Fast-forward cookiecutter

.cruft.json

@@ -1,6 +1,6 @@
 {
   "template": "https://github.com/Ouranosinc/cookiecutter-pypackage",
-  "commit": "5b62e2c2d1cf5d779f1cd4a59f3be4c20215be16",
+  "commit": "770fc5056ab143530fcee23d7914551956916b8d",
   "checkout": null,
   "context": {
     "cookiecutter": {
@@ -35,7 +35,7 @@
         ".github/workflows/workflow-warning.yml"
       ],
       "_template": "https://github.com/Ouranosinc/cookiecutter-pypackage",
-      "_commit": "5b62e2c2d1cf5d779f1cd4a59f3be4c20215be16"
+      "_commit": "770fc5056ab143530fcee23d7914551956916b8d"
     }
   },
   "directory": null

.github/workflows/auto-accept-ci-changes.yml

@@ -35,6 +35,8 @@ jobs:
         with:
           app-id: ${{ secrets.HYDROLOGIE_HELPER_BOT_ID }}
           private-key: ${{ secrets.HYDROLOGIE_HELPER_BOT_KEY }}
+          permission-contents: write
+          permission-pull-requests: write
 
       - name: Fetch Dependabot metadata
         id: dependabot-metadata

.github/workflows/bump-version.yml

@@ -43,7 +43,7 @@ jobs:
     runs-on: ubuntu-latest
     environment: automation
     permissions:
-      actions: read
+      contents: write
     strategy:
       matrix:
         python-version: [ "3.13" ]
@@ -65,6 +65,7 @@ jobs:
         with:
           app-id: ${{ secrets.HYDROLOGIE_HELPER_BOT_ID }}
           private-key: ${{ secrets.HYDROLOGIE_HELPER_BOT_KEY }}
+          permission-contents: write
 
       - name: Checkout Repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

.github/workflows/tag-testpypi.yml

@@ -56,13 +56,7 @@ jobs:
         uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
         with:
           disable-sudo: true
-          egress-policy: block
-          allowed-endpoints: >
-            files.pythonhosted.org:443
-            github.com:443
-            pypi.org:443
-            ruf-repo-cdn.sigstore.dev:443
-            test.pypi.org:443
+          egress-policy: audit
 
       - name: Checkout Repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

.readthedocs.yml

@@ -11,10 +11,12 @@ sphinx:
   fail_on_warning: true
 
 build:
-  os: "ubuntu-24.04"
+  os: "ubuntu-26.04"
   tools:
-    python: "mambaforge-23.11"
+    python: "miniforge3-25.11"
   jobs:
+    post_create_environment:
+      - python -m pip install --group docs
     pre_build:
       - sphinx-apidoc -o docs/apidoc --private --module-first src/hsamiplus
       - sphinx-build -M gettext docs docs/_build
@@ -26,5 +28,3 @@ python:
   install:
     - method: pip
       path: .
-      extra_requirements:
-        - dev

CHANGELOG.rst

@@ -20,6 +20,15 @@ Changes
     * `tox` now uses the TOML spec for configuration.
     * `Makefile` now handles more dependency management operations.
     * Added generative AI contribution information and model guidance files (`AGENTS.md` and `AI_POLICY.md`).
+* `hsamiplus` now has guidance documents on acceptable usages of AI and the expected methods of AI usage disclosure. See the documentation for more details. (#114).
+* Updated the cookiecutter template to use the latest commit. (#114):
+    * Adjusted the permissions for some workflows to address security issues.
+    * Added the new "standard" AI disclosure guidance for code contributions.
+    * Updated the ReadTheDocs configuration to use newer OS and conda images.
+    * Modified ``make servedocs`` to use `sphinx-autobuild` (``make livehtml``).
+    * Added guidance for maintainers on git commit signing and immutable releases.
+    * Adjusted the source distribution inclusion/exclusion list.
+    * Set `bump-my-version` to sign tags by default.
 
 Fixes
 ^^^^^

CONTRIBUTING.rst

@@ -193,7 +193,7 @@ Before you submit a pull request, check that it meets these guidelines:
 
 #. The pull request should work for all currently supported Python versions. Check the `pyproject.toml` or `tox.ini` files for the list of supported versions.
 
-#. If you haven't already, ensure that you have read and agreed to the `Developer Certificate of Origin (DCO) <https://developercertificate.org/>`_, and that you have signed your commits using:
+#. If you haven't already, ensure that you have read and agreed to the `Developer Certificate of Origin (DCO) <https://developercertificate.org/>`_, and that you have signed off on your commits using:
 
     .. code-block:: bash
 

Makefile

@@ -109,7 +109,7 @@ ifndef READTHEDOCS
 endif
 
 servedocs: autodoc ## compile the docs while watching for changes
-	watchmedo shell-command -p '*.rst' -c '$(MAKE) -C docs html' -R -D .
+	$(MAKE) -C docs livehtml
 
 dist: clean ## builds source and wheel package
 	python -m flit build

docs/Makefile

@@ -18,3 +18,6 @@ help:
 # "make mode" option.  $(O) is meant as a shortcut for $(SPHINXOPTS).
 %: Makefile
 	@$(SPHINXBUILD) -M $@ "$(SOURCEDIR)" "$(BUILDDIR)" $(SPHINXOPTS) $(O)
+
+livehtml:
+	sphinx-autobuild --port 54345 --open-browser --delay 3 --re-ignore "$(BUILDDIR)|apidoc|Makefile|__pycache__" "$(SOURCEDIR)" "$(BUILDDIR)" $(SPHINXOPTS) $(O)

docs/index.rst

@@ -1,9 +1,20 @@
 Welcome to hsamiplus's documentation!
 =====================================
 
+**hsamiplus**: Python Boilerplate contains all the boilerplate you need to create a Python package.
+
+Need help?
+^^^^^^^^^^
+
+* If you encounter any errors or problems with `hsamiplus`, please let us know! Open an issue at the `GitHub main repository <https://github.com/hydrologie/hsamiplus>`_.
+* To be aware of changes in `hsamiplus`, feel free to “watch” the GitHub repository. You can customize the watch function to notify you of new releases or more.
+
+Navigation
+==========
+
 .. toctree::
    :maxdepth: 2
-   :caption: Contents:
+   :caption: Table of Contents
 
    readme
    installation

docs/releasing.rst

@@ -11,6 +11,13 @@ A reminder for the **maintainers** on how to deploy. This section is only releva
 
     It is important to be aware that any changes to files found within the ``src/hsamiplus`` folder (with the exception of ``src/hsamiplus/__init__.py``) will trigger the ``bump-version.yml`` workflow. Be careful not to commit changes to files in this folder when preparing a new release.
 
+.. note::
+
+    Before beginning, it is a good idea to practice `commit signing`_ at the very least for _tags_ and _releases_. This is a method of cryptographically signing your work to ensure that packages can verifiably be traced to a known and trusted developer.
+    Once a GPG key has been `created`_ and `added`_ to your GitHub profile, you can enable GPG signing for all commits by launching `$ git config --local/--global commit.gpgsign true` within a shell running in your local clone (or anywhere if `--global`).
+
+For creating tags and releases, we **strongly recommend** enabling the "release immutability" option in the repository settings. This prevents _tags_ and _releases_ from being modified of GitHub after they have been published.
+
 #. Create a new branch from `main` (e.g. `release-0.2.0`).
 #. Update the `CHANGELOG.rst` file to change the `Unreleased` section to the current date.
 #. Bump the version in your branch to the next version (e.g. `v0.1.0 -> v0.2.0`):
@@ -26,16 +33,20 @@ A reminder for the **maintainers** on how to deploy. This section is only releva
 
     .. code-block:: console
 
-        git tag v0.2.0
+        git tag -s/--sign "v0.2.0" -m "Release v0.2.0"
         git push --tags
 
    This will trigger a GitHub workflow to build the package and upload it to TestPyPI. At the same time, the GitHub workflow will create a draft release on GitHub. Assuming that the workflow passes, the final release can then be published on GitHub by finalizing the draft release.
 
-#. Once the release is published, the `publish-pypi.yml` workflow will go into an `awaiting approval` mode on Github Actions. Only authorized users may approve this workflow (notifications will be sent) to trigger the upload to PyPI.
+#. Once the release is **published**, the `publish-pypi.yml` workflow will go into an `awaiting approval` mode on Github Actions. Only authorized users may approve this workflow (notifications will be sent) to trigger the upload to PyPI.
 
 .. warning::
 
-    Uploads to PyPI can **never** be overwritten. If you make a mistake, you will need to bump the version and re-release the package. If the package uploaded to PyPI is broken, you should modify the GitHub release to mark the package as broken, as well as yank the package (mark the version "broken") on PyPI.
+    Uploads to PyPI (and releases on GitHub if using release immutability) can **never** be overwritten. If you make a mistake, you will need to bump the version and re-release the package. If the package uploaded to GitHub and PyPI is broken, you should modify the GitHub release to mark the package as broken, as well as yank the package (mark the version "broken") on PyPI.
+
+.. _`commit signing`: https://git-scm.com/book/en/v2/Git-Tools-Signing-Your-Work
+.. _created: https://docs.github.com/en/authentication/managing-commit-signature-verification/generating-a-new-gpg-key
+.. _added: https://docs.github.com/en/authentication/managing-commit-signature-verification/adding-a-gpg-key-to-your-github-account
 
 Packaging
 ---------

environment-docs.yml

@@ -8,6 +8,7 @@ dependencies:
   - ipython >=8.5.0
   - nbsphinx >=0.9.5
   - sphinx >=8.2
+  - sphinx-autobuild >=2024.4.16
   - sphinx-codeautolink >=0.16.2
   - sphinx-copybutton >=0.5.2
   - sphinx-intl

pyproject.toml

@@ -29,6 +29,7 @@ docs = [
   "jupyter_client",
   "nbsphinx >=0.9.8",
   "sphinx >=8.2.0",
+  "sphinx-autobuild >=2024.4.16",
   "sphinx-codeautolink >=0.16.2",
   "sphinx-copybutton >=0.5.2",
   "sphinx-intl",
@@ -109,6 +110,7 @@ commit = true
 commit_args = "--no-verify"
 tag = false
 tag_name = "v{new_version}"
+sign_tags = true
 allow_dirty = true
 parse = "(?P<major>\\d+)\\.(?P<minor>\\d+)\\.(?P<patch>\\d+)(\\-(?P<release>[a-z]+)(\\.(?P<build>\\d+)))?"
 serialize = [
@@ -200,34 +202,36 @@ include = [
   ".zenodo.json",
   "AUTHORS.rst",
   "CHANGELOG.rst",
+  "CITATION.cff",
+  "CODE_OF_CONDUCT.md",
   "CONTRIBUTING.rst",
   "LICENSE",
   "Makefile",
   "README.rst",
   "environment-dev.yml",
   "environment-docs.yml",
-  "docs/_static/_images/*.gif",
-  "docs/_static/_images/*.jpg",
-  "docs/_static/_images/*.png",
-  "docs/_static/_images/*.rst",
-  "docs/Makefile",
+  "docs/_static/*",
+  "docs/*.rst",
   "docs/conf.py",
   "docs/make.bat",
+  "docs/Makefile",
+  "pyproject.toml",
   "src/hsamiplus",
   "tests/*.py",
   "tox.toml"
 ]
 exclude = [
   "*.py[co]",
   "__pycache__",
-  ".coveralls.yml",
   ".editorconfig",
   ".flake8",
+  ".github",
   ".gitignore",
   ".pre-commit-config.yaml",
   ".readthedocs.yml",
   ".yamllint.yaml",
   ".zizmor.yml",
+  "CI/requirements_ci.*",
   "docs/_*",
   "docs/apidoc/modules.rst",
   "docs/apidoc/hsamiplus*.rst",