci__push__publish,
-            publish__username=ci__push__publish__username,
-            publish__password=ci__push__publish__password,
-            publish__publish_url=ci__push__publish__publish_url,
+            certificates=ci__certificates,
+            publish__github=ci__push__publish__github,
+            publish__primary=ci__push__publish__primary,
+            publish__primary__job_name=ci__push__publish__primary__job_name,
+            publish__primary__username=ci__push__publish__primary__username,
+            publish__primary__password=ci__push__publish__primary__password,
+            publish__primary__publish_url=ci__push__publish__primary__publish_url,
+            publish__secondary=ci__push__publish__secondary,
+            publish__secondary__job_name=ci__push__publish__secondary__job_name,
+            publish__secondary__username=ci__push__publish__secondary__username,
+            publish__secondary__password=ci__push__publish__secondary__password,
+            publish__secondary__publish_url=ci__push__publish__secondary__publish_url,
             tag=ci__push__tag,
             tag__all=ci__push__tag__all,
+            token_checkout=ci__token_checkout,
+            token_github=ci__token_github,
             uv__native_tls=uv__native_tls,
         )
     if coverage:
@@ -288,11 +329,7 @@ def conformalize_repo(
         )
     if gitignore:
         add_gitignore(modifications=modifications)
-    if (
-        pyproject
-        or pyproject__project__optional_dependencies__scripts
-        or (len(pyproject__tool__uv__indexes) >= 1)
-    ):
+    if pyproject:
         add_pyproject_toml(
             modifications=modifications,
             python_version=python_version,
@@ -301,7 +338,7 @@ def conformalize_repo(
             readme=readme,
             optional_dependencies__scripts=pyproject__project__optional_dependencies__scripts,
             python_package_name=python_package_name,
-            tool__uv__indexes=pyproject__tool__uv__indexes,
+            uv__indexes=uv__indexes,
         )
     if pyright:
         add_pyrightconfig_json(
@@ -338,6 +375,7 @@ def conformalize_repo(
             ", ".join(map(repr_str, sorted(modifications))),
         )
         sys.exit(1)
+    LOGGER.info("Finished running %r", get_func_name(conformalize_repo))
 
 
 ##
@@ -351,11 +389,11 @@ def add_bumpversion_toml(
     python_package_name: str | None = SETTINGS.python_package_name,
 ) -> None:
     with yield_bumpversion_toml(modifications=modifications) as doc:
-        tool = get_table(doc, "tool")
-        bumpversion = get_table(tool, "bumpversion")
+        tool = get_set_table(doc, "tool")
+        bumpversion = get_set_table(tool, "bumpversion")
         if pyproject:
-            files = get_aot(bumpversion, "files")
-            ensure_aot_contains(
+            files = get_set_aot(bumpversion, "files")
+            ensure_contains(
                 files,
                 _add_bumpversion_toml_file(PYPROJECT_TOML, 'version = "${version}"'),
             )
@@ -364,8 +402,8 @@ def add_bumpversion_toml(
             package_name=package_name, python_package_name=python_package_name
         )
     ) is not None:
-        files = get_aot(bumpversion, "files")
-        ensure_aot_contains(
+        files = get_set_aot(bumpversion, "files")
+        ensure_contains(
             files,
             _add_bumpversion_toml_file(
                 f"src/{python_package_name_use}/__init__.py",
@@ -387,10 +425,9 @@ def _add_bumpversion_toml_file(path: PathLike, template: str, /) -> Table:
 
 def add_ci_pull_request_yaml(
     *,
-    certificates: bool = SETTINGS.ci__ca_certificates,
     gitea: bool = SETTINGS.ci__gitea,
-    token: str | None = SETTINGS.ci__token,
     modifications: MutableSet[Path] | None = None,
+    certificates: bool = SETTINGS.ci__certificates,
     pre_commit: bool = SETTINGS.ci__pull_request__pre_commit,
     pre_commit__submodules: str
     | None = SETTINGS.ci__pull_request__pre_commit__submodules,
@@ -399,76 +436,75 @@ def add_ci_pull_request_yaml(
     pytest__ubuntu: bool = SETTINGS.ci__pull_request__pytest__ubuntu,
     pytest__windows: bool = SETTINGS.ci__pull_request__pytest__windows,
     pytest__all_versions: bool = SETTINGS.ci__pull_request__pytest__all_versions,
-    pytest__sops_age_key: str | None = SETTINGS.ci__pull_request__pytest__sops_age_key,
+    pytest__sops_age_key: Secret[str]
+    | None = SETTINGS.ci__pull_request__pytest__sops_age_key,
     pytest__timeout: int | None = SETTINGS.pytest__timeout,
     python_version: str = SETTINGS.python_version,
     repo_name: str | None = SETTINGS.repo_name,
     ruff: bool = SETTINGS.ci__pull_request__ruff,
     script: str | None = SETTINGS.script,
+    token_checkout: Secret[str] | None = SETTINGS.ci__token_checkout,
+    token_github: Secret[str] | None = SETTINGS.ci__token_github,
     uv__native_tls: bool = SETTINGS.uv__native_tls,
 ) -> None:
     path = GITEA_PULL_REQUEST_YAML if gitea else GITHUB_PULL_REQUEST_YAML
     with yield_yaml_dict(path, modifications=modifications) as dict_:
         dict_["name"] = "pull-request"
-        on = get_dict(dict_, "on")
-        pull_request = get_dict(on, "pull_request")
-        branches = get_list(pull_request, "branches")
+        on = get_set_dict(dict_, "on")
+        pull_request = get_set_dict(on, "pull_request")
+        branches = get_set_list_strs(pull_request, "branches")
         ensure_contains(branches, "master")
-        schedule = get_list(on, "schedule")
+        schedule = get_set_list_dicts(on, "schedule")
         ensure_contains(schedule, {"cron": get_cron_job(repo_name=repo_name)})
-        jobs = get_dict(dict_, "jobs")
+        jobs = get_set_dict(dict_, "jobs")
         if pre_commit:
-            pre_commit_dict = get_dict(jobs, "pre-commit")
+            pre_commit_dict = get_set_dict(jobs, "pre-commit")
             pre_commit_dict["runs-on"] = "ubuntu-latest"
-            steps = get_list(pre_commit_dict, "steps")
+            steps = get_set_list_dicts(pre_commit_dict, "steps")
             if certificates:
                 ensure_contains(steps, update_ca_certificates_dict("pre-commit"))
             ensure_contains(
                 steps,
                 action_run_hooks_dict(
-                    token=token,
+                    token_checkout=token_checkout,
+                    token_github=token_github,
                     submodules=pre_commit__submodules,
-                    repos=["pre-commit/pre-commit-hooks"],
+                    repos=["dycw/actions", "pre-commit/pre-commit-hooks"],
                     gitea=gitea,
                 ),
             )
         if pyright:
-            pyright_dict = get_dict(jobs, "pyright")
+            pyright_dict = get_set_dict(jobs, "pyright")
             pyright_dict["runs-on"] = "ubuntu-latest"
-            steps = get_list(pyright_dict, "steps")
+            steps = get_set_list_dicts(pyright_dict, "steps")
             if certificates:
                 ensure_contains(steps, update_ca_certificates_dict("pyright"))
             ensure_contains(
                 steps,
                 action_pyright_dict(
-                    token=token,
+                    token_checkout=token_checkout,
+                    token_github=token_github,
                     python_version=python_version,
                     with_requirements=script,
                     native_tls=uv__native_tls,
                 ),
             )
-        if (
-            pytest__macos
-            or pytest__ubuntu
-            or pytest__windows
-            or (pytest__sops_age_key is not None)
-            or pytest__all_versions
-            or pytest__timeout
-        ):
-            pytest_dict = get_dict(jobs, "pytest")
-            env = get_dict(pytest_dict, "env")
+        if pytest__macos or pytest__ubuntu or pytest__windows:
+            pytest_dict = get_set_dict(jobs, "pytest")
+            env = get_set_dict(pytest_dict, "env")
             env["CI"] = "1"
             pytest_dict["name"] = (
                 "pytest (${{matrix.os}}, ${{matrix.python-version}}, ${{matrix.resolution}})"
             )
             pytest_dict["runs-on"] = "${{matrix.os}}"
-            steps = get_list(pytest_dict, "steps")
+            steps = get_set_list_dicts(pytest_dict, "steps")
             if certificates:
                 ensure_contains(steps, update_ca_certificates_dict("pytest"))
             ensure_contains(
                 steps,
                 action_pytest_dict(
-                    token=token,
+                    token_checkout=token_checkout,
+                    token_github=token_github,
                     python_version="${{matrix.python-version}}",
                     sops_age_key=pytest__sops_age_key,
                     resolution="${{matrix.resolution}}",
@@ -476,34 +512,39 @@ def add_ci_pull_request_yaml(
                     with_requirements=script,
                 ),
             )
-            strategy_dict = get_dict(pytest_dict, "strategy")
+            strategy_dict = get_set_dict(pytest_dict, "strategy")
             strategy_dict["fail-fast"] = False
-            matrix = get_dict(strategy_dict, "matrix")
-            os = get_list(matrix, "os")
+            matrix = get_set_dict(strategy_dict, "matrix")
+            os = get_set_list_strs(matrix, "os")
             if pytest__macos:
                 ensure_contains(os, "macos-latest")
             if pytest__ubuntu:
                 ensure_contains(os, "ubuntu-latest")
             if pytest__windows:
                 ensure_contains(os, "windows-latest")
-            python_version_dict = get_list(matrix, "python-version")
+            python_version_dict = get_set_list_strs(matrix, "python-version")
             if pytest__all_versions:
                 ensure_contains(
                     python_version_dict, *yield_python_versions(python_version)
                 )
             else:
                 ensure_contains(python_version_dict, python_version)
-            resolution = get_list(matrix, "resolution")
+            resolution = get_set_list_strs(matrix, "resolution")
             ensure_contains(resolution, "highest", "lowest-direct")
             if pytest__timeout is not None:
                 pytest_dict["timeout-minutes"] = max(round(pytest__timeout / 60), 1)
         if ruff:
-            ruff_dict = get_dict(jobs, "ruff")
+            ruff_dict = get_set_dict(jobs, "ruff")
             ruff_dict["runs-on"] = "ubuntu-latest"
-            steps = get_list(ruff_dict, "steps")
+            steps = get_set_list_dicts(ruff_dict, "steps")
             if certificates:
                 ensure_contains(steps, update_ca_certificates_dict("steps"))
-            ensure_contains(steps, action_ruff_dict(token=token))
+            ensure_contains(
+                steps,
+                action_ruff_dict(
+                    token_checkout=token_checkout, token_github=token_github
+                ),
+            )
 
 
 ##
@@ -511,50 +552,76 @@ def add_ci_pull_request_yaml(
 
 def add_ci_push_yaml(
     *,
-    certificates: bool = SETTINGS.ci__ca_certificates,
     gitea: bool = SETTINGS.ci__gitea,
-    token: str | None = SETTINGS.ci__token,
     modifications: MutableSet[Path] | None = None,
-    publish: bool = SETTINGS.ci__push__publish,
-    publish__username: str | None = SETTINGS.ci__push__publish__username,
-    publish__password: Secret[str] | None = SETTINGS.ci__push__publish__password,
-    publish__publish_url: Secret[str] | None = SETTINGS.ci__push__publish__publish_url,
+    certificates: bool = SETTINGS.ci__certificates,
+    publish__github: bool = SETTINGS.ci__push__publish__github,
+    publish__primary: bool = SETTINGS.ci__push__publish__primary,
+    publish__primary__job_name: str = SETTINGS.ci__push__publish__primary__job_name,
+    publish__primary__username: str
+    | None = SETTINGS.ci__push__publish__primary__username,
+    publish__primary__password: Secret[str]
+    | None = SETTINGS.ci__push__publish__primary__password,
+    publish__primary__publish_url: str
+    | None = SETTINGS.ci__push__publish__primary__publish_url,
+    publish__secondary: bool = SETTINGS.ci__push__publish__secondary,
+    publish__secondary__job_name: str = SETTINGS.ci__push__publish__secondary__job_name,
+    publish__secondary__username: str
+    | None = SETTINGS.ci__push__publish__secondary__username,
+    publish__secondary__password: Secret[str]
+    | None = SETTINGS.ci__push__publish__secondary__password,
+    publish__secondary__publish_url: str
+    | None = SETTINGS.ci__push__publish__secondary__publish_url,
     tag: bool = SETTINGS.ci__push__tag,
     tag__all: bool = SETTINGS.ci__push__tag__all,
+    token_checkout: Secret[str] | None = SETTINGS.ci__token_checkout,
+    token_github: Secret[str] | None = SETTINGS.ci__token_github,
     uv__native_tls: bool = SETTINGS.uv__native_tls,
 ) -> None:
     path = GITEA_PUSH_YAML if gitea else GITHUB_PUSH_YAML
     with yield_yaml_dict(path, modifications=modifications) as dict_:
         dict_["name"] = "push"
-        on = get_dict(dict_, "on")
-        push = get_dict(on, "push")
-        branches = get_list(push, "branches")
+        on = get_set_dict(dict_, "on")
+        push = get_set_dict(on, "push")
+        branches = get_set_list_strs(push, "branches")
         ensure_contains(branches, "master")
-        jobs = get_dict(dict_, "jobs")
-        if publish:
-            publish_dict = get_dict(jobs, "publish")
-            environment = get_dict(publish_dict, "environment")
-            environment["name"] = "pypi"
-            permissions = get_dict(publish_dict, "permissions")
-            permissions["id-token"] = "write"
-            publish_dict["runs-on"] = "ubuntu-latest"
-            steps = get_list(publish_dict, "steps")
-            if certificates:
-                ensure_contains(steps, update_ca_certificates_dict("publish"))
-            ensure_contains(
-                steps,
-                action_publish_package_dict(
-                    token=token,
-                    username=publish__username,
-                    password=publish__password,
-                    publish_url=publish__publish_url,
-                    native_tls=uv__native_tls,
-                ),
+        jobs = get_set_dict(dict_, "jobs")
+        if publish__github:
+            _add_ci_push_yaml_publish_dict(
+                jobs,
+                "github",
+                github=True,
+                token_checkout=token_checkout,
+                token_github=token_github,
+            )
+        if publish__primary:
+            _add_ci_push_yaml_publish_dict(
+                jobs,
+                publish__primary__job_name,
+                certificates=certificates,
+                token_checkout=token_checkout,
+                token_github=token_github,
+                username=publish__primary__username,
+                password=publish__primary__password,
+                publish_url=publish__primary__publish_url,
+                uv__native_tls=uv__native_tls,
+            )
+        if publish__secondary:
+            _add_ci_push_yaml_publish_dict(
+                jobs,
+                publish__secondary__job_name,
+                certificates=certificates,
+                token_checkout=token_checkout,
+                token_github=token_github,
+                username=publish__secondary__username,
+                password=publish__secondary__password,
+                publish_url=publish__secondary__publish_url,
+                uv__native_tls=uv__native_tls,
             )
         if tag:
-            tag_dict = get_dict(jobs, "tag")
+            tag_dict = get_set_dict(jobs, "tag")
             tag_dict["runs-on"] = "ubuntu-latest"
-            steps = get_list(tag_dict, "steps")
+            steps = get_set_list_dicts(tag_dict, "steps")
             if certificates:
                 ensure_contains(steps, update_ca_certificates_dict("tag"))
             ensure_contains(
@@ -565,20 +632,58 @@ def add_ci_push_yaml(
             )
 
 
+def _add_ci_push_yaml_publish_dict(
+    jobs: StrDict,
+    name: str,
+    /,
+    *,
+    github: bool = False,
+    certificates: bool = SETTINGS.ci__certificates,
+    token_checkout: Secret[str] | None = SETTINGS.ci__token_checkout,
+    token_github: Secret[str] | None = SETTINGS.ci__token_github,
+    username: str | None = None,
+    password: Secret[str] | None = None,
+    publish_url: str | None = None,
+    uv__native_tls: bool = SETTINGS.uv__native_tls,
+) -> None:
+    publish_name = f"publish-{name}"
+    publish_dict = get_set_dict(jobs, publish_name)
+    if github:
+        environment = get_set_dict(publish_dict, "environment")
+        environment["name"] = "pypi"
+        permissions = get_set_dict(publish_dict, "permissions")
+        permissions["id-token"] = "write"
+    publish_dict["runs-on"] = "ubuntu-latest"
+    steps = get_set_list_dicts(publish_dict, "steps")
+    if certificates:
+        ensure_contains(steps, update_ca_certificates_dict(publish_name))
+    ensure_contains(
+        steps,
+        action_publish_package_dict(
+            token_checkout=token_checkout,
+            token_github=token_github,
+            username=username,
+            password=password,
+            publish_url=publish_url,
+            native_tls=uv__native_tls,
+        ),
+    )
+
+
 ##
 
 
 def add_coveragerc_toml(*, modifications: MutableSet[Path] | None = None) -> None:
     with yield_toml_doc(COVERAGERC_TOML, modifications=modifications) as doc:
-        html = get_table(doc, "html")
+        html = get_set_table(doc, "html")
         html["directory"] = ".coverage/html"
-        report = get_table(doc, "report")
-        exclude_also = get_array(report, "exclude_also")
+        report = get_set_table(doc, "report")
+        exclude_also = get_set_array(report, "exclude_also")
         ensure_contains(exclude_also, "@overload", "if TYPE_CHECKING:")
         report["fail_under"] = 100.0
         report["skip_covered"] = True
         report["skip_empty"] = True
-        run = get_table(doc, "run")
+        run = get_set_table(doc, "run")
         run["branch"] = True
         run["data_file"] = ".coverage/data"
         run["parallel"] = True
@@ -615,7 +720,7 @@ def add_envrc(
                 native_tls=uv__native_tls, python_version=python_version, script=script
             )
             if search(escape(uv_text), context.output, flags=MULTILINE) is None:
-                context.output += f"\n\n{echo}"
+                context.output += f"\n\n{uv_text}"
 
 
 def _add_envrc_uv_text(
@@ -636,14 +741,15 @@ def _add_envrc_uv_text(
         strip_and_dedent(f"""
             export UV_PRERELEASE='disallow'
             export UV_PYTHON='{python_version}'
+            export UV_VENV_CLEAR=1
             if ! command -v uv >/dev/null 2>&1; then
-                echo_date "ERROR: 'uv' not found" && exit 1
+            \techo_date "ERROR: 'uv' not found" && exit 1
             fi
             activate='.venv/bin/activate'
             if [ -f $activate ]; then
-                . $activate
+            \t. $activate
             else
-                uv venv
+            \tuv venv
             fi
         """)
     )
@@ -681,6 +787,8 @@ def add_pre_commit_config_yaml(
     taplo: bool = SETTINGS.pre_commit__taplo,
     uv: bool = SETTINGS.pre_commit__uv,
     script: str | None = SETTINGS.script,
+    uv__indexes: list[tuple[str, str]] = SETTINGS.uv__indexes,
+    uv__native_tls: bool = SETTINGS.uv__native_tls,
 ) -> None:
     with yield_yaml_dict(PRE_COMMIT_CONFIG_YAML, modifications=modifications) as dict_:
         _add_pre_commit_config_repo(dict_, ACTIONS_URL, CONFORMALIZE_REPO_SUB_CMD)
@@ -728,7 +836,17 @@ def add_pre_commit_config_yaml(
             )
             _add_pre_commit_config_repo(dict_, ACTIONS_URL, TOUCH_EMPTY_PY_SUB_CMD)
             _add_pre_commit_config_repo(dict_, ACTIONS_URL, TOUCH_PY_TYPED_SUB_CMD)
-            _add_pre_commit_config_repo(dict_, ACTIONS_URL, UPDATE_REQUIREMENTS_SUB_CMD)
+            args: list[str] = []
+            if len(uv__indexes) >= 1:
+                args.extend(["--index", ",".join(v for _, v in uv__indexes)])
+            if uv__native_tls:
+                args.append("--native-tls")
+            _add_pre_commit_config_repo(
+                dict_,
+                ACTIONS_URL,
+                UPDATE_REQUIREMENTS_SUB_CMD,
+                args=("add", args) if len(args) >= 1 else None,
+            )
         if ruff:
             _add_pre_commit_config_repo(
                 dict_, RUFF_URL, "ruff-check", args=("add", ["--fix"])
@@ -755,16 +873,21 @@ def add_pre_commit_config_yaml(
                 ),
             )
         if uv:
+            args: list[str] = [
+                "--upgrade",
+                "--resolution",
+                "highest",
+                "--prerelease",
+                "disallow",
+            ]
+            if script is not None:
+                args.extend(["--script", script])
             _add_pre_commit_config_repo(
                 dict_,
                 UV_URL,
                 "uv-lock",
                 files=None if script is None else rf"^{escape(script)}$",
-                args=(
-                    "add",
-                    ["--upgrade", "--resolution", "highest", "--prerelease", "disallow"]
-                    + ([] if script is None else [f"--script={script}"]),
-                ),
+                args=("add", args),
             )
 
 
@@ -781,11 +904,11 @@ def _add_pre_commit_config_repo(
     types_or: list[str] | None = None,
     args: tuple[Literal["add", "exact"], list[str]] | None = None,
 ) -> None:
-    repos_list = get_list(pre_commit_dict, "repos")
+    repos_list = get_set_list_dicts(pre_commit_dict, "repos")
     repo_dict = ensure_contains_partial_dict(
         repos_list, {"repo": url}, extra={} if url == "local" else {"rev": "master"}
     )
-    hooks_list = get_list(repo_dict, "hooks")
+    hooks_list = get_set_list_dicts(repo_dict, "hooks")
     hook_dict = ensure_contains_partial_dict(hooks_list, {"id": id_})
     if name is not None:
         hook_dict["name"] = name
@@ -800,7 +923,7 @@ def _add_pre_commit_config_repo(
     if args is not None:
         match args:
             case "add", list() as args_i:
-                hook_args = get_list(hook_dict, "args")
+                hook_args = get_set_list_strs(hook_dict, "args")
                 ensure_contains(hook_args, *args_i)
             case "exact", list() as args_i:
                 hook_dict["args"] = args_i
@@ -820,13 +943,13 @@ def add_pyproject_toml(
     readme: bool = SETTINGS.readme,
     optional_dependencies__scripts: bool = SETTINGS.pyproject__project__optional_dependencies__scripts,
     python_package_name: str | None = SETTINGS.python_package_name,
-    tool__uv__indexes: list[tuple[str, str]] = SETTINGS.pyproject__tool__uv__indexes,
+    uv__indexes: list[tuple[str, str]] = SETTINGS.uv__indexes,
 ) -> None:
-    with yield_toml_doc(PYPROJECT_TOML, modifications=modifications) as doc:
-        build_system = get_table(doc, "build-system")
+    with yield_pyproject_toml(modifications=modifications) as doc:
+        build_system = get_set_table(doc, "build-system")
         build_system["build-backend"] = "uv_build"
         build_system["requires"] = ["uv_build"]
-        project = get_table(doc, "project")
+        project = get_set_table(doc, "project")
         project["requires-python"] = f">= {python_version}"
         if description is not None:
             project["description"] = description
@@ -835,33 +958,31 @@ def add_pyproject_toml(
         if readme:
             project["readme"] = "README.md"
         project.setdefault("version", "0.1.0")
-        dependency_groups = get_table(doc, "dependency-groups")
-        dev = get_array(dependency_groups, "dev")
+        dependency_groups = get_set_table(doc, "dependency-groups")
+        dev = get_set_array(dependency_groups, "dev")
         _ = ensure_contains_partial_str(dev, "dycw-utilities[test]")
         _ = ensure_contains_partial_str(dev, "pyright")
         _ = ensure_contains_partial_str(dev, "rich")
         if optional_dependencies__scripts:
-            optional_dependencies = get_table(project, "optional-dependencies")
-            scripts = get_array(optional_dependencies, "scripts")
+            optional_dependencies = get_set_table(project, "optional-dependencies")
+            scripts = get_set_array(optional_dependencies, "scripts")
             _ = ensure_contains_partial_str(scripts, "click")
         if python_package_name is not None:
-            tool = get_table(doc, "tool")
-            uv = get_table(tool, "uv")
-            build_backend = get_table(uv, "build-backend")
+            uv = get_tool_uv(doc)
+            build_backend = get_set_table(uv, "build-backend")
             build_backend["module-name"] = get_python_package_name(
                 package_name=package_name, python_package_name=python_package_name
             )
             build_backend["module-root"] = "src"
-        if len(tool__uv__indexes) >= 1:
-            tool = get_table(doc, "tool")
-            uv = get_table(tool, "uv")
-            indexes = get_aot(uv, "index")
-            for name, url in tool__uv__indexes:
+        if len(uv__indexes) >= 1:
+            uv = get_tool_uv(doc)
+            indexes = get_set_aot(uv, "index")
+            for name, url in uv__indexes:
                 index = table()
                 index["explicit"] = True
                 index["name"] = name
                 index["url"] = url
-                ensure_aot_contains(indexes, index)
+                ensure_contains(indexes, index)
 
 
 ##
@@ -876,7 +997,7 @@ def add_pyrightconfig_json(
     with yield_json_dict(PYRIGHTCONFIG_JSON, modifications=modifications) as dict_:
         dict_["deprecateTypingAliases"] = True
         dict_["enableReachabilityAnalysis"] = False
-        include = get_list(dict_, "include")
+        include = get_set_list_strs(dict_, "include")
         ensure_contains(include, "src" if script is None else script)
         dict_["pythonVersion"] = python_version
         dict_["reportCallInDefaultInitializer"] = True
@@ -917,8 +1038,8 @@ def add_pytest_toml(
     script: str | None = SETTINGS.script,
 ) -> None:
     with yield_toml_doc(PYTEST_TOML, modifications=modifications) as doc:
-        pytest = get_table(doc, "pytest")
-        addopts = get_array(pytest, "addopts")
+        pytest = get_set_table(doc, "pytest")
+        addopts = get_set_array(pytest, "addopts")
         ensure_contains(
             addopts,
             "-ra",
@@ -943,18 +1064,18 @@ def add_pytest_toml(
             )
         pytest["collect_imported_tests"] = False
         pytest["empty_parameter_set_mark"] = "fail_at_collect"
-        filterwarnings = get_array(pytest, "filterwarnings")
+        filterwarnings = get_set_array(pytest, "filterwarnings")
         ensure_contains(filterwarnings, "error")
         pytest["minversion"] = "9.0"
         pytest["strict"] = True
-        testpaths = get_array(pytest, "testpaths")
+        testpaths = get_set_array(pytest, "testpaths")
         ensure_contains(testpaths, "src/tests" if script is None else "tests")
         pytest["xfail_strict"] = True
         if asyncio:
             pytest["asyncio_default_fixture_loop_scope"] = "function"
             pytest["asyncio_mode"] = "auto"
         if ignore_warnings:
-            filterwarnings = get_array(pytest, "filterwarnings")
+            filterwarnings = get_set_array(pytest, "filterwarnings")
             ensure_contains(
                 filterwarnings,
                 "ignore::DeprecationWarning",
@@ -996,14 +1117,14 @@ def add_ruff_toml(
     with yield_toml_doc(RUFF_TOML, modifications=modifications) as doc:
         doc["target-version"] = f"py{python_version.replace('.', '')}"
         doc["unsafe-fixes"] = True
-        fmt = get_table(doc, "format")
+        fmt = get_set_table(doc, "format")
         fmt["preview"] = True
         fmt["skip-magic-trailing-comma"] = True
-        lint = get_table(doc, "lint")
+        lint = get_set_table(doc, "lint")
         lint["explicit-preview-rules"] = True
-        fixable = get_array(lint, "fixable")
+        fixable = get_set_array(lint, "fixable")
         ensure_contains(fixable, "ALL")
-        ignore = get_array(lint, "ignore")
+        ignore = get_set_array(lint, "ignore")
         ensure_contains(
             ignore,
             "ANN401",  # any-type
@@ -1044,27 +1165,27 @@ def add_ruff_toml(
             "ISC002",  # multi-line-implicit-string-concatenation
         )
         lint["preview"] = True
-        select = get_array(lint, "select")
+        select = get_set_array(lint, "select")
         selected_rules = [
             "RUF022",  # unsorted-dunder-all
             "RUF029",  # unused-async
         ]
         ensure_contains(select, "ALL", *selected_rules)
-        extend_per_file_ignores = get_table(lint, "extend-per-file-ignores")
-        test_py = get_array(extend_per_file_ignores, "test_*.py")
+        extend_per_file_ignores = get_set_table(lint, "extend-per-file-ignores")
+        test_py = get_set_array(extend_per_file_ignores, "test_*.py")
         test_py_rules = [
             "S101",  # assert
             "SLF001",  # private-member-access
         ]
         ensure_contains(test_py, *test_py_rules)
         ensure_not_contains(ignore, *selected_rules, *test_py_rules)
-        bugbear = get_table(lint, "flake8-bugbear")
-        extend_immutable_calls = get_array(bugbear, "extend-immutable-calls")
+        bugbear = get_set_table(lint, "flake8-bugbear")
+        extend_immutable_calls = get_set_array(bugbear, "extend-immutable-calls")
         ensure_contains(extend_immutable_calls, "typing.cast")
-        tidy_imports = get_table(lint, "flake8-tidy-imports")
+        tidy_imports = get_set_table(lint, "flake8-tidy-imports")
         tidy_imports["ban-relative-imports"] = "all"
-        isort = get_table(lint, "isort")
-        req_imps = get_array(isort, "required-imports")
+        isort = get_set_table(lint, "isort")
+        req_imps = get_set_array(isort, "required-imports")
         ensure_contains(req_imps, "from __future__ import annotations")
         isort["split-on-trailing-comma"] = False
 
@@ -1113,13 +1234,21 @@ def get_python_package_name(
 ##
 
 
+def get_tool_uv(doc: TOMLDocument, /) -> Table:
+    tool = get_set_table(doc, "tool")
+    return get_set_table(tool, "uv")
+
+
+##
+
+
 def get_version_from_bumpversion_toml(
     *, obj: TOMLDocument | str | None = None
 ) -> Version:
     match obj:
         case TOMLDocument() as doc:
-            tool = get_table(doc, "tool")
-            bumpversion = get_table(tool, "bumpversion")
+            tool = get_set_table(doc, "tool")
+            bumpversion = get_set_table(tool, "bumpversion")
             return parse_version(str(bumpversion["current_version"]))
         case str() as text:
             return get_version_from_bumpversion_toml(obj=tomlkit.parse(text))
@@ -1179,7 +1308,7 @@ def _run_pre_commit_update(*, modifications: MutableSet[Path] | None = None) ->
 
 
 run_pre_commit_update = throttle(
-    delta=THROTTLE_DELTA, path=path_throttle_cache(_run_pre_commit_update)
+    duration=THROTTLE_DURATION, path=path_throttle_cache(_run_pre_commit_update)
 )(_run_pre_commit_update)
 
 
@@ -1245,7 +1374,7 @@ def update_action_file_extensions(
 
 def update_action_versions(*, modifications: MutableSet[Path] | None = None) -> None:
     try:
-        paths = list(Path(".github").rglob("**/*.yaml"))
+        paths = list(GITHUB.rglob("**/*.yaml"))
     except FileNotFoundError:
         return
     versions = {
@@ -1274,8 +1403,8 @@ def yield_bumpversion_toml(
     *, modifications: MutableSet[Path] | None = None
 ) -> Iterator[TOMLDocument]:
     with yield_toml_doc(BUMPVERSION_TOML, modifications=modifications) as doc:
-        tool = get_table(doc, "tool")
-        bumpversion = get_table(tool, "bumpversion")
+        tool = get_set_table(doc, "tool")
+        bumpversion = get_set_table(tool, "bumpversion")
         bumpversion["allow_dirty"] = True
         bumpversion.setdefault("current_version", str(Version(0, 1, 0)))
         yield doc
@@ -1323,6 +1452,7 @@ __all__ = [
     "check_versions",
     "get_cron_job",
     "get_python_package_name",
+    "get_tool_uv",
     "get_version_from_bumpversion_toml",
     "get_version_from_git_show",
     "get_version_from_git_tag",