fix: check daily if update is due based on UPDATE_INTERVAL

.github/workflows/build-and-push.yml

@@ -25,6 +25,7 @@ jobs:
               uses: actions/checkout@v6
               with:
                   ref: ${{ github.ref }}
+                  persist-credentials: false
 
             - name: Set up Docker Buildx
               uses: docker/setup-buildx-action@v3
@@ -54,26 +55,26 @@ jobs:
                     fi
                     echo "Read photon version from .last_release: $PHOTON_VERSION"
                   else
-                    PHOTON_VERSION="${{ github.event.inputs.photon_version }}"
+                    PHOTON_VERSION="${GITHUB_EVENT_INPUTS_PHOTON_VERSION}"
                     if [[ -z "$PHOTON_VERSION" ]]; then
                       echo "Error: PHOTON_VERSION must be provided when .last_release file is missing"
                       exit 1
                     fi
                   fi
 
                   if [ "${{ github.event_name }}" == "release" ]; then
-                    CONTAINER_VERSION="${{ github.event.release.tag_name }}"
+                    CONTAINER_VERSION="${GITHUB_EVENT_RELEASE_TAG_NAME}"
                     CONTAINER_VERSION="${CONTAINER_VERSION#v}"
                     IS_PRERELEASE="${{ github.event.release.prerelease }}"
-                  elif [ "${{ github.event_name }}" == "push" ] && [ "${{ github.ref }}" == "refs/heads/dev" ]; then
+                  elif [ "${{ github.event_name }}" == "push" ] && [ "${GITHUB_REF}" == "refs/heads/dev" ]; then
                     SHORT_SHA=$(echo "${{ github.sha }}" | cut -c1-7)
                     CONTAINER_VERSION="dev-${SHORT_SHA}"
                     IS_PRERELEASE="true"
                   elif [ "${{ github.event_name }}" == "pull_request" ]; then
                     CONTAINER_VERSION="pr-${{ github.event.pull_request.number }}"
                     IS_PRERELEASE="true"
                   else
-                    CONTAINER_VERSION="${{ github.event.inputs.container_version }}"
+                    CONTAINER_VERSION="${GITHUB_EVENT_INPUTS_CONTAINER_VERSION}"
                     CONTAINER_VERSION="${CONTAINER_VERSION#v}"
 
                     if [[ "$CONTAINER_VERSION" == *"-beta"* ]]; then
@@ -90,20 +91,24 @@ jobs:
                   echo "Container Version: $CONTAINER_VERSION"
                   echo "Photon Version: $PHOTON_VERSION"
                   echo "Is Prerelease: $IS_PRERELEASE"
+              env:
+                GITHUB_EVENT_INPUTS_PHOTON_VERSION: ${{ github.event.inputs.photon_version }}
+                GITHUB_EVENT_RELEASE_TAG_NAME: ${{ github.event.release.tag_name }}
+                GITHUB_EVENT_INPUTS_CONTAINER_VERSION: ${{ github.event.inputs.container_version }}
 
             - name: Generate Docker tags with semver support
               id: generate_tags
               run: |
-                  CONTAINER_VERSION="${{ env.CONTAINER_VERSION }}"
-                  IS_PRERELEASE="${{ env.IS_PRERELEASE }}"
+                  CONTAINER_VERSION="${CONTAINER_VERSION}"
+                  IS_PRERELEASE="${IS_PRERELEASE}"
 
                   REPO_NAME="${{ github.repository }}"
                   DOCKERHUB_REPO="${REPO_NAME,,}"
                   GHCR_REPO="ghcr.io/${REPO_NAME,,}"
 
                   TAGS="$DOCKERHUB_REPO:$CONTAINER_VERSION,$GHCR_REPO:$CONTAINER_VERSION"
 
-                  if [ "${{ github.event_name }}" == "push" ] && [ "${{ github.ref }}" == "refs/heads/dev" ]; then
+                  if [ "${{ github.event_name }}" == "push" ] && [ "${GITHUB_REF}" == "refs/heads/dev" ]; then
                     TAGS="$TAGS,$DOCKERHUB_REPO:dev,$GHCR_REPO:dev"
                   elif [ "$IS_PRERELEASE" == "true" ]; then
                     TAGS="$TAGS,$DOCKERHUB_REPO:beta,$GHCR_REPO:beta"
@@ -143,7 +148,7 @@ jobs:
               run: |
                   echo "## Docker Build Summary" >> $GITHUB_STEP_SUMMARY
                   echo "- **Event:** ${{ github.event_name }}" >> $GITHUB_STEP_SUMMARY
-                  echo "- **Container Version:** ${{ env.CONTAINER_VERSION }}" >> $GITHUB_STEP_SUMMARY
-                  echo "- **Photon Version:** ${{ env.PHOTON_VERSION }}" >> $GITHUB_STEP_SUMMARY
-                  echo "- **Is Prerelease:** ${{ env.IS_PRERELEASE }}" >> $GITHUB_STEP_SUMMARY
-                  echo "- **Tags:** ${{ env.DOCKER_TAGS }}" >> $GITHUB_STEP_SUMMARY
+                  echo "- **Container Version:** ${CONTAINER_VERSION}" >> $GITHUB_STEP_SUMMARY
+                  echo "- **Photon Version:** ${PHOTON_VERSION}" >> $GITHUB_STEP_SUMMARY
+                  echo "- **Is Prerelease:** ${IS_PRERELEASE}" >> $GITHUB_STEP_SUMMARY
+                  echo "- **Tags:** ${DOCKER_TAGS}" >> $GITHUB_STEP_SUMMARY

.github/workflows/check-releases.yml

@@ -15,6 +15,8 @@ jobs:
         steps:
             - name: Checkout Repository
               uses: actions/checkout@v6
+              with:
+                persist-credentials: false
 
             - name: Check for new Photon release
               id: check_release
@@ -43,26 +45,28 @@ jobs:
             - name: Determine if update is needed
               id: prepare_update
               run: |
-                  if [[ -n "${{ env.latest_release_version }}" && "${{ env.latest_release_version }}" != "${{ env.last_processed_version }}" ]]; then
-                    echo "New version found: ${{ env.latest_release_version }}. (Previous: ${{ env.last_processed_version }})"
+                  if [[ -n "${LATEST_RELEASE_VERSION}" && "${LATEST_RELEASE_VERSION}" != "${LAST_PROCESSED_VERSION}" ]]; then
+                    echo "New version found: ${LATEST_RELEASE_VERSION}. (Previous: ${LAST_PROCESSED_VERSION})"
                     {
                       echo "update_needed=true"
-                      echo "new_version=${{ env.latest_release_version }}"
-                      echo "new_branch_name=update-photon-${{ env.latest_release_version }}"
+                      echo "new_version=${LATEST_RELEASE_VERSION}"
+                      echo "new_branch_name=update-photon-${LATEST_RELEASE_VERSION}"
                     } >> "$GITHUB_OUTPUT"
                   else
-                    echo "No new Photon release detected or version is already up-to-date. Latest fetched: '${{ env.latest_release_version }}', last processed: '${{ env.last_processed_version }}'."
+                    echo "No new Photon release detected or version is already up-to-date. Latest fetched: '${LATEST_RELEASE_VERSION}', last processed: '${LAST_PROCESSED_VERSION}'."
                     {
                       echo "update_needed=false"
-                      echo "new_version=${{ env.last_processed_version }}"
+                      echo "new_version=${LAST_PROCESSED_VERSION}"
                     } >> "$GITHUB_OUTPUT"
                   fi
 
             - name: Update release file(s) locally
               if: steps.prepare_update.outputs.update_needed == 'true'
               run: |
-                  echo "Updating .last_release to ${{ steps.prepare_update.outputs.new_version }}"
-                  echo "${{ steps.prepare_update.outputs.new_version }}" > .last_release
+                  echo "Updating .last_release to ${STEPS_PREPARE_UPDATE_OUTPUTS_NEW_VERSION}"
+                  echo "${STEPS_PREPARE_UPDATE_OUTPUTS_NEW_VERSION}" > .last_release
+              env:
+                STEPS_PREPARE_UPDATE_OUTPUTS_NEW_VERSION: ${{ steps.prepare_update.outputs.new_version }}
 
             - name: Create Pull Request
               if: steps.prepare_update.outputs.update_needed == 'true'

.github/workflows/full-test.yml

@@ -19,6 +19,8 @@ jobs:
         steps:
             - name: Checkout Repository
               uses: actions/checkout@v6
+              with:
+                persist-credentials: false
 
             - name: Set up Docker Buildx
               uses: docker/setup-buildx-action@v3
@@ -98,5 +100,7 @@ jobs:
               run: |
                   echo "## Container Test Summary" >> $GITHUB_STEP_SUMMARY
                   echo "- **PR Number:** ${{ github.event.pull_request.number }}" >> $GITHUB_STEP_SUMMARY
-                  echo "- **Photon Version:** ${{ env.PHOTON_VERSION }}" >> $GITHUB_STEP_SUMMARY
-                  echo "- **Status:** ${{ job.status }}" >> $GITHUB_STEP_SUMMARY
+                  echo "- **Photon Version:** ${PHOTON_VERSION}" >> $GITHUB_STEP_SUMMARY
+                  echo "- **Status:** ${JOB_STATUS}" >> $GITHUB_STEP_SUMMARY
+              env:
+                JOB_STATUS: ${{ job.status }}

.github/workflows/lint.yml

@@ -12,6 +12,8 @@ jobs:
         runs-on: ubuntu-latest
         steps:
             - uses: actions/checkout@v6
+              with:
+                persist-credentials: false
             - name: "Set up Python"
               uses: actions/setup-python@v6
               with:
@@ -36,6 +38,8 @@ jobs:
         needs: setup
         steps:
             - uses: actions/checkout@v6
+              with:
+                persist-credentials: false
             - name: "Set up Python"
               uses: actions/setup-python@v6
               with:
@@ -63,6 +67,8 @@ jobs:
         needs: setup
         steps:
             - uses: actions/checkout@v6
+              with:
+                persist-credentials: false
             - name: "Set up Python"
               uses: actions/setup-python@v6
               with:
@@ -87,6 +93,8 @@ jobs:
         needs: setup
         steps:
             - uses: actions/checkout@v6
+              with:
+                persist-credentials: false
             - name: "Set up Python"
               uses: actions/setup-python@v6
               with:

.github/workflows/pytest.yml

@@ -16,6 +16,8 @@ jobs:
         runs-on: ubuntu-latest
         steps:
             - uses: actions/checkout@v6
+              with:
+                persist-credentials: false
 
             - name: Set up Python
               uses: actions/setup-python@v6

.github/workflows/release-drafter.yml

@@ -16,6 +16,8 @@ jobs:
         steps:
             - name: Checkout Repository
               uses: actions/checkout@v6
+              with:
+                persist-credentials: false
 
             - name: Run Release Drafter
               id: release-drafter
@@ -28,13 +30,14 @@ jobs:
               env:
                   GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
                   DRAFT_BODY: ${{ steps.release-drafter.outputs.body }}
+                  STEPS_RELEASE_DRAFTER_OUTPUTS_ID: ${{ steps.release-drafter.outputs.id }}
               run: |
                   PHOTON_VERSION=$(tr -d '[:space:]' < .last_release)
                   {
                     printf '%s' "$DRAFT_BODY"
-                    printf '\n\n---\n **Upstream Photon release notes (%s):** https://github.com/komoot/photon/releases/tag/%s\n' \
+                    printf '\n\n---\n **[Photon release notes](https://github.com/komoot/photon/releases/tag/%s) (%s):** \n' \
                       "$PHOTON_VERSION" "$PHOTON_VERSION"
                   } > /tmp/new_body.txt
-                  gh api "repos/${{ github.repository }}/releases/${{ steps.release-drafter.outputs.id }}" \
+                  gh api "repos/${{ github.repository }}/releases/${STEPS_RELEASE_DRAFTER_OUTPUTS_ID}" \
                     --method PATCH \
                     --field body=@/tmp/new_body.txt

.pre-commit-config.yml

@@ -0,0 +1,21 @@
+repos:
+    - repo: https://github.com/pre-commit/pre-commit-hooks
+      rev: v6.0.0
+      hooks:
+          - id: trailing-whitespace
+          - id: check-yaml
+          - id: end-of-file-fixer
+
+    - repo: https://github.com/astral-sh/ruff-pre-commit
+      rev: v0.15.4
+      hooks:
+          - id: ruff-check
+            args: [--fix]
+            files: "\\.py$"
+          - id: ruff-format
+            files: "\\.py$"
+
+    - repo: https://github.com/rhysd/actionlint
+      rev: v1.7.11
+      hooks:
+          - id: actionlint

Dockerfile

@@ -1,7 +1,7 @@
 FROM eclipse-temurin:21.0.9_10-jre-noble
 
 # install astral uv
-COPY --from=ghcr.io/astral-sh/uv:0.8 /uv /usr/local/bin/
+COPY --from=ghcr.io/astral-sh/uv:0.10 /uv /usr/local/bin/
 
 ARG DEBIAN_FRONTEND=noninteractive
 ARG PHOTON_VERSION

pyproject.toml

@@ -35,7 +35,6 @@ line-length = 120
 ignore = [
     "ANN",  # flake8-annotations
     "COM",  # flake8-commas
-    "C90",  # mccabe complexity
     "DJ",  # django
     "EXE",  # flake8-executable
     "BLE",  # blind except

renovate.json

@@ -1,14 +1,58 @@
 {
-    "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-    "extends": [
-        "config:recommended",
-        "helpers:pinGitHubActionDigests",
-        ":configMigration",
-        ":pinDevDependencies",
-        "abandonments:recommended",
-        ":enablePreCommit"
-    ],
-    "baseBranchPatterns": [
-        "dev"
-    ]
+	"$schema": "https://docs.renovatebot.com/renovate-schema.json",
+	"extends": ["config:best-practices", ":enablePreCommit"],
+	"prConcurrentLimit": 0,
+	"prCreation": "not-pending",
+	"rebaseWhen": "behind-base-branch",
+	"labels": ["renovate"],
+	"baseBranchPatterns": ["dev"],
+	"useBaseBranchConfig": "merge",
+	"internalChecksFilter": "strict",
+	"minimumReleaseAge": "3 days",
+	"packageRules": [
+		{
+			"matchUpdateTypes": ["patch"],
+			"addLabels": ["dependencies", "patch"],
+			"minimumReleaseAge": "3 days"
+		},
+		{
+			"matchUpdateTypes": ["minor"],
+			"addLabels": ["dependencies", "minor"],
+			"minimumReleaseAge": "3 days"
+		},
+		{
+			"matchUpdateTypes": ["major"],
+			"addLabels": ["dependencies", "major"],
+			"minimumReleaseAge": "7 days"
+		},
+		{
+			"matchDepTypes": ["devDependencies", "dev"],
+			"matchUpdateTypes": ["minor", "patch"],
+			"matchCurrentVersion": "!/^0/",
+			"automerge": true
+		},
+		{
+			"matchPackageNames": ["ruff", "astral-sh/ruff-pre-commit"],
+			"groupName": "ruff"
+		},
+		{
+			"groupName": "Python Version",
+			"matchPackageNames": ["python"],
+			"matchManagers": ["custom.regex", "pyenv", "pep621"]
+		}
+	],
+
+	"customManagers": [
+		{
+			// updates ruff target version
+			"customType": "regex",
+			"managerFilePatterns": ["/^pyproject\\.toml$/"],
+			"matchStrings": ["target-version = \"py3(?<minor>\\d+)\""],
+			"currentValueTemplate": "3.{{{minor}}}",
+			"autoReplaceStringTemplate": "target-version = \"py3{{{replace '.' '' newValue}}}\"",
+			"depNameTemplate": "python",
+			"datasourceTemplate": "python-version",
+			"versioningTemplate": "python"
+		}
+	]
 }