Contemplative Constellations

contemplative-constellations/.dockerignore

@@ -0,0 +1,9 @@
+.github/
+.git/
+.tests/
+.vscode/
+.editorconfig
+.gitattributes
+.gitignore
+.pre-commit-config.yaml
+README.md

contemplative-constellations/.editorconfig

@@ -0,0 +1,17 @@
+# Check http://editorconfig.org for more information
+# This is the main config file for this project:
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+insert_final_newline = true
+indent_style = space
+indent_size = 2
+trim_trailing_whitespace = true
+
+[*.{py, pyi}]
+indent_size = 4
+
+[*.md]
+trim_trailing_whitespace = false

contemplative-constellations/.gitattributes

@@ -0,0 +1,2 @@
+# (CRLF sucks, it's just a waste of a byte, Windows is stupid for using it)
+* text=auto eol=lf

contemplative-constellations/.github/scripts/normalize_coverage.py

@@ -0,0 +1,9 @@
+import sqlite3
+
+connection = sqlite3.connect(".coverage")
+
+# Normalize windows paths
+connection.execute("UPDATE file SET path = REPLACE(path, '\\', '/')")
+
+connection.commit()
+connection.close()

contemplative-constellations/.github/workflows/docker.yml

@@ -0,0 +1,94 @@
+name: Docker
+
+# This workflow uses actions that are not certified by GitHub.
+# They are provided by a third-party and are governed by
+# separate terms of service, privacy policy, and support
+# documentation.
+
+on: workflow_call
+
+env:
+  # Use docker.io for Docker Hub if empty
+  REGISTRY: ghcr.io
+  # github.repository as <account>/<repo>
+  IMAGE_NAME: ${{ github.repository }}
+
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+      # This is used to complete the identity challenge
+      # with sigstore/fulcio when running outside of PRs.
+      id-token: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      # Install the cosign tool except on PR
+      # https://github.com/sigstore/cosign-installer
+      - name: Install cosign
+        if: github.event_name != 'pull_request'
+        uses: sigstore/[email protected]
+        with:
+          cosign-release: 'v2.2.4'
+
+      # Set up BuildKit Docker container builder to be able to build
+      # multi-platform images and export cache
+      # https://github.com/docker/setup-buildx-action
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      # Allows us to build images with different cpu architectures than the github runner (arm64)
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
+      # Login against a Docker registry except on PR
+      # https://github.com/docker/login-action
+      - name: Log into registry ${{ env.REGISTRY }}
+        if: github.event_name != 'pull_request'
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      # Extract metadata (tags, labels) for Docker
+      # https://github.com/docker/metadata-action
+      - name: Extract Docker metadata
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+
+      # Build and push Docker image with Buildx (don't push on PR)
+      # https://github.com/docker/build-push-action
+      - name: Build and push Docker image
+        id: build-and-push
+        uses: docker/build-push-action@v6
+        with:
+          platforms: linux/amd64,linux/arm64
+          context: .
+          push: ${{ github.event_name != 'pull_request' }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+      # Sign the resulting Docker image digest except on PRs.
+      # This will only write to the public Rekor transparency log when the Docker
+      # repository is public to avoid leaking data.  If you would like to publish
+      # transparency data even for private images, pass --force to cosign below.
+      # https://github.com/sigstore/cosign
+      - name: Sign the published Docker image
+        if: ${{ github.event_name != 'pull_request' }}
+        env:
+          # https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable
+          TAGS: ${{ steps.meta.outputs.tags }}
+          DIGEST: ${{ steps.build-and-push.outputs.digest }}
+        # This step uses the identity token to provision an ephemeral certificate
+        # against the sigstore community Fulcio instance.
+        run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST}

contemplative-constellations/.github/workflows/main.yml

@@ -0,0 +1,74 @@
+---
+name: CI
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+  workflow_dispatch:
+
+# Cancel already running workflows if new ones are scheduled
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  validation:
+    uses: ./.github/workflows/validation.yml
+
+  unit-tests:
+    uses: ./.github/workflows/unit-tests.yml
+
+  pages:
+    uses: ./.github/workflows/pages.yml
+    needs: [unit-tests, validation]
+    permissions:
+      contents: write
+      pull-requests: write
+
+  docker:
+    uses: ./.github/workflows/docker.yml
+    needs: [unit-tests, validation]
+    permissions:
+      packages: write
+      contents: read
+      id-token: write
+
+  deploy-portainer:
+    runs-on: ubuntu-latest
+    needs: [docker]
+    env:
+      WEBHOOK: ${{ secrets.PORTAINER_WEBHOOK }}
+    if: (github.event_name == 'push' || github.event == 'workflow_dispatch') && github.ref == 'refs/heads/main'
+    steps:
+      - name: Trigger Portainer Webhook
+        if: env.WEBHOOK != ''
+        run: |
+          response=$(curl -s -X POST -o /dev/null -w "%{http_code}" ${{ secrets.PORTAINER_WEBHOOK }})
+          if [[ "$response" -lt 200 || "$response" -ge 300 ]]; then
+            echo "Webhook trigger failed with response code $response"
+            exit 1
+          fi
+
+  # Produce a pull request payload artifact with various data about the
+  # pull-request event (such as the PR number, title, author, ...).
+  # This data is then be picked up by status-embed.yml action.
+  pr_artifact:
+    name: Produce Pull Request payload artifact
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Prepare Pull Request Payload artifact
+        id: prepare-artifact
+        if: always() && github.event_name == 'pull_request'
+        continue-on-error: true
+        run: cat $GITHUB_EVENT_PATH | jq '.pull_request' > pull_request_payload.json
+
+      - name: Upload a Build Artifact
+        if: always() && steps.prepare-artifact.outcome == 'success'
+        continue-on-error: true
+        uses: actions/upload-artifact@v4
+        with:
+          name: pull-request-payload
+          path: pull_request_payload.json

contemplative-constellations/.github/workflows/pages.yml

@@ -0,0 +1,45 @@
+name: marp-to-pages
+concurrency: marp-to-pages
+
+on:
+  workflow_call:
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+    steps:
+
+      - name: Checkout code
+        uses: actions/checkout@v3
+
+      - name: Ensure build dir exists
+        run: mkdir -p build
+
+      - name: Copy images directory (if exists)
+        run: if [[ -d presentation/img ]]; then cp -R presentation/img build/img; fi
+
+      - name: Marp Build (README)
+        uses: docker://marpteam/marp-cli:v3.0.2
+        with:
+          args: presentation/presentation.md -o build/index.html
+        env:
+          MARP_USER: root:root
+
+      - name: Deploy preview
+        if: ${{ github.event_name == 'pull_request' }}
+        uses: rossjrw/pr-preview-action@v1
+        with:
+          source-dir: ./build/
+          preview-branch: gh-pages
+          umbrella-dir: pr-preview
+
+      - name: Deploy production
+        if: ${{ github.event_name == 'push' }}
+        uses: JamesIves/github-pages-deploy-action@v4
+        with:
+          branch: gh-pages
+          folder: ./build/
+          clean-exclude: pr-preview/

contemplative-constellations/.github/workflows/unit-tests.yml

@@ -0,0 +1,58 @@
+---
+name: Unit-Tests
+
+on: workflow_call
+
+jobs:
+  unit-tests:
+    runs-on: ${{ matrix.platform }}
+
+    strategy:
+      fail-fast: false # Allows for matrix sub-jobs to fail without cancelling the rest
+      matrix:
+        platform: [ubuntu-latest, windows-latest]
+        python-version: ["3.12"]
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Setup poetry
+        id: poetry_setup
+        uses: ItsDrike/setup-poetry@v1
+        with:
+          python-version: ${{ matrix.python-version }}
+          install-args: "--without lint"
+
+      - name: Run pytest
+        shell: bash
+        run: |
+          # Ignore exit code 5 (no tests found)
+          poetry run pytest -v || ([ $? = 5 ] && exit 0 || exit $?)
+
+          python .github/scripts/normalize_coverage.py
+          mv .coverage .coverage.${{ matrix.platform }}.${{ matrix.python-version }}
+
+      - name: Upload coverage artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: coverage.${{ matrix.platform }}.${{ matrix.python-version }}
+          path: .coverage.${{ matrix.platform }}.${{ matrix.python-version }}
+          retention-days: 1
+          if-no-files-found: error
+
+  tests-done:
+    needs: [unit-tests]
+    if: always() && !cancelled()
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Set status based on required jobs
+        env:
+          RESULTS: ${{ join(needs.*.result, ' ') }}
+        run: |
+          for result in $RESULTS; do
+            if [ "$result" != "success" ]; then
+              exit 1
+            fi
+          done

contemplative-constellations/.github/workflows/validation.yml

@@ -0,0 +1,45 @@
+---
+name: Validation
+
+on: workflow_call
+
+env:
+  PRE_COMMIT_HOME: "/home/runner/.cache/pre-commit"
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Setup poetry
+        id: poetry_setup
+        uses: ItsDrike/setup-poetry@v1
+        with:
+          python-version: 3.12
+
+      - name: Pre-commit Environment Caching
+        uses: actions/cache@v4
+        with:
+          path: ${{ env.PRE_COMMIT_HOME }}
+          key:
+            "precommit-${{ runner.os }}-${{ steps.poetry_setup.outputs.python-version }}-\
+            ${{ hashFiles('./.pre-commit-config.yaml') }}"
+          # Restore keys allows us to perform a cache restore even if the full cache key wasn't matched.
+          # That way we still end up saving new cache, but we can still make use of the cache from previous
+          # version.
+          restore-keys: "precommit-${{ runner.os }}-${{ steps.poetry_setup.outputs-python-version}}-"
+
+      - name: Run pre-commit hooks
+        run: SKIP=ruff-linter,ruff-formatter,basedpyright pre-commit run --all-files
+
+      - name: Run ruff linter
+        run: ruff check --output-format=github --show-fixes --exit-non-zero-on-fix .
+
+      - name: Run ruff formatter
+        run: ruff format --diff .
+
+      - name: Run basedpyright type checker
+        run: basedpyright --warnings .