update best practices example

Author: ocefpaf

.github/dependabot.yml

@@ -9,3 +9,18 @@ updates:
       interval: "daily"
     labels:
       - "Bot"
+    groups:
+      github-actions:
+        patterns:
+          - '*'
+    cooldown:
+      default-days: 7
+
+  - package-ecosystem: "pre-commit"
+    directory: "/"
+    schedule:
+      interval: "daily"
+    labels:
+      - "Bot"
+    cooldown:
+      default-days: 7

.github/workflows/deploy-docs.yml

@@ -1,5 +1,8 @@
 name: Documentation
 
+# no permissions by default
+permissions: {}
+
 on:
   pull_request:
   push:
@@ -12,15 +15,21 @@ on:
 jobs:
   build-docs:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    defaults:
+      run:
+        shell: bash -l {0}
 
     steps:
     - name: checkout
-      uses: actions/checkout@v6
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
       with:
         fetch-depth: 0
+        persist-credentials: false
 
     - name: Setup Micromamba
-      uses: mamba-org/setup-micromamba@v2
+      uses: mamba-org/setup-micromamba@add3a49764cedee8ee24e82dfde87f5bc2914462  # v2.0.7
       with:
         environment-name: TEST
         init-shell: bash
@@ -31,12 +40,10 @@ jobs:
           --channel conda-forge
 
     - name: Install package
-      shell: bash -l {0}
       run: |
         python -m pip install -e . --no-deps --force-reinstall
 
     - name: Build documentation
-      shell: bash -l {0}
       run: |
         set -e
         jupyter nbconvert --to notebook --execute notebooks/tutorial.ipynb --output=tutorial-output.ipynb
@@ -47,7 +54,7 @@ jobs:
 
     - name: Deploy
       if: success() && github.event_name == 'release'
-      uses: peaceiris/actions-gh-pages@v4
+      uses: peaceiris/actions-gh-pages@4f9cc6602d3f66b9c108549d475ec49e8ef4d45e  # v4.0.0
       with:
         github_token: ${{ secrets.GITHUB_TOKEN }}
         publish_dir: docs/build/html

.github/workflows/pypi.yml

@@ -9,45 +9,55 @@ on:
     types:
       - published
 
+defaults:
+  run:
+    shell: bash
+
 jobs:
-  packages:
+  pypi-publish:
+    name: Upload release to PyPI
     runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/p/ioos-pkg-skeleton/
+    permissions:
+      id-token: write  # IMPORTANT: this permission is mandatory for trusted publishing
+
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+      with:
+        # Should be enough for setuptools-scm
+        fetch-depth: 100
+        persist-credentials: false
 
     - name: Set up Python
-      uses: actions/setup-python@v6
+      uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
       with:
         python-version: "3.x"
 
     - name: Get tags
       run: git fetch --depth=1 origin +refs/tags/*:refs/tags/*
-      shell: bash
 
     - name: Install build tools
       run: |
         python -m pip install --upgrade pip build
 
-      shell: bash
 
-    - name: Build binary wheel
+    - name: Build sdist and binary wheel
       run: python -m build --sdist --wheel . --outdir dist
 
     - name: CheckFiles
       run: |
         ls dist
-      shell: bash
+        python -m pip install --upgrade check-manifest
+        check-manifest --verbose
 
     - name: Test wheels
       run: |
         cd dist && python -m pip install *.whl
         python -m pip install --upgrade twine
         python -m twine check *
-      shell: bash
 
     - name: Publish a Python distribution to PyPI
       if: success() && github.event_name == 'release'
-      uses: pypa/gh-action-pypi-publish@release/v1
-      with:
-        user: __token__
-        password: ${{ secrets.PYPI_PASSWORD }}
+      uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e  # v1.13.0

.github/workflows/tests.yml

@@ -1,5 +1,8 @@
 name: Tests
 
+# no permissions by default
+permissions: {}
+
 on:
   pull_request:
   push:
@@ -10,17 +13,21 @@ jobs:
     runs-on: ${{ matrix.os }}
     strategy:
       matrix:
-        python-version: ["3.8", "3.9", "3.10", "3.11"]
+        python-version: [ "3.10", "3.14"]
         os: [windows-latest, ubuntu-latest, macos-latest]
       fail-fast: false
+    defaults:
+      run:
+        shell: bash -l {0}
 
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
       with:
         fetch-depth: 0
+        persist-credentials: false
 
     - name: Setup Micromamba ${{ matrix.python-version }}
-      uses: mamba-org/setup-micromamba@v2
+      uses: mamba-org/setup-micromamba@add3a49764cedee8ee24e82dfde87f5bc2914462 # v2.0.7
       with:
         environment-name: TEST
         init-shell: bash
@@ -31,11 +38,9 @@ jobs:
           --channel conda-forge
 
     - name: Install package
-      shell: bash -l {0}
       run: |
         python -m pip install -e . --no-deps --force-reinstall
 
     - name: Tests
-      shell: bash -l {0}
       run: |
         python -m pytest -n 2 -rxs --cov=ioos_pkg_skeleton tests

.isort.cfg

@@ -1,7 +1,7 @@
 repos:
 
 - repo: https://github.com/pre-commit/pre-commit-hooks
-  rev: v4.4.0
+  rev: v6.0.0
   hooks:
     - id: trailing-whitespace
       exclude: tests/data
@@ -15,59 +15,73 @@ repos:
       files: requirements-dev.txt
 
 - repo: https://github.com/econchick/interrogate
-  rev: 1.5.0
+  rev: 1.7.0
   hooks:
     - id: interrogate
       exclude: ^(docs|setup.py|tests)
       args: [--config=pyproject.toml]
 
 - repo: https://github.com/keewis/blackdoc
-  rev: v0.3.8
+  rev: v0.4.6
   hooks:
     - id: blackdoc
 
-- repo: https://github.com/charliermarsh/ruff-pre-commit
-  rev: v0.0.282
+- repo: https://github.com/astral-sh/ruff-pre-commit
+  rev: v0.15.8
   hooks:
     - id: ruff
-
-- repo: https://github.com/psf/black
-  rev: 23.7.0
-  hooks:
-  - id: black
-    language_version: python3
+      args: ["--fix", "--show-fixes"]
+    - id: ruff-format
 
 - repo: https://github.com/codespell-project/codespell
-  rev: v2.2.5
+  rev: v2.4.2
   hooks:
     - id: codespell
       args:
         - --quiet-level=2
 
 - repo: https://github.com/asottile/add-trailing-comma
-  rev: v3.0.1
+  rev: v4.0.0
   hooks:
     - id: add-trailing-comma
 
 - repo: https://github.com/tox-dev/pyproject-fmt
-  rev: "0.13.0"
+  rev: "v2.21.0"
   hooks:
     - id: pyproject-fmt
 
 - repo: https://github.com/aio-libs/sort-all
-  rev: "v1.2.0"
+  rev: "v1.3.0"
   hooks:
     - id: sort-all
       types: [file, python]
 
+- repo: https://github.com/nbQA-dev/nbQA
+  rev: 1.9.1
+  hooks:
+    - id: nbqa-check-ast
+    - id: nbqa-black
+    - id: nbqa-ruff
+      args: [
+        --fix,
+        --config=ruff.toml,
+        ]
+
+- repo: https://github.com/bdice/nb-strip-paths
+  rev: v0.1.0
+  hooks:
+    - id: nb-strip-paths
+
+- repo: https://github.com/woodruffw/zizmor-pre-commit
+  rev: v1.23.1
+  hooks:
+    - id: zizmor
 
 ci:
     autofix_commit_msg: |
         [pre-commit.ci] auto fixes from pre-commit.com hooks
 
         for more information, see https://pre-commit.ci
     autofix_prs: false
-    autoupdate_commit_msg: '[pre-commit.ci] pre-commit autoupdate'
-    autoupdate_schedule: monthly
     skip: []
     submodules: false

.pre-commit-config.yaml

@@ -27,7 +27,6 @@ pip install ioos_pkg_skeleton
 ```python
 from ioos_pkg_skeleton import ioos_pkg_skeleton
 
-
 ioos_pkg_skeleton.meaning_of_life_url()
 ```
 

README.md

@@ -58,11 +58,11 @@
 # |version| and |release|, also used in various other places throughout the
 # built documents.
 #
-from ioos_pkg_skeleton import __version__ as VERSION  # noqa
+from ioos_pkg_skeleton import __version__
 
-version = VERSION
+version = __version__
 # The full version, including alpha/beta/rc tags.
-release = VERSION
+release = __version__
 
 # The language for content autogenerated by Sphinx. Refer to documentation
 # for a list of supported languages.

docs/source/conf.py

@@ -89,7 +89,6 @@ setup(
         "tag_regex": r"^(?P<prefix>v)?(?P<version>[^\+]+)(?P<suffix>.*)?$",
     }
 )
-
 ```
 
 We recommend the use of `setuptools-scm`.

docs/source/how2package4ioos.md

@@ -1,5 +1,5 @@
-"""
-ioos_pkg_skeleton is not a real package, just a set of best practices examples.
+"""ioos_pkg_skeleton is not a real package,
+just a set of best practices examples.
 """
 
 from ioos_pkg_skeleton.ioos_pkg_skeleton import (