Modernize

.github/dependabot.yml

@@ -3,9 +3,17 @@
 version: 2
 updates:
 
-  - package-ecosystem: "github-actions"
+  - package-ecosystem:
+    - "github-actions"
+    - "pre-commit"
     directory: "/"
     schedule:
       interval: "daily"
     labels:
       - "Bot"
+    groups:
+      github-actions:
+        patterns:
+          - '*'
+    cooldown:
+      default-days: 7

.github/workflows/deploy-docs.yml

@@ -1,5 +1,8 @@
 name: Documentation
 
+# no permissions by default
+permissions: {}
+
 on:
   pull_request:
   push:
@@ -12,15 +15,21 @@ on:
 jobs:
   build-docs:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    defaults:
+      run:
+        shell: bash -l {0}
 
     steps:
     - name: checkout
-      uses: actions/checkout@v6
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
       with:
         fetch-depth: 0
+        persist-credentials: false
 
     - name: Setup Micromamba
-      uses: mamba-org/setup-micromamba@v2
+      uses: mamba-org/setup-micromamba@add3a49764cedee8ee24e82dfde87f5bc2914462 # v2.0.7
       with:
         environment-name: TEST
         init-shell: bash
@@ -29,12 +38,10 @@ jobs:
 
 
     - name: Install oceans
-      shell: bash -l {0}
       run: |
         python -m pip install -e . --no-deps --force-reinstall
 
     - name: Build documentation
-      shell: bash -l {0}
       run: |
         set -e
         pushd docs
@@ -43,7 +50,7 @@ jobs:
 
     - name: Deploy
       if: success() && github.event_name == 'release'
-      uses: peaceiris/actions-gh-pages@v4
+      uses: peaceiris/actions-gh-pages@4f9cc6602d3f66b9c108549d475ec49e8ef4d45e  # v4.0.0
       with:
         github_token: ${{ secrets.GITHUB_TOKEN }}
         publish_dir: docs/build/html

.github/workflows/pypi.yml

@@ -9,44 +9,50 @@ on:
     types:
       - published
 
+defaults:
+  run:
+    shell: bash
+
 jobs:
-  packages:
+  pypi-publish:
+    name: Upload release to PyPI
     runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/p/erddapy/
+    permissions:
+      id-token: write  # IMPORTANT: this permission is mandatory for trusted publishing
+
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+      with:
+        fetch-depth: 0
+        persist-credentials: false
 
     - name: Set up Python
-      uses: actions/setup-python@v6
+      uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
       with:
         python-version: "3.x"
 
     - name: Get tags
       run: git fetch --depth=1 origin +refs/tags/*:refs/tags/*
-      shell: bash
 
     - name: Install build tools
       run: |
         python -m pip install --upgrade pip build twine
 
-      shell: bash
-
     - name: Build binary wheel
       run: python -m build --sdist --wheel . --outdir dist
 
     - name: CheckFiles
       run: |
         ls dist
-      shell: bash
 
     - name: Test wheels
       run: |
         cd dist && python -m pip install *.whl
         python -m twine check *
-      shell: bash
 
     - name: Publish a Python distribution to PyPI
       if: success() && github.event_name == 'release'
-      uses: pypa/gh-action-pypi-publish@release/v1
-      with:
-        user: __token__
-        password: ${{ secrets.PYPI_PASSWORD }}
+      uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e  # v1.13.0

.github/workflows/tests.yml

@@ -1,43 +1,47 @@
 name: Tests
 
+# no permissions by default
+permissions: {}
+
 on:
   pull_request:
   push:
-    branches: [main]
+    branches: [ main ]
 
 jobs:
   run:
     runs-on: ${{ matrix.os }}
     strategy:
       matrix:
-        python-version: [ "3.10", "3.11", "3.12" ]
-        os: [ubuntu-latest]
+        python-version: [ "3.10", "3.14"]
+        os: [ ubuntu-latest ]
       fail-fast: false
+    defaults:
+      run:
+        shell: bash -l {0}
 
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
       with:
         fetch-depth: 0
+        persist-credentials: false
 
     - name: Setup Micromamba Python ${{ matrix.python-version }}
-      uses: mamba-org/setup-micromamba@v2
+      uses: mamba-org/setup-micromamba@add3a49764cedee8ee24e82dfde87f5bc2914462 # v2.0.7
       with:
         environment-name: TEST
         init-shell: bash
         create-args: >-
           python=${{ matrix.python-version }} --file requirements.txt --file requirements-dev.txt --channel conda-forge
 
     - name: Install oceans
-      shell: bash -l {0}
       run: |
         python -m pip install -e . --no-deps --force-reinstall
 
     - name: Tests
-      shell: bash -l {0}
       run: |
         python -m pytest -n 2 -rxs --cov=oceans tests
 
     - name: Doctests
-      shell: bash -l {0}
       run: |
         python -m pytest -vv oceans --doctest-modules

.pre-commit-config.yaml

@@ -1,7 +1,7 @@
 
 repos:
 - repo: https://github.com/pre-commit/pre-commit-hooks
-  rev: v4.6.0
+  rev: v6.0.0
   hooks:
     - id: check-ast
     - id: end-of-file-fixer
@@ -15,42 +15,59 @@ repos:
     - id: debug-statements
 
 
-# - repo: https://github.com/econchick/interrogate
-#   rev: 1.5.0
-#   hooks:
-#     - id: interrogate
-#       exclude: ^(docs|setup.py|tests)
-#       args: [--config=pyproject.toml]
-
 - repo: https://github.com/keewis/blackdoc
-  rev: v0.3.9
+  rev: v0.4.6
   hooks:
     - id: blackdoc
 
-- repo: https://github.com/charliermarsh/ruff-pre-commit
-  rev: v0.5.5
+
+- repo: https://github.com/astral-sh/ruff-pre-commit
+  rev: v0.15.8
   hooks:
     - id: ruff
+      args: ["--fix", "--show-fixes"]
+    - id: ruff-format
+
+
+- repo: https://github.com/nbQA-dev/nbQA
+  rev: 1.9.1
+  hooks:
+    - id: nbqa-check-ast
+    - id: nbqa-black
+    - id: nbqa-ruff
+      args: [
+        --fix,
+        --config=ruff.toml,
+        ]
+
 
-- repo: https://github.com/psf/black
-  rev: 24.4.2
+- repo: https://github.com/woodruffw/zizmor-pre-commit
+  rev: v1.23.1
   hooks:
-  - id: black
-    language_version: python3
+    - id: zizmor
+
+
+- repo: https://github.com/bdice/nb-strip-paths
+  rev: v0.1.0
+  hooks:
+    - id: nb-strip-paths
+
 
 - repo: https://github.com/codespell-project/codespell
-  rev: v2.3.0
+  rev: v2.4.2
   hooks:
     - id: codespell
       args:
         - --ignore-words-list=pres
 
+
 - repo: https://github.com/asottile/add-trailing-comma
-  rev: v3.1.0
+  rev: v4.0.0
   hooks:
     - id: add-trailing-comma
 
+
 - repo: https://github.com/tox-dev/pyproject-fmt
-  rev: "2.2.0"
+  rev: "v2.20.0"
   hooks:
     - id: pyproject-fmt