chore: Update to copier template v4 (#1077)

Moves the copier template beyond the boundary that requires manual
intervention: copier v4 and beyond does not require --trust and so can
become another dependency managed by Renovate.

Author: DiamondJoseph

.copier-answers.yml

@@ -1,5 +1,5 @@
 # Changes here will be overwritten by Copier
-_commit: 3.0.0
+_commit: 4.0.1
 _src_path: https://github.com/DiamondLightSource/python-copier-template
 author_email: [email protected]
 author_name: Callum Forrester

.github/CONTRIBUTING.md

@@ -24,4 +24,4 @@ It is recommended that developers use a [vscode devcontainer](https://code.visua
 
 This project was created using the [Diamond Light Source Copier Template](https://github.com/DiamondLightSource/python-copier-template) for Python projects.
 
-For more information on common tasks like setting up a developer environment, running the tests, and setting a pre-commit hook, see the template's [How-to guides](https://diamondlightsource.github.io/python-copier-template/3.0.0/how-to.html).
+For more information on common tasks like setting up a developer environment, running the tests, and setting a pre-commit hook, see the template's [How-to guides](https://diamondlightsource.github.io/python-copier-template/4.0.1/how-to.html).

.github/actions/install_requirements/action.yml

@@ -15,6 +15,7 @@ runs:
       run: |
         PYTHON_VERSION="${{ inputs.python-version }}"
         if [ $PYTHON_VERSION == "dev" ]; then
+          # python version from Dockerfile, removing potential pinned sha
           PYTHON_VERSION=$(sed -Ene "s/ARG PYTHON_VERSION=([0-9\.]+).*/\1/p" Dockerfile)
         fi
         echo "PYTHON_VERSION=$PYTHON_VERSION" >> "$GITHUB_ENV"

.github/workflows/_check.yml

@@ -1,6 +1,10 @@
 name: Build and publish container
 on:
   workflow_call:
+    inputs:
+      publish:
+        type: boolean
+        description: If true, pushes image to container registry
 
 jobs:
   build_container:
@@ -69,8 +73,8 @@ jobs:
             type=ref,event=tag,suffix=-debug
             type=raw,value=latest-debug
       
-      - name: Build and publish debug image to container registry
-        if: github.ref_type == 'tag'
+      - name: Push cached image to container registry
+        if: inputs.publish && github.ref_type == 'tag'
         uses: docker/build-push-action@v6
         env:
           DOCKER_BUILD_RECORD_UPLOAD: false

.github/workflows/_container.yml

@@ -1,6 +1,7 @@
 on:
   workflow_call:
 
+
 jobs:
   build:
     runs-on: ubuntu-latest

.github/workflows/_docs.yml

@@ -4,11 +4,14 @@ name: AsyncAPI
 
 on:
   push:
+    branches:
+      - main
+    tags:
+      - '*'
   pull_request:
 
 jobs:
   validate:
-    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.repository
     runs-on: ubuntu-latest
 
     steps:

.github/workflows/asyncapi.yml

@@ -2,11 +2,14 @@ name: Backstage
 
 on:
   push:
+    branches:
+      - main
+    tags:
+      - '*'
   pull_request:
 
 jobs:
   validate:
-    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.repository
     runs-on: ubuntu-latest
 
     steps:

.github/workflows/backstage.yml

@@ -2,22 +2,20 @@ name: CI
 
 on:
   push:
+    branches:
+      - main
+    tags:
+      - '*'
   pull_request:
 
 jobs:
-  check:
-    uses: ./.github/workflows/_check.yml
 
   lint:
-    needs: check
-    if: needs.check.outputs.branch-pr == ''
     uses: ./.github/workflows/_tox.yml
     with:
       tox: pre-commit,type-checking
 
   test:
-    needs: check
-    if: needs.check.outputs.branch-pr == ''
     strategy:
       matrix:
         runs-on: ["ubuntu-latest"] # can add windows-latest, macos-latest
@@ -35,38 +33,35 @@ jobs:
       CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
 
   system-test:
-    needs: check
-    if: needs.check.outputs.branch-pr == ''
     uses: ./.github/workflows/_system_test.yml
 
   container:
-    needs: check
-    if: needs.check.outputs.branch-pr == ''
+    needs: test
+    if: always()
     uses: ./.github/workflows/_container.yml
+    with:
+      publish: ${{ needs.test.result == 'success' }}
     permissions:
       contents: read
       packages: write
 
   docs:
-    needs: check
-    if: needs.check.outputs.branch-pr == ''
     uses: ./.github/workflows/_docs.yml
 
+
   dist:
-    needs: check
-    if: needs.check.outputs.branch-pr == ''
     uses: ./.github/workflows/_dist.yml
 
   pypi:
+    needs: [dist, test]
     if: github.ref_type == 'tag'
-    needs: dist
     uses: ./.github/workflows/_pypi.yml
     permissions:
       id-token: write
 
   release:
+    needs: [dist, test, docs]
     if: github.ref_type == 'tag'
-    needs: [dist, docs]
     uses: ./.github/workflows/_release.yml
     permissions:
       contents: write

.github/workflows/ci.yml

@@ -13,11 +13,12 @@ name: "CodeQL"
 
 on:
   push:
-    branches: ["main"]
+    branches:
+      - main
+    tags:
+      - '*'
   pull_request:
-    branches: ["main"]
-  schedule:
-    - cron: "23 10 * * 2"
+
 
 jobs:
   analyze: