Skip to content

Commit 0c27393

Browse files
dipakparmardipakparmar
authored
DEVOPS-781 refactor: clariti cumulusCI fork setup and release infrastructure (#16)
* DEVOPS-781 feat: add local GitHub Actions testing support with example secrets and vars files * DEVOPS-781 chore: update package-ecosystem in dependabot configuration from pip to uv * DEVOPS-781 chore: update setup-uv action references to use astral-sh/setup-uv@v5 * DEVOPS-781 docs: update documentation links to point to Clariti's GitHub Pages * DEVOPS-781 refactor: update references and version requirements for Clariti CumulusCI * DEVOPS-781 refactor: update project name and references to Clariti CumulusCI * DEVOPS-781 docs: add legal compliance and security documentation for Clariti CumulusCI * DEVOPS-781 docs: update CODEOWNERS and AUTHORS files for Clariti CumulusCI maintainers * DEVOPS-781 docs: update bug report template to clarify support options and improve documentation links * DEVOPS-781 docs: enhance AGENTS.md with local GitHub Actions testing instructions and key documentation references * DEVOPS-781 chore: remove outdated update_dependencies workflow in favor of dependabot * DEVOPS-781 feat: enhance workflow-test to support matrix filtering for OS selection * DEVOPS-781 fix: update project name references to Clariti-CumulusCI in tests and utils * DEVOPS-781 chore: update uv.lock * DEVOPS-781 style: lint run_workflow.py * DEVOPS-781 chore: add format/lint Makefile targets and fix code formatting * DEVOPS-781 release: bump version to v4.6.0.dev2 with changelog * DEVOPS-781 ci: add dynamic environment selection and trusted publishing for releases * DEVOPS-781 fix: address CodeRabbit review findings (URLs and anchors) * DEVOPS-781 fix: address remaining CodeRabbit findings (typos and shell vars) - Fix typo "Offical" → "Official" in bug report template - Fix grammar "please visit on the" → "please visit the" - Improve release.yml to use shell variables instead of reading $GITHUB_OUTPUT * DEVOPS-781 fix: pin third-party GitHub Actions to SHA Pin non-GitHub owned actions to commit SHA for security: - astral-sh/setup-uv@v5 -> SHA - pre-commit/action@v3.0.1 -> SHA * DEVOPS-781 fix: correct PyPI environment URL path Use /project/ instead of /p/ for canonical PyPI URL. * DEVOPS-781 fix: address CodeRabbit review findings - docs/get-started.md: update Windows PATH from Python38 to Python311 - docs/org_config-reference.md: fix duplicated word "number" - docs/robot-advanced.md: fix inconsistent anchor for Set Test Elapsed Time - MAINTAINERS.md: update to reference PyPI GitHub Action instead of hatch publish - slow_integration_tests.yml: update actions/checkout v2->v4, setup-python v4->v5 - cumulusci/cli/utils.py: fix Windows registry handle leak using context managers - release.yml: tighten prerelease detection regex for PEP 440 compliance * DEVOPS-781 fix: suppress warnings when var/secret files explicitly disabled Don't emit warnings about missing custom var/secret files when the user has explicitly disabled them via --no-var-file or --no-secret-file flags. * DEVOPS-781 fix: add explicit permissions to GitHub Actions workflows Add minimal permissions blocks to limit GITHUB_TOKEN scope: - feature_test.yml: contents: read - chores.yml: contents: read - pre-release.yml: contents: write, pull-requests: write - release.yml: contents: write, id-token: write - release_test.yml: contents: read - release_test_sfdx.yml: contents: read - slow_integration_tests.yml: contents: read * DEVOPS-781 fix: grant write permissions to chores workflow The update_api_versions job pushes a branch and creates a PR, so it needs contents: write and pull-requests: write permissions. * DEVOPS-781 fix: update release_test.yml for clariti-cumulusci package name Update wheel/sdist filenames and pip commands to use clariti_cumulusci instead of cumulusci to match the renamed package.
1 parent 7ae1f89 commit 0c27393

57 files changed

Lines changed: 1512 additions & 458 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/CODEOWNERS‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,3 @@
1-
#ECCN: Open Source
2-
#GUSINFO: SFDO Release Engineering, SFDO RelEng - CumulusCI Core
3-
* @SFDO-Tooling/salesforce-org-release-engineering
1+
# Clariti CumulusCI Code Owners
2+
# Maintainers of the Clariti fork of CumulusCI
3+
* @ClaritiSoftware/cci-maintainers

‎.github/ISSUE_TEMPLATE/bug_report.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,12 @@
11
---
22
name: Bug report
3-
description: Report a problem in CumulusCI functionality
3+
description: Report a problem in Clariti CumulusCI functionality
44
labels: bug
55
body:
66
- type: markdown
77
attributes:
88
value: |
9-
If you are seeking support on using CumulusCI, please do not open an Issue. Instead, please visit us on the [Trailblazer Community](https://trailhead.salesforce.com/trailblazer-community/groups/0F9300000009M9ZCAU).
9+
If you are seeking support on using Clariti CumulusCI or Official CumulusCI, please do not open an Issue. Instead, please visit the [Trailblazer Community](https://trailhead.salesforce.com/trailblazer-community/groups/0F9300000009M9ZCAU).
1010
- type: textarea
1111
id: bug_description
1212
validations:
@@ -71,7 +71,7 @@ body:
7171
id: error_gist
7272
attributes:
7373
label: Error Gist
74-
description: If applicable, please use the `cci error gist` command to create a Gist from your error log and include the link here. See the [documentation](https://cumulusci.readthedocs.io/en/latest/features.html#working-with-errors) to learn how to create a Gist.
74+
description: If applicable, please use the `cci error gist` command to create a Gist from your error log and include the link here. See the [documentation](https://claritisoftware.github.io/CumulusCI/features.html#working-with-errors) to learn how to create a Gist. **Recommended:** [Enable telemetry](https://claritisoftware.github.io/CumulusCI/env-var-reference.html#telemetry) and reproduce the issue so we automatically receive the error report.
7575
- type: textarea
7676
id: additional_information
7777
attributes:

‎.github/dependabot.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
version: 2
22
updates:
3-
- package-ecosystem: pip
3+
- package-ecosystem: uv
44
directory: "/"
55
schedule:
66
interval: weekly

‎.github/workflows/chores.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,10 @@ on:
55
schedule:
66
- cron: "0 0 * * 0" # At 00:00 on Sunday
77

8+
permissions:
9+
contents: write
10+
pull-requests: write
11+
812
jobs:
913
check_api_versions:
1014
runs-on: ubuntu-latest

‎.github/workflows/docs.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,7 @@ jobs:
3737
python-version: "3.11"
3838

3939
- name: Set up uv
40-
uses: SFDO-Tooling/setup-uv@main
40+
uses: astral-sh/setup-uv@e58605a9b6da7c637471fab8847a5e5a6b8df081 # v5
4141
with:
4242
version: "0.8.4"
4343
enable-cache: true

‎.github/workflows/feature_test.yml‎

Lines changed: 14 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -8,11 +8,20 @@ on:
88
branches:
99
- main
1010

11+
permissions:
12+
contents: read
13+
1114
jobs:
1215
lint:
1316
name: Lint
1417
if: ${{ contains(fromJSON('["workflow_dispatch", "pull_request"]'), github.event_name) }}
15-
uses: SFDO-Tooling/.github/.github/workflows/pre-commit.yml@main
18+
runs-on: ubuntu-latest
19+
steps:
20+
- uses: actions/checkout@v4
21+
- uses: actions/setup-python@v4
22+
with:
23+
python-version: "3.11"
24+
- uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd # v3.0.1
1625
docs:
1726
name: Build Docs
1827
if: ${{ github.event_name == 'pull_request' }}
@@ -28,7 +37,7 @@ jobs:
2837
with:
2938
python-version: 3.11
3039
- name: Set up uv
31-
uses: SFDO-Tooling/setup-uv@main
40+
uses: astral-sh/setup-uv@e58605a9b6da7c637471fab8847a5e5a6b8df081 # v5
3241
with:
3342
version: "0.8.4"
3443
enable-cache: true
@@ -54,7 +63,7 @@ jobs:
5463
with:
5564
python-version: "${{ matrix.python-version }}"
5665
- name: Set up uv
57-
uses: SFDO-Tooling/setup-uv@main
66+
uses: astral-sh/setup-uv@e58605a9b6da7c637471fab8847a5e5a6b8df081 # v5
5867
with:
5968
version: "0.8.4"
6069
enable-cache: true
@@ -78,7 +87,7 @@ jobs:
7887
with:
7988
python-version: "${{ matrix.python-version }}"
8089
- name: Set up uv
81-
uses: SFDO-Tooling/setup-uv@main
90+
uses: astral-sh/setup-uv@e58605a9b6da7c637471fab8847a5e5a6b8df081 # v5
8291
with:
8392
version: "0.8.4"
8493
enable-cache: true
@@ -97,7 +106,7 @@ jobs:
97106
with:
98107
python-version: 3.11
99108
- name: Set up uv
100-
uses: SFDO-Tooling/setup-uv@main
109+
uses: astral-sh/setup-uv@e58605a9b6da7c637471fab8847a5e5a6b8df081 # v5
101110
with:
102111
version: "0.8.4"
103112
enable-cache: true

‎.github/workflows/pre-release.yml‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,10 @@ on:
1616
- preview
1717
- dev
1818

19+
permissions:
20+
contents: write
21+
pull-requests: write
22+
1923
jobs:
2024
generate-changelog:
2125
name: Create a PR to update version and release notes
@@ -44,7 +48,7 @@ jobs:
4448
gh api \
4549
--method POST \
4650
-H "Accept: application/vnd.github.v3+json" \
47-
/repos/SFDO-Tooling/CumulusCI/releases/generate-notes \
51+
/repos/ClaritiSoftware/CumulusCI/releases/generate-notes \
4852
-f previous_tag_name=$PREVIOUS_VERSION \
4953
-f target_commitish='main' \
5054
-f tag_name=$NEXT_VERSION \

‎.github/workflows/release.yml‎

Lines changed: 69 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -7,36 +7,94 @@ on:
77
paths:
88
- cumulusci/__about__.py
99

10+
permissions:
11+
contents: write
12+
id-token: write
13+
1014
concurrency: publishing
1115

1216
jobs:
17+
determine-environment:
18+
name: Determine release environment
19+
runs-on: ubuntu-latest
20+
outputs:
21+
version: ${{ steps.version.outputs.version }}
22+
environment: ${{ steps.version.outputs.environment }}
23+
prerelease: ${{ steps.version.outputs.prerelease }}
24+
steps:
25+
- uses: actions/checkout@v4
26+
- name: Set up Python 3.11
27+
uses: actions/setup-python@v5
28+
with:
29+
python-version: 3.11
30+
- name: Install hatch
31+
run: python -m pip install hatch
32+
- name: Determine version and environment
33+
id: version
34+
run: |
35+
VERSION="$(hatch version)"
36+
echo "version=$VERSION" >> $GITHUB_OUTPUT
37+
38+
# Determine environment based on version pattern (PEP 440 compliant)
39+
ENVIRONMENT=""
40+
PRERELEASE=""
41+
if [[ "$VERSION" =~ \.dev[0-9]*$ ]]; then
42+
ENVIRONMENT="development"
43+
PRERELEASE="true"
44+
elif [[ "$VERSION" =~ (a|b|rc)[0-9]+$ ]]; then
45+
ENVIRONMENT="staging"
46+
PRERELEASE="true"
47+
else
48+
ENVIRONMENT="production"
49+
PRERELEASE="false"
50+
fi
51+
52+
echo "environment=$ENVIRONMENT" >> $GITHUB_OUTPUT
53+
echo "prerelease=$PRERELEASE" >> $GITHUB_OUTPUT
54+
55+
echo "📦 Version: $VERSION"
56+
echo "🌍 Environment: $ENVIRONMENT"
57+
1358
publish-to-pypi:
14-
name: Publish new release to PyPI
59+
name: Publish ${{ needs.determine-environment.outputs.version }} to PyPI
1560
runs-on: ubuntu-latest
61+
needs: determine-environment
62+
environment:
63+
name: ${{ needs.determine-environment.outputs.environment }}
64+
url: https://pypi.org/project/clariti-cumulusci/${{ needs.determine-environment.outputs.version }}
65+
permissions:
66+
id-token: write # Required for trusted publishing
67+
contents: write # Required for creating releases
1668
steps:
17-
- uses: actions/checkout@main
69+
- uses: actions/checkout@v4
1870
- name: Set up Python 3.11
19-
uses: actions/setup-python@v4
71+
uses: actions/setup-python@v5
2072
with:
2173
python-version: 3.11
2274
cache: pip
2375
- name: Install build tools
2476
run: python -m pip install hatch tomli tomli-w
2577
- name: Build source tarball and binary wheel
2678
run: hatch build -c
27-
- name: Upload to PyPI
28-
run: hatch publish
29-
env:
30-
HATCH_INDEX_USER: "__token__"
31-
HATCH_INDEX_AUTH: ${{ secrets.PYPI_TOKEN }}
32-
- name: Create release
79+
- name: Publish to PyPI (Trusted Publishing)
80+
uses: pypa/gh-action-pypi-publish@106e0b0b7c337fa67ed433972f777c6357f78598 # v1.13.0
81+
# No credentials needed - uses OIDC trusted publishing
82+
- name: Create GitHub release
3383
env:
3484
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
85+
VERSION: ${{ needs.determine-environment.outputs.version }}
86+
PRERELEASE: ${{ needs.determine-environment.outputs.prerelease }}
3587
run: |
36-
VERSION="$(hatch version)"
3788
awk '/<!-- latest-start -->/,/<!-- latest-stop -->/' docs/history.md > changelog.md
89+
90+
PRERELEASE_FLAG=""
91+
if [[ "$PRERELEASE" == "true" ]]; then
92+
PRERELEASE_FLAG="--prerelease"
93+
fi
94+
3895
gh release create "v$VERSION" \
3996
dist/*.whl \
4097
dist/*.tar.gz \
4198
--notes-file changelog.md \
42-
--title $VERSION
99+
--title "v$VERSION" \
100+
$PRERELEASE_FLAG

‎.github/workflows/release_test.yml‎

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,9 @@ on:
55
pull_request:
66
types: [opened, synchronize, reopened] # Default
77

8+
permissions:
9+
contents: read
10+
811
jobs:
912
test_artifacts:
1013
name: "Test Package Artifacts"
@@ -24,14 +27,14 @@ jobs:
2427
hatch build
2528
- name: Test install of wheel
2629
run: |
27-
pip install dist/cumulusci*.whl
28-
pip show cumulusci
29-
pip uninstall -y cumulusci
30+
pip install dist/clariti_cumulusci*.whl
31+
pip show clariti-cumulusci
32+
pip uninstall -y clariti-cumulusci
3033
- name: Test install of sdist
3134
run: |
32-
pip install dist/cumulusci*.tar.gz
33-
pip show cumulusci
34-
pip uninstall -y cumulusci
35+
pip install dist/clariti_cumulusci*.tar.gz
36+
pip show clariti-cumulusci
37+
pip uninstall -y clariti-cumulusci
3538
- name: Store artifacts
3639
if: failure()
3740
uses: actions/upload-artifact@v4

‎.github/workflows/release_test_sfdx.yml‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,8 @@
11
name: SFDX Integration Test
22

3+
permissions:
4+
contents: read
5+
36
on:
47
workflow_call:
58
inputs:
@@ -46,7 +49,7 @@ jobs:
4649
with:
4750
python-version: 3.11
4851
- name: Set up uv
49-
uses: SFDO-Tooling/setup-uv@main
52+
uses: astral-sh/setup-uv@e58605a9b6da7c637471fab8847a5e5a6b8df081 # v5
5053
with:
5154
version: "0.8.4"
5255
enable-cache: true

0 commit comments

Comments
 (0)