stub component and ci basics

.dockerignore

@@ -0,0 +1,10 @@
+**/.venv
+**/.tmp
+**/.idea
+**/.vscode
+**/*.pyc
+
+*/src/python/*.egg-info
+*/dist/
+
+.git

.envrc

@@ -0,0 +1,11 @@
+source_up
+layout_uv
+
+export PIP_DISABLE_PIP_VERSION_CHECK=1
+export PYTHONDONTWRITEBYTECODE=1
+
+# Should give us the path to the root of the component even if someone CDs deeper into the path
+SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
+
+# If we want executables outside of python, we put them in the `bin/` directory
+export PATH="${SCRIPT_DIR}/bin:$PATH"

.github/actions/setup-environment/action.yaml

@@ -0,0 +1,78 @@
+name: "Setup Environment"
+description: |
+  Install tools and define common variables.
+outputs:
+  package-version:
+    description: "a generated version usable for publishing packages and containers"
+    value: ${{ steps.runner-context.outputs.package-version }}
+runs:
+  using: "composite"
+  steps:
+    - id: runner-context
+      name: runner-context
+      shell: bash
+      env:
+        COMMIT_TIMESTAMP: ${{ github.event.head_commit.timestamp }}
+        # github.head_ref only exists in PR builds
+        # github.ref_name only exists in branch builds (main)
+        COMMIT_REF: "${{ github.head_ref || github.ref_name }}"
+        RUN_ID: "${{ github.run_id }}"
+        IS_PR_BUILD: "${{ github.event_name == 'pull_request' && '1' || '0' }}"
+        # we are calling tagged versions and main branch builds both "main" builds
+        IS_MAIN_BUILD: "${{ github.event_name == 'push' && '1' || '0' }}"
+        BASE_SHA: "${{ github.event.pull_request.base.sha || github.event.before }}"
+        HEAD_SHA: "${{ github.event.pull_request.head.sha || github.event.after }}"
+      run: |
+        # make sure people are able to use packages installed with `uv tool install`
+        export PATH="${HOME}/.local/bin:$PATH"
+        echo "${HOME}/.local/bin" >> $GITHUB_PATH
+        export PATH="${PWD}/bin:$PATH"
+        echo "${PWD}/bin" >> $GITHUB_PATH
+
+        TOML_VERSION=$(grep -m 1 version pyproject.toml | tr -s " " | tr -d '"' | tr -d "'" | cut -d" " -f3)
+        MAIN_BUILD_VERSION="$TOML_VERSION.pre$RUN_ID"
+        PR_BUILD_VERSION="$(date --date "$COMMIT_TIMESTAMP" "+$TOML_VERSION.pre$RUN_ID.dev%Y%m%d%H%M%S")"
+
+        echo "timestamp: $COMMIT_TIMESTAMP"
+        echo "commit ref: $COMMIT_REF"
+        echo "version found in toml: $TOML_VERSION"
+        echo "version calculated for main branch builds: $MAIN_BUILD_VERSION"
+        echo "version calculated for pr builds: $PR_BUILD_VERSION"
+        echo "runid: $RUN_ID"
+
+        if  [[ $COMMIT_REF == "v$TOML_VERSION" ]] ;
+        then
+          echo "detected tag build: $COMMIT_REF"
+          PACKAGE_VERSION=$TOML_VERSION
+        elif [[ $COMMIT_REF == "main" ]] ;
+        then
+          echo "detected main branch build"
+          echo "will generate a release candidate"
+          # if the package is installed with "allow-prereleases", the latest version of this branch is used
+          PACKAGE_VERSION=$MAIN_BUILD_VERSION
+        else
+          echo "detected branch build"
+          echo "will generate a dev version"
+          # these version numbers are only installable by specifying the full version string
+          PACKAGE_VERSION=$PR_BUILD_VERSION
+        fi
+
+        echo "generating context for version: $PACKAGE_VERSION"
+        echo "package-version=$PACKAGE_VERSION" >> $GITHUB_OUTPUT
+        echo "is-pr-build=$IS_PR_BUILD" >> $GITHUB_OUTPUT
+        echo "is-main-build=$IS_MAIN_BUILD" >> $GITHUB_OUTPUT
+        echo "base-sha=$BASE_SHA" >> $GITHUB_OUTPUT
+        echo "head-sha=$HEAD_SHA" >> $GITHUB_OUTPUT
+    - name: "install-uv"
+      uses: astral-sh/setup-uv@v6
+      with:
+        version: "0.9"
+    - id: "update-docker-data-root"
+      name: "update-docker-data-root"
+      shell: bash
+      run: |
+        sudo systemctl stop docker docker.socket
+        sudo mkdir -p /mnt/docker-data
+        sudo chmod 711 /mnt/docker-data
+        echo '{ "data-root": "/mnt/docker-data" }' | sudo tee /etc/docker/daemon.json
+        sudo systemctl start docker

.github/dependabot.yaml

@@ -0,0 +1,26 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    target-branch: main
+    groups:
+      github-actions:
+        patterns:
+          - "*"
+    commit-message:
+      prefix: ":arrow_up: dep-bump"
+      include: scope
+  - package-ecosystem: pip
+    directory: /
+    schedule:
+      interval: weekly
+    target-branch: main
+    groups:
+      package-dependencies:
+        patterns:
+          - "*"
+    commit-message:
+      prefix: ":arrow_up: dep-bump"
+      include: scope

.github/policies/branch-protection.yml

@@ -0,0 +1,13 @@
+# Documentation for branch policy: https://aka.ms/gim/docs/policy/branch-protection
+
+name: main branch policy
+description: restrict permissions to main branch
+resource: repository
+where:
+configuration:
+  branchProtectionRules:
+    - branchNamePattern: "main"
+      requiredApprovingReviewsCount: 1
+      restrictsPushes: false
+      allowsForcePushes: false
+      allowsDeletions: false

.github/workflows/automerge.yml

@@ -0,0 +1,23 @@
+name: Dependabot auto-merge
+on: pull_request
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  dependabot:
+    runs-on: "ubuntu-24.04"
+    if: github.event.pull_request.user.login == 'dependabot[bot]' && github.repository == 'microsoft/SNRAware'
+    steps:
+      - name: Dependabot metadata
+        id: metadata
+        uses: dependabot/fetch-metadata@v2
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+      - name: Enable auto-merge for Dependabot PRs
+        if: steps.metadata.outputs.update-type == 'version-update:semver-patch' || steps.metadata.outputs.update-type == 'version-update:semver-minor'
+        run: gh pr merge --auto --rebase "$PR_URL"
+        env:
+          PR_URL: ${{ github.event.pull_request.html_url }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/build-containers.yaml

@@ -0,0 +1,37 @@
+name: Build Containers
+on:
+  workflow_dispatch:
+    inputs:
+      sha:
+        description: 'the git sha to checkout'
+        required: true
+        type: string
+  workflow_call:
+    inputs:
+      sha:
+        description: 'the git sha to checkout'
+        required: true
+        type: string
+jobs:
+  build-containers:
+    runs-on: "ubuntu-24.04"
+    steps:
+      # Checkout the repository code
+      - name: Checkout Code
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.sha }}
+          fetch-depth: 0
+          fetch-tags: true
+      - uses: ./.github/actions/setup-environment
+        id: runner-context
+      # Build the Docker image
+      - name: Build Docker Image
+        run: |
+          uv version "$PACKAGE_VERSION" --no-sync
+          echo "building image: snraware:${PACKAGE_VERSION}"
+          docker build -f Containerfile -t snraware:${PACKAGE_VERSION} .
+          echo "testing installation in image"
+          docker run snraware:${PACKAGE_VERSION} python -c "import snraware"
+        env:
+          PACKAGE_VERSION: "${{ steps.runner-context.outputs.package-version }}"

.github/workflows/build-docs.yaml

@@ -0,0 +1,37 @@
+name: Build Docs
+on:
+  workflow_dispatch:
+    inputs:
+      sha:
+        description: 'the git sha to checkout'
+        required: true
+        type: string
+  workflow_call:
+    inputs:
+      sha:
+        description: 'the git sha to checkout'
+        required: true
+        type: string
+jobs:
+  generate-docs:
+    runs-on: "ubuntu-24.04"
+    name: "generate-docs"
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          ref: ${{ inputs.sha }}
+          fetch-depth: 0
+          fetch-tags: true
+      - uses: ./.github/actions/setup-environment
+        id: runner-context
+      - name: mkdocs-build
+        env:
+          PACKAGE_VERSION: "${{ steps.runner-context.outputs.package-version }}"
+        run: |
+          uv version "$PACKAGE_VERSION"
+          uv sync
+          uv run mkdocs build
+      - name: "upload-gh-pages"
+        uses: actions/upload-pages-artifact@v4
+        with:
+          path: "dist/site"

.github/workflows/build-wheels.yaml

@@ -0,0 +1,38 @@
+name: Build Wheels
+on:
+  workflow_dispatch:
+    inputs:
+      sha:
+        description: 'the git sha to checkout'
+        required: true
+        type: string
+  workflow_call:
+    inputs:
+      sha:
+        description: 'the git sha to checkout'
+        required: true
+        type: string
+jobs:
+  build-components:
+    runs-on: "ubuntu-24.04"
+    name: "build-wheels"
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          ref: ${{ inputs.sha }}
+          fetch-depth: 0
+          fetch-tags: true
+      - uses: ./.github/actions/setup-environment
+        id: runner-context
+      - name: build-wheel
+        env:
+          PACKAGE_VERSION: "${{ steps.runner-context.outputs.package-version }}"
+        run: |
+          uv version "$PACKAGE_VERSION"
+          uv sync
+          uv build
+      - name: "upload-artifacts"
+        uses: actions/upload-artifact@v4
+        with:
+          name: "pkg-wheels"
+          path: "dist/*.whl"

.github/workflows/checks.yaml

@@ -0,0 +1,35 @@
+name: Check
+on:
+  workflow_dispatch:
+    inputs:
+      sha:
+        description: 'the git sha to checkout'
+        required: true
+        type: string
+  workflow_call:
+    inputs:
+      sha:
+        description: 'the git sha to checkout'
+        required: true
+        type: string
+jobs:
+  check-components:
+    runs-on: "ubuntu-24.04"
+    name: "check"
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          ref: ${{ inputs.sha }}
+          fetch-depth: 0
+          fetch-tags: true
+      - uses: ./.github/actions/setup-environment
+        id: runner-context
+      - name: check
+        env:
+          PACKAGE_VERSION: "${{ steps.runner-context.outputs.package-version }}"
+        run: |
+          uv version "$PACKAGE_VERSION"
+          uv run ruff format --check
+          uv run ruff check
+          uv run pyright
+          uv run pytest

.github/workflows/codeql.yaml

@@ -0,0 +1,42 @@
+name: "CodeQL"
+on:
+  workflow_dispatch:
+    inputs:
+      sha:
+        description: 'the git sha to checkout'
+        required: true
+        type: string
+  workflow_call:
+    inputs:
+      sha:
+        description: 'the git sha to checkout'
+        required: true
+        type: string
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: "ubuntu-24.04"
+    permissions:
+      security-events: write
+      actions: read
+      contents: read
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [ "javascript-typescript", "python" ]
+    steps:
+    - uses: actions/checkout@v5
+      with:
+        ref: ${{ inputs.sha }}
+        fetch-depth: 0
+        fetch-tags: true
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@v3
+      with:
+        languages: ${{ matrix.language }}
+    - name: Autobuild
+      uses: github/codeql-action/autobuild@v3
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@v3
+      with:
+        category: "/language:${{matrix.language}}"