Dev chores (marshmallow-code#916)

* Migrate to pyproject.toml; use ruff; add SECURITY.md and RELEASING.md

* tox -e lint

* Update build and release pipeline

* cleanup

.github/workflows/build-release.yml

@@ -18,40 +18,60 @@ jobs:
           - { name: "lowest", python: "3.8", tox: py38-lowest }
           - { name: "dev", python: "3.12", tox: py312-marshmallowdev }
     steps:
-      - uses: actions/checkout@v3.1.0
-      - uses: actions/setup-python@v4.3.0
+      - uses: actions/checkout@v4.0.0
+      - uses: actions/setup-python@v4.7.0
         with:
           python-version: ${{ matrix.python }}
-      - run: python -m pip install --upgrade pip
       - run: python -m pip install tox
       - run: python -m tox -e${{ matrix.tox }}
+  build:
+    name: Build package
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v4
+        with:
+          python-version: "3.11"
+      - name: Install pypa/build
+        run: python -m pip install build
+      - name: Build a binary wheel and a source tarball
+        run: python -m build
+      - name: Install twine
+        run: python -m pip install twine
+      - name: Check build
+        run: python -m twine check --strict dist/*
+      - name: Store the distribution packages
+        uses: actions/upload-artifact@v3
+        with:
+          name: python-package-distributions
+          path: dist/
   # this duplicates pre-commit.ci, so only run it on tags
   # it guarantees that linting is passing prior to a release
   lint-pre-release:
-    name: lint
-    runs-on: ubuntu-latest
     if: startsWith(github.ref, 'refs/tags')
+    runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3.1.0
-      - uses: actions/setup-python@v4.3.0
+      - uses: actions/checkout@v4.0.0
+      - uses: actions/setup-python@v4.7.0
         with:
           python-version: "3.11"
-      - run: python -m pip install --upgrade pip
       - run: python -m pip install tox
-      - run: python -m tox -elint
-  release:
-    needs: [tests, lint-pre-release]
+      - run: python -m tox -e lint
+  publish-to-pypi:
     name: PyPI release
-    if: startsWith(github.ref, 'refs/tags')
+    if: startsWith(github.ref, 'refs/tags/')
+    needs: [build, tests, lint-pre-release]
     runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/p/webargs
+    permissions:
+      id-token: write
     steps:
-      - uses: actions/checkout@v3.1.0
-      - uses: actions/setup-python@v4.3.0
-      - name: install requirements
-        run: python -m pip install build twine
-      - name: build dists
-        run: python -m build
-      - name: check package metadata
-        run: twine check dist/*
-      - name: publish
-        run: twine upload -u __token__ -p ${{ secrets.PYPI_API_TOKEN }} dist/*
+      - name: Download all the dists
+        uses: actions/download-artifact@v3
+        with:
+          name: python-package-distributions
+          path: dist/
+      - name: Publish distribution to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1

.pre-commit-config.yaml

@@ -1,29 +1,19 @@
 repos:
-- repo: https://github.com/asottile/pyupgrade
-  rev: v3.15.0
+- repo: https://github.com/astral-sh/ruff-pre-commit
+  rev: v0.1.14
   hooks:
-  - id: pyupgrade
-    args: ["--py38-plus"]
+    - id: ruff
+    - id: ruff-format
 - repo: https://github.com/python-jsonschema/check-jsonschema
   rev: 0.27.3
   hooks:
     - id: check-github-workflows
     - id: check-readthedocs
-- repo: https://github.com/psf/black
-  rev: 24.1.1
-  hooks:
-  - id: black
-- repo: https://github.com/pycqa/flake8
-  rev: 7.0.0
-  hooks:
-  - id: flake8
-    additional_dependencies: ['flake8-bugbear==23.12.2']
 - repo: https://github.com/asottile/blacken-docs
   rev: 1.16.0
   hooks:
   - id: blacken-docs
     additional_dependencies: [black==23.12.1]
-    args: ["--target-version", "py38"]
 - repo: https://github.com/pre-commit/mirrors-mypy
   rev: v1.8.0
   hooks:

LICENSE

@@ -1,4 +1,4 @@
-Copyright 2014-2024 Steven Loria and contributors
+Copyright Steven Loria and contributors
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

RELEASING.md

@@ -0,0 +1,9 @@
+# Releasing
+
+1. Bump version in `pyproject.toml` and update the changelog
+   with today's date.
+2. Commit: `git commit -m "Bump version and update changelog"`
+3. Tag the commit: `git tag x.y.z`
+4. Push: `git push --tags origin dev`. CI will take care of the
+   PyPI release.
+5. Add release notes on Tidelift.

SECURITY.md

@@ -0,0 +1,5 @@
+# Security Contact Information
+
+To report a security vulnerability, please use the
+[Tidelift security contact](https://tidelift.com/security).
+Tidelift will coordinate the fix and disclosure.

docs/conf.py

@@ -1,13 +1,4 @@
-import sys
-import os
-import time
-import datetime as dt
-
-# If extensions (or modules to document with autodoc) are in another directory,
-# add these directories to sys.path here. If the directory is relative to the
-# documentation root, use os.path.abspath to make it absolute, like shown here.
-sys.path.insert(0, os.path.abspath(os.path.join("..", "src")))
-import webargs  # noqa
+import importlib.metadata
 
 extensions = [
     "sphinx.ext.autodoc",
@@ -30,20 +21,14 @@
 }
 
 
-# Use SOURCE_DATE_EPOCH for reproducible build output
-# https://reproducible-builds.org/docs/source-date-epoch/
-build_date = dt.datetime.utcfromtimestamp(
-    int(os.environ.get("SOURCE_DATE_EPOCH", time.time()))
-)
-
 # The master toctree document.
 master_doc = "index"
 language = "en"
 html_domain_indices = False
 source_suffix = ".rst"
 project = "webargs"
-copyright = f"2014-{build_date:%Y}, Steven Loria and contributors"
-version = release = webargs.__version__
+copyright = "Steven Loria and contributors"
+version = release = importlib.metadata.version("webargs")
 templates_path = ["_templates"]
 exclude_patterns = ["_build"]
 

examples/aiohttp_example.py

@@ -18,6 +18,7 @@
 
 from aiohttp import web
 from aiohttp.web import json_response
+
 from webargs import fields, validate
 from webargs.aiohttpparser import use_args, use_kwargs
 

examples/annotations_example.py

@@ -14,15 +14,15 @@
     $ http GET :5001/users/42
 """
 
-import random
 import functools
+import random
 
 from flask import Flask, request
 from marshmallow import Schema
+
 from webargs import fields
 from webargs.flaskparser import parser
 
-
 app = Flask(__name__)
 
 ##### Routing wrapper ####

examples/bottle_example.py

@@ -15,11 +15,11 @@
 
 import datetime as dt
 
-from bottle import route, run, error, response
+from bottle import error, response, route, run
+
 from webargs import fields, validate
 from webargs.bottleparser import use_args, use_kwargs
 
-
 hello_args = {"name": fields.Str(load_default="Friend")}
 
 

examples/falcon_example.py

@@ -19,11 +19,11 @@
 
 import datetime as dt
 
-from webargs.core import json
-
 import falcon
+
 from webargs import fields, validate
-from webargs.falconparser import use_args, use_kwargs, parser
+from webargs.core import json
+from webargs.falconparser import parser, use_args, use_kwargs
 
 ### Middleware and hooks ###
 

examples/flask_example.py

@@ -17,6 +17,7 @@
 import datetime as dt
 
 from flask import Flask, jsonify
+
 from webargs import fields, validate
 from webargs.flaskparser import use_args, use_kwargs
 

examples/flaskrestful_example.py

@@ -19,7 +19,7 @@
 from flask_restful import Api, Resource
 
 from webargs import fields, validate
-from webargs.flaskparser import use_args, use_kwargs, parser, abort
+from webargs.flaskparser import abort, parser, use_args, use_kwargs
 
 app = Flask(__name__)
 api = Api(app)

examples/pyramid_example.py

@@ -14,15 +14,15 @@
 """
 
 import datetime as dt
-
 from wsgiref.simple_server import make_server
+
 from pyramid.config import Configurator
-from pyramid.view import view_config
 from pyramid.renderers import JSON
+from pyramid.view import view_config
+
 from webargs import fields, validate
 from webargs.pyramidparser import use_args, use_kwargs
 
-
 hello_args = {"name": fields.Str(load_default="Friend")}
 
 

examples/schema_example.py

@@ -19,6 +19,7 @@
 
 from flask import Flask, request
 from marshmallow import Schema, fields, post_dump
+
 from webargs.flaskparser import parser, use_kwargs
 
 app = Flask(__name__)

examples/tornado_example.py

@@ -17,6 +17,7 @@
 
 import tornado.ioloop
 from tornado.web import RequestHandler
+
 from webargs import fields, validate
 from webargs.tornadoparser import use_args, use_kwargs