Adopt Trusted Publishing; simplify pre-commit

.copier-answers.yml

@@ -1,6 +1,6 @@
 # WARNING: Do not edit this file manually.
 # Any changes will be overwritten by Copier.
-_commit: v0.3.1
+_commit: v0.4.1-1-gd3a985d
 _src_path: gh:easyscience/templates
 app_docs_url: https://easyscience.github.io/peasy-app
 app_doi: 10.5281/zenodo.18163581

.github/actions/publish-to-pypi/action.yml

@@ -1,13 +1,14 @@
 name: 'Publish to PyPI'
-description: 'Publish a built distribution to PyPI using pypa/gh-action-pypi-publish'
+description: 'Publish dist/ to PyPI via Trusted Publishing (OIDC)'
 inputs:
-  password:
-    description: 'PyPI API token (or password) for authentication'
-    required: true
+  packages_dir:
+    description: 'Directory containing the built packages to upload'
+    required: false
+    default: 'dist'
 
 runs:
   using: 'composite'
   steps:
     - uses: pypa/gh-action-pypi-publish@release/v1
       with:
-        password: ${{ inputs.password }}
+        packages-dir: ${{ inputs.packages_dir }}

.github/workflows/docs.yml

@@ -107,11 +107,8 @@ jobs:
       - name: Pre-build site step
         run: pixi run python -c "import easypeasy"
 
-      # Convert Python scripts in the docs/docs/tutorials/ directory to Jupyter
-      # notebooks.
-      # This step also strips any existing output from the notebooks and
-      # prepares them for documentation.
-      - name: Convert tutorial scripts to notebooks
+      # Prepare the Jupyter notebooks for documentation (strip output, etc.).
+      - name: Prepare notebooks
         run: pixi run notebook-prepare
 
       # Execute all Jupyter notebooks to generate output cells (plots, tables, etc.).

.github/workflows/pypi-publish.yml

@@ -14,6 +14,10 @@ jobs:
   pypi-publish:
     runs-on: ubuntu-latest
 
+    permissions:
+      contents: read
+      id-token: write # IMPORTANT: this permission is mandatory for trusted publishing
+
     steps:
       - name: Check-out repository
         uses: actions/checkout@v5
@@ -23,10 +27,18 @@ jobs:
       - name: Set up pixi
         uses: ./.github/actions/setup-pixi
 
+      # Build the Python package (to dist/ folder)
       - name: Create Python package
         run: pixi run default-build
 
+      # Publish the package to PyPI (from dist/ folder)
+      # Instead of publishing with personal access token, we use
+      # GitHub Actions OIDC to get a short-lived token from PyPI.
+      # New publisher must be previously configured in PyPI at
+      # https://pypi.org/manage/project/easypeasy/settings/publishing/
+      # Use the following data:
+      # Owner: easyscience
+      # Repository name: peasy-lib
+      # Workflow name: pypi-publish.yml
       - name: Publish to PyPI
         uses: ./.github/actions/publish-to-pypi
-        with:
-          password: ${{ secrets.PYPI_PASSWORD }}

.github/workflows/quality.yml

@@ -80,7 +80,7 @@ jobs:
         shell: bash
         run: pixi run nonpy-format-check
       # Check formatting of Jupyter Notebooks in the tutorials folder
-      - name: Convert tutorial scripts to notebooks and check formatting
+      - name: Prepare notebooks and check formatting
         id: check_notebooks_formatting
         continue-on-error: true
         shell: bash

.github/workflows/tutorial-tests.yml

@@ -46,7 +46,7 @@ jobs:
         shell: bash
         run: pixi run script-tests
 
-      - name: Convert tutorial scripts to notebooks
+      - name: Prepare notebooks
         shell: bash
         run: pixi run notebook-prepare
 

.pre-commit-config.yaml

@@ -1,60 +1,54 @@
 repos:
   - repo: local
     hooks:
-      # -----------------
-      # Pre-commit checks
-      # -----------------
+      # -------------
+      # Manual checks
+      # -------------
       - id: pixi-pyproject-check
         name: pixi run pyproject-check
         entry: pixi run pyproject-check
         language: system
         pass_filenames: false
-        stages: [pre-commit]
+        stages: [manual]
 
       - id: pixi-py-lint-check
-        name: pixi run py-lint-check-pre STAGED_FILES
-        entry: pixi run py-lint-check-pre
+        name: pixi run py-lint-check
+        entry: pixi run py-lint-check
         language: system
-        pass_filenames: true
-        files: ^(src/|tests/|docs/docs/tutorials/).*\.py$
-        stages: [pre-commit]
+        pass_filenames: false
+        stages: [manual]
 
       - id: pixi-py-format-check
-        name: pixi run py-format-check-pre STAGED_FILES
-        entry: pixi run py-format-check-pre
+        name: pixi run py-format-check
+        entry: pixi run py-format-check
         language: system
-        pass_filenames: true
-        files: ^(src/|tests/|docs/docs/tutorials/).*\.py$
-        stages: [pre-commit]
+        pass_filenames: false
+        stages: [manual]
 
       - id: pixi-nonpy-format-check
-        name: pixi run nonpy-format-check-pre STAGED_FILES
-        entry: pixi run nonpy-format-check-pre
+        name: pixi run nonpy-format-check
+        entry: pixi run nonpy-format-check
         language: system
-        pass_filenames: true
-        stages: [pre-commit]
+        pass_filenames: false
+        stages: [manual]
 
       - id: pixi-docs-format-check
-        name: pixi run docs-format-check-pre STAGED_FILES
-        entry: pixi run docs-format-check-pre
+        name: pixi run docs-format-check
+        entry: pixi run docs-format-check
         language: system
-        pass_filenames: true
-        files: ^(src/|docs/docs/tutorials/).*\.py$
-        stages: [pre-commit]
+        pass_filenames: false
+        stages: [manual]
 
-      # ----------------
-      # Pre-push checks
-      # ----------------
-      - id: pixi-nonpy-format-check
-        name: pixi run nonpy-format-check
-        entry: pixi run nonpy-format-check
+      - id: pixi-notebook-format-check
+        name: pixi run notebook-format-check
+        entry: pixi run notebook-format-check
         language: system
         pass_filenames: false
-        stages: [pre-push]
+        stages: [manual]
 
       - id: pixi-unit-tests
         name: pixi run unit-tests
         entry: pixi run unit-tests
         language: system
         pass_filenames: false
-        stages: [pre-push]
+        stages: [manual]

pixi.toml

@@ -99,12 +99,7 @@ py-format-check = "ruff format --check src/ tests/ docs/docs/tutorials/"
 nonpy-format-check = "npx prettier --list-different --config=prettierrc.toml --ignore-unknown ."
 nonpy-format-check-modified = "python tools/nonpy_prettier_modified.py"
 
-check = { depends-on = [
-  'py-format-check',
-  'docs-format-check',
-  'py-lint-check',
-  'nonpy-format-check-modified',
-] }
+check = 'pre-commit run --hook-stage manual --all-files'
 
 ##########
 # 🛠️ Fixes
@@ -122,7 +117,8 @@ fix = { depends-on = [
   'py-format-fix',
   'docs-format-fix',
   'py-lint-fix',
-  'nonpy-format-fix-modified',
+  'nonpy-format-fix',
+  'notebook-format-fix',
   'success-message-fix',
 ] }
 
@@ -194,19 +190,6 @@ copier-update = "copier update --data-file ../peasy/.copier-answers.yml --data t
 # 🪝 Pre-commit Hooks
 #####################
 
-# Pre-commit hook commands (to be used in .pre-commit-config.yaml)
-py-lint-check-pre = 'ruff check'
-py-format-check-pre = "ruff format --check"
-nonpy-format-check-pre = "npx prettier --list-different --config=prettierrc.toml --ignore-unknown"
-docs-format-check-pre = 'docformatter --check'
-
-# Run like a real commit: staged files only (almost)
-pre-commit-check = 'pre-commit run --hook-stage pre-commit'
-# CI check: lint/format everything
-pre-commit-check-all = 'pre-commit run --all-files --hook-stage pre-commit'
-# Pre-push check: lint/format everything
-pre-push-check = 'pre-commit run --all-files --hook-stage pre-push'
-
 pre-commit-clean = 'pre-commit clean'
 pre-commit-install = 'pre-commit install --hook-type pre-commit --hook-type pre-push --overwrite'
 pre-commit-uninstall = 'pre-commit uninstall --hook-type pre-commit --hook-type pre-push'
@@ -234,7 +217,7 @@ spdx-update = 'python tools/update_spdx.py'
 post-install = { depends-on = [
   'npm-config',
   'prettier-install',
-  'pre-commit-setup',
+  #'pre-commit-setup',
 ] }
 
 ##########################