saltext.github 1.0.0__tar.gz → 1.1.0__tar.gz

saltext_github-1.1.0/.codecov.yml

@@ -0,0 +1,25 @@
+---
+coverage:
+  status:
+    project:
+      default: false
+      app:
+        informational: true
+        paths:
+          - src/
+      tests:
+        informational: true
+        paths:
+          - tests/
+    patch:
+      default: false
+      app:
+        informational: true
+        paths:
+          - src/
+      tests:
+        informational: true
+        paths:
+          - tests/
+github_checks:
+  annotations: false

{saltext_github-1.0.0 → saltext_github-1.1.0}/.copier-answers.yml

@@ -1,6 +1,6 @@
 # Autogenerated. Do not edit this by hand, use `copier update`.
 ---
-_commit: 0.3.7
+_commit: 0.11.0
 _src_path: https://github.com/lkubb/salt-extension-copier
 author: EITR Technologies, LLC
 author_email: devops@eitr.tech
@@ -10,19 +10,31 @@ deploy_docs: rolling
 docs_url: https://salt-extensions.github.io/saltext-github/
 integration_name: GitHub
 license: apache
+linux_test_distros:
+  - Ubuntu
 loaders:
   - module
+  - resource
   - state
-max_salt_version: 3007
+max_salt_version: '3008'
 no_saltext_namespace: false
+os_support:
+  - Linux
+  - macOS
+  - Windows
 package_name: github
 project_name: github
-python_requires: '3.8'
-salt_version: '3005'
+push_secret: ''
+python_requires: '3.11'
+relax_pylint: false
+salt_version: '3006'
 source_url: https://github.com/salt-extensions/saltext-github
 ssh_fixtures: false
 summary: Salt Extension for interacting with GitHub
 test_containers: false
 tracker_url: https://github.com/salt-extensions/saltext-github/issues
+typing: false
+ubuntu_releases:
+  - '26.04'
 url: https://github.com/salt-extensions/saltext-github
-workflows: org
+venv_python: '3.14'

saltext_github-1.1.0/.envrc.example

@@ -0,0 +1,31 @@
+layout_saltext() {
+    # --skip-install only installs the project when the venv is freshly
+    # created or pyproject.toml changed since the last install.
+    # Run `make dev` to force a full synchronization.
+    VIRTUAL_ENV="$(python3 tools/initialize.py --skip-install --print-venv)"
+    PATH_add "$VIRTUAL_ENV/bin"
+    export VIRTUAL_ENV
+}
+
+# Uncomment to override the Python version for the development venv,
+# e.g. when the configured `venv_python` is hard to come by locally:
+# export VENV_PYTHON=3.13
+
+# Uncomment to inherit system-wide packages in the development venvs,
+# e.g. when dependencies are only available as system packages:
+# export VENV_SYSTEM_SITE_PACKAGES=1
+
+# Uncomment to skip the actionlint hook locally when it cannot be built,
+# e.g. for lack of a Go toolchain. It still runs in CI. Multiple hooks
+# can be specified as a comma-separated list. Other candidates for skipping
+# on specific platforms are:
+#   * ty: Only auto-installed on Windows/Linux/macOS. On other platforms,
+#     requires a locally installed `uv` binary and Rust toolchain since
+#     no binary wheels are available for them.
+#   * zizmor: Only required on Windows/Linux/macOS, other platforms skip it
+#     automatically when not installed via external means.
+#     Requires a Rust toolchain in case no binary wheels are available for
+#     the architecture an otherwise supported OS runs on.
+# export SKIP=actionlint
+
+layout_saltext

{saltext_github-1.0.0 → saltext_github-1.1.0}/.github/ISSUE_TEMPLATE/config.yml

@@ -10,5 +10,5 @@ contact_links:
     url: https://web.libera.chat/#salt
     about: Please ask and answer questions here.
   - name: Security vulnerabilities
-    email: saltproject-security.pdl@broadcom.com
-    about: Please report security vulnerabilities here.
+    url: https://github.com/saltstack/salt/blob/master/SECURITY.md
+    about: Please report security vulnerabilities to saltproject-security.pdl@broadcom.com.

{saltext_github-1.0.0 → saltext_github-1.1.0}/.github/PULL_REQUEST_TEMPLATE.md

@@ -10,10 +10,10 @@ Remove this section if not relevant
 Remove this section if not relevant
 
 ### Merge requirements satisfied?
-**[NOTICE] Bug fixes or features added to Salt require tests.**
-<!-- Please review the [test documentation](https://docs.saltproject.io/en/master/topics/tutorials/writing_tests.html) for details on how to implement tests into Salt's test suite. -->
+**[NOTICE] Bug fixes or new features require tests.**
+<!-- Please review the [salt-extensions](https://salt-extensions.github.io/salt-extension-copier/topics/testing/writing.html) and [Salt test documentation](https://docs.saltproject.io/en/master/topics/tutorials/writing_tests.html) for details on how to implement tests for your changes. -->
 - [ ] Docs
-- [ ] Changelog - https://docs.saltproject.io/en/master/topics/development/changelog.html
+- [ ] Changelog - https://salt-extensions.github.io/salt-extension-copier/topics/documenting/changelog.html#procedure
 - [ ] Tests written/updated
 
 ### Commits signed with GPG?

saltext_github-1.1.0/.github/actions/upload-exitstatus/action.yml

@@ -0,0 +1,33 @@
+---
+name: upload-exitstatus
+description: Upload a job's status as an artifact
+inputs:
+  artifact_prefix:
+    required: false
+    default: exitstatus-
+  name:
+    required: false
+    default: ''
+
+runs:
+  using: composite
+
+  steps:
+
+      - name: Set Exit Status
+        if: ${{ !cancelled() }}
+        env:
+          JOB_STATUS: ${{ job.status }}
+          OUTFILE: exitstatus/${{ inputs.name == '' && github.job || inputs.name }}
+        shell: bash
+        run: |
+          mkdir exitstatus
+          echo "${JOB_STATUS}" > "$OUTFILE"
+
+      - name: Upload Exit Status
+        if: ${{ !cancelled() }}
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7.0.2
+        with:
+          name: ${{ inputs.artifact_prefix }}${{ inputs.name == '' && github.job || inputs.name }}
+          path: exitstatus
+          if-no-files-found: error

saltext_github-1.1.0/.github/workflows/ci.yml

@@ -0,0 +1,64 @@
+---
+name: CI
+
+on:
+  workflow_call:
+    inputs:
+      checkout-ref:
+        required: false
+        type: string
+        default: ''
+
+permissions: {}
+
+jobs:
+  get-changed-files:
+    name: Get Changed Files
+    uses: $/.github/workflows/get-changed-files.yml
+    with:
+      checkout-ref: ${{ inputs.checkout-ref || github.sha }}
+    permissions:
+      contents: read
+      pull-requests: read  # for dorny/paths-filter to read pull requests
+
+  pre-commit:
+    name: Pre-Commit
+    needs:
+      - get-changed-files
+    uses: $/.github/workflows/pre-commit-action.yml
+    with:
+      changed-files: ${{ needs.get-changed-files.outputs.changed-files }}
+      checkout-ref: ${{ inputs.checkout-ref || github.sha }}
+    permissions:
+      contents: read
+
+  test:
+    name: Test
+    needs:
+      - pre-commit
+    uses: $/.github/workflows/test-action.yml
+    with:
+      checkout-ref: ${{ inputs.checkout-ref || github.sha }}
+    permissions:
+      contents: read
+      id-token: write  # codecov uploads
+
+  docs:
+    name: Docs
+    needs:
+      - pre-commit
+    uses: $/.github/workflows/docs-action.yml
+    with:
+      checkout-ref: ${{ inputs.checkout-ref || github.sha }}
+    permissions:
+      contents: read
+
+  build-python-package:
+    name: Python Package
+    needs:
+      - pre-commit
+    uses: $/.github/workflows/package-action.yml
+    with:
+      checkout-ref: ${{ inputs.checkout-ref || github.sha }}
+    permissions:
+      contents: read

saltext_github-1.1.0/.github/workflows/clear-caches.yml

@@ -0,0 +1,36 @@
+---
+name: Clear Actions Caches
+
+on:
+  workflow_dispatch:
+    inputs:
+      key:
+        description: Only delete the cache with this key. Deletes all caches when empty.
+        required: false
+        type: string
+        default: ""
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions: {}
+
+jobs:
+  clear-caches:
+    name: Clear Actions Caches
+    runs-on: ubuntu-26.04
+    permissions:
+      actions: write  # Delete caches
+
+    steps:
+      - name: Clear caches
+        env:
+          GH_TOKEN: ${{ github.token }}
+          KEY: ${{ inputs.key }}
+        run: |
+          if [ -n "$KEY" ]; then
+            gh cache delete --repo "$GITHUB_REPOSITORY" -- "$KEY"
+          else
+            gh cache delete --repo "$GITHUB_REPOSITORY" --all --succeed-on-no-caches
+          fi

saltext_github-1.1.0/.github/workflows/deploy-docs-action.yml

@@ -0,0 +1,85 @@
+---
+name: Publish Documentation
+
+on:
+  workflow_call:
+    inputs:
+      # This is the name of the regular artifact that should
+      # be transformed into a GitHub Pages deployment.
+      artifact-name:
+        type: string
+        required: false
+        default: html-docs
+      # The workflow run that hosts the docs artifact. Defaults to
+      # the triggering run (`workflow_run` trigger) or the current one.
+      run-id:
+        type: string
+        required: false
+        default: ''
+
+
+permissions: {}
+
+jobs:
+
+  # The released docs are not versioned currently, only the latest ones are deployed.
+  #
+  # Versioning support would require either (better):
+  #   * Rebuilding docs for all versions when a new release is made
+  #   * Version selector support in `furo`: https://github.com/pradyunsg/furo/pull/500
+  #
+  # or (more basic):
+  #   * using the `gh-pages` branch and peaceiris/actions-gh-pages
+  #     to be able to deploy to subdirectories. The implementation via
+  #     actions/deploy-pages always replaces the directory root.
+
+  Deploy-Docs-GH-Pages:
+    name: Publish Docs to GitHub Pages
+
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+
+    permissions:
+      actions: read    # Download artifacts of other runs when called via workflow_run trigger
+      id-token: write  # Pages deployment
+      pages: write     # Pages deployment
+
+    runs-on: ubuntu-26.04
+
+    steps:
+
+      - name: Download built docs
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333  # v8.0.2
+        with:
+          name: ${{ inputs.artifact-name }}
+          path: html-docs
+          github-token: ${{ github.token }}
+          run-id: ${{ inputs.run-id || github.event_name == 'workflow_run' && github.event.workflow_run.id || github.run_id }}
+
+      - name: Upload GitHub Pages artifact
+        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9  # v5.0.0
+        with:
+          name: html-docs-pages
+          path: html-docs
+
+      - name: Deploy to GitHub Pages
+        id: deployment
+        uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346  # v5.0.1
+        with:
+          artifact_name: html-docs-pages
+
+      - name: Delete GitHub Pages artifact
+        if: ${{ !cancelled() }}
+        uses: geekyeggo/delete-artifact@176a747ab7e287e3ff4787bf8a148716375ca118  # v6.0.0
+        with:
+          name: html-docs-pages
+          failOnError: false
+
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Upload Exit Status
+        if: ${{ !cancelled() }}
+        uses: $/.github/actions/upload-exitstatus

saltext_github-1.1.0/.github/workflows/deploy-package-action.yml

@@ -0,0 +1,211 @@
+# Publishes verified Python distributions to PyPI.
+#
+# This workflow is registered as the PyPI Trusted Publisher.
+# Any job in this file with `id-token: write` and the configured
+# environment can potentially obtain PyPI publishing credentials.
+#
+# Only the publish job receives OIDC permissions.
+# No repository code is executed in the publishing job.
+#
+# The triggering workflow must be initiate-release.yml, which
+# independently authorizes releases and builds the artifacts.
+# `workflow_run` workflows always execute the default branch's
+# definition and artifacts can only be uploaded by a run itself,
+# so verifying the triggering run's identity (path + event) makes
+# its artifacts trustworthy.
+---
+name: Release Salt Extension Python Package
+
+on:
+  # zizmor: ignore[dangerous-triggers]
+  # `workflow_run` selects triggering runs by display name only, which a pull
+  # request can claim by adding a `pull_request`-triggered workflow of the same
+  # name. The trigger alone therefore grants no trust - the `verify` job below
+  # verifies the triggering run's provenance before anything is touched.
+  workflow_run:
+    types:
+      - completed
+    workflows:
+      - Initiate Release
+
+concurrency:
+  group: ${{ github.workflow }}
+  cancel-in-progress: false
+  queue: max
+
+cache-mode: none
+permissions: {}
+
+jobs:
+  verify:
+    name: Verify release
+    runs-on: ubuntu-26.04
+
+    # Only accept successful runs of the actual release initiation workflow,
+    # identified by its file path and trigger, never by name alone. A pull
+    # request cannot forge the `workflow_run` event: such workflows only ever
+    # execute the default branch's definition.
+    if: >-
+      github.event.workflow_run.conclusion == 'success' &&
+      github.event.workflow_run.repository.full_name == github.repository &&
+      github.event.workflow_run.head_repository.full_name == github.repository &&
+      github.event.workflow_run.event == 'workflow_run' &&
+      github.event.workflow_run.path == '.github/workflows/initiate-release.yml' &&
+      github.event.workflow_run.head_branch == github.event.repository.default_branch
+
+    permissions:
+      actions: read   # List release artifacts and download them from different run
+      contents: read  # Resolve the release tag via the API
+
+    env:
+      GH_TOKEN: ${{ github.token }}
+      GH_REPO: ${{ github.repository }}
+      INITIATE_RUN_ID: ${{ github.event.workflow_run.id }}
+
+    outputs:
+      version: ${{ steps.manifest.outputs.version }}
+      commit: ${{ steps.manifest.outputs.commit }}
+      tag: ${{ steps.manifest.outputs.tag }}
+
+    steps:
+      # The triggering workflow also completes successfully when all its
+      # jobs were skipped, e.g. because it was triggered by an unrelated
+      # or unauthorized workflow run. In that case, there is no release.
+      - name: Check triggering workflow for release manifest
+        id: check
+        run: |
+          set -euo pipefail
+
+          artifacts="$(gh api --paginate \
+            "repos/${GH_REPO}/actions/runs/${INITIATE_RUN_ID}/artifacts?per_page=100" \
+            --jq '.artifacts[] | select(.expired == false).name')"
+
+          if grep -qx 'release-manifest' <<< "$artifacts"; then
+            echo "available=1" >> "$GITHUB_OUTPUT"
+          else
+            echo "available=0" >> "$GITHUB_OUTPUT"
+            echo "::notice::No release manifest found, assuming the triggering run did not initiate a release."
+          fi
+
+      - name: Download release manifest
+        if: steps.check.outputs.available == '1'
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333  # v8.0.2
+        with:
+          name: release-manifest
+          run-id: ${{ github.event.workflow_run.id }}
+          github-token: ${{ github.token }}
+          path: ${{ runner.temp }}/release
+
+      - name: Verify release manifest
+        if: steps.check.outputs.available == '1'
+        id: manifest
+        env:
+          MANIFEST: ${{ runner.temp }}/release/manifest.json
+        run: |
+          set -euo pipefail
+
+          # The manifest must describe a release initiated by the exact
+          # triggering run.
+          jq -e \
+            --arg repo "$GH_REPO" \
+            --argjson run_id "$INITIATE_RUN_ID" '
+            .schema_version == 1
+            and .repository == $repo
+            and .initiate_run_id == $run_id
+            and (.version | type == "string")
+            and (.tag | type == "string")
+            and (.commit | type == "string")
+          ' "$MANIFEST" > /dev/null
+
+          version="$(jq -er '.version' "$MANIFEST")"
+          tag="$(jq -er '.tag' "$MANIFEST")"
+          commit="$(jq -er '.commit' "$MANIFEST")"
+
+          # Validate release naming.
+          [[ "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]] || exit 1
+          [[ "$tag" == "v${version}" ]] || exit 1
+
+          # Require a complete commit SHA.
+          [[ "$commit" =~ ^[0-9a-f]{40}$ ]] || exit 1
+
+          # Retrieve the exact Git reference.
+          ref="$(gh api "repos/${GH_REPO}/git/ref/tags/${tag}")"
+
+          [[ "$(jq -r '.ref' <<< "$ref")" == "refs/tags/${tag}" ]] || {
+            echo "::error::Unexpected Git reference"
+            exit 1
+          }
+
+          sha="$(jq -er '.object.sha' <<< "$ref")"
+          type="$(jq -er '.object.type' <<< "$ref")"
+
+          # Dereference annotated tags.
+          for _ in 1 2 3 4; do
+            [[ "$type" == "tag" ]] || break
+
+            object="$(gh api "repos/${GH_REPO}/git/tags/${sha}")"
+            sha="$(jq -er '.object.sha' <<< "$object")"
+            type="$(jq -er '.object.type' <<< "$object")"
+          done
+
+          [[ "$type" == "commit" ]] || {
+            echo "::error::Release tag does not resolve to a commit"
+            exit 1
+          }
+
+          # The release tag must still reference the authorized commit.
+          [[ "$sha" == "$commit" ]] || {
+            echo "::error::Release tag has changed since initiation"
+            exit 1
+          }
+
+          echo "Verified release: $tag ($commit)"
+
+          {
+            echo "version=$version"
+            echo "tag=$tag"
+            echo "commit=$commit"
+          } >> "$GITHUB_OUTPUT"
+
+      - name: Upload release handoff
+        # Consumed by finalize-release.yml, which handles the
+        # remaining release steps after the packages were published.
+        if: steps.check.outputs.available == '1'
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7.0.2
+        with:
+          name: release-handoff
+          path: ${{ runner.temp }}/release/manifest.json
+          if-no-files-found: error
+
+  publish:
+    name: Publish to PyPI
+    needs: verify
+    runs-on: ubuntu-26.04
+    # Skip when the triggering workflow did not initiate a release.
+    if: needs.verify.outputs.version != ''
+
+    environment:
+      name: release
+      url: https://pypi.org/p/saltext.github
+
+    permissions:
+      actions: read    # Download artifact from the triggering run
+      id-token: write  # Trusted Publishing
+
+    steps:
+      - name: Download verified distributions
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333  # v8.0.2
+        with:
+          name: salt-extension-packages
+          run-id: ${{ github.event.workflow_run.id }}
+          github-token: ${{ github.token }}
+          path: dist/
+
+      - name: Publish distributions to PyPI
+        uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086  # v1.14.3
+        with:
+          attestations: true
+          verbose: ${{ runner.debug == '1' }}
+
+  # The GitHub release and the docs deployment run separately on
+  # `workflow_run` in finalize-release.yml.

saltext_github-1.1.0/.github/workflows/docs-action.yml

@@ -0,0 +1,103 @@
+---
+name: Build Documentation
+
+on:
+  workflow_call:
+    inputs:
+      checkout-ref:
+        required: false
+        type: string
+        default: ''
+      pages-artifact:
+        required: false
+        type: boolean
+        default: false
+      require-in-branch:
+        required: false
+        type: string
+        default: ''
+
+permissions:
+  contents: read
+
+jobs:
+  Docs:
+    name: Build Docs and Upload Artifact
+    runs-on: ubuntu-26.04
+    timeout-minutes: 10
+
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          ref: ${{ inputs.checkout-ref || github.sha }}
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Enforce ref being in branch
+        if: ${{ inputs.require-in-branch != '' }}
+        env:
+          BRANCH_NAME: ${{ inputs.require-in-branch }}
+          CHECK_REF: ${{ inputs.checkout-ref || github.sha }}
+        run: git merge-base --is-ancestor "$CHECK_REF" "origin/$BRANCH_NAME"
+
+      - name: Set up Python 3.14 For Nox
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0  # v7.1.0
+        with:
+          python-version: "3.14"
+
+      - name: Install Nox
+        run: |
+          pip install "nox==${NOX_VERSION}" "uv==${UV_VERSION}"
+        env:
+          NOX_VERSION: '2026.10.20'
+          UV_VERSION: '0.13.5'
+
+      - name: Install Doc Requirements
+        run: |
+          nox --force-color -e docs --install-only
+
+      - name: Build Docs
+        env:
+          SKIP_REQUIREMENTS_INSTALL: '1'
+        run: |
+          nox --force-color -e docs
+
+      # Create a Pages-compatible artifact if we're going to deploy it
+      - name: Package documentation
+        if: inputs.pages-artifact
+        env:
+          DOCS_DIR: ${{ github.workspace }}/docs/_build/html
+        run: |
+          set -euo pipefail
+
+          test -f "$DOCS_DIR/index.html"
+          mkdir -p "$RUNNER_TEMP/docs"
+          tar \
+            --dereference \
+            --hard-dereference \
+            --directory "$DOCS_DIR" \
+            --exclude=.git \
+            --exclude=.github \
+            --exclude='.[^/]*' \
+            -cf "$RUNNER_TEMP/docs/artifact.tar" \
+            .
+
+      - name: Upload built docs as Pages artifact
+        if: inputs.pages-artifact
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7.0.2
+        with:
+          name: html-docs
+          path: ${{ runner.temp }}/docs/artifact.tar
+          if-no-files-found: error
+          retention-days: 7
+
+      - name: Upload built docs as artifact
+        if: ${{ !inputs.pages-artifact }}
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7.0.2
+        with:
+          name: html-docs
+          path: docs/_build/html
+
+      - name: Upload Exit Status
+        if: ${{ !cancelled() }}
+        uses: $/.github/actions/upload-exitstatus