Upgrade CI and Docker to Python 3.14

.github/workflows/codeql-analysis.yml

@@ -13,31 +13,26 @@ jobs:
   analyze:
     name: Analyze
     runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
-      with:
-        # We must fetch at least the immediate parents so that if this is
-        # a pull request then we can checkout the head.
-        fetch-depth: 2
-
-    # If this run was triggered by a pull request event, then checkout
-    # the head of the pull request instead of the merge commit.
-    - run: git checkout HEAD^2
-      if: ${{ github.event_name == 'pull_request' }}
+      uses: actions/checkout@v7
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v1
+      uses: github/codeql-action/init@v4
       # Override language selection by uncommenting this and choosing your languages
       # with:
       #   languages: go, javascript, csharp, python, cpp, java
 
     # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@v1
+      uses: github/codeql-action/autobuild@v4
 
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 https://git.io/JvXDl
@@ -51,4 +46,4 @@ jobs:
     #   make release
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v1
+      uses: github/codeql-action/analyze@v4

.github/workflows/create-release.yml

@@ -12,19 +12,21 @@ jobs:
   version_check:
     name: Check Version
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
-      - uses: actions/setup-python@v4
+      - uses: actions/setup-python@v7
         with:
-          python-version: '3.12'
+          python-version: '3.14'
 
       - name: Install and Setup
         run: |
-          python -m pip install -U pip setuptools wheel
+          python -m pip install -U pip setuptools wheel packaging
 
       - name: Get Version
         id: get_version
@@ -37,10 +39,10 @@ jobs:
           python -m pip install -e .
 
           echo "DARC_VERSION=$(python -c 'import darc; print(darc.__version__)')" >> $GITHUB_OUTPUT
-          echo "DARC_PRERELEASE=$(python -c 'import darc, pkg_resources; print(str(pkg_resources.parse_version(darc.__version__).is_prerelease).lower())')" >> $GITHUB_OUTPUT
-          echo "DARC_CONDA_LABEL=$(python -c 'import darc, pkg_resources; print("dev" if pkg_resources.parse_version(darc.__version__).is_prerelease else "main")')" >> $GITHUB_OUTPUT
+          echo "DARC_PRERELEASE=$(python -c 'from packaging.version import Version; import darc; print(str(Version(darc.__version__).is_prerelease).lower())')" >> $GITHUB_OUTPUT
+          echo "DARC_CONDA_LABEL=$(python -c 'from packaging.version import Version; import darc; print("dev" if Version(darc.__version__).is_prerelease else "main")')" >> $GITHUB_OUTPUT
 
-      - uses: mukunku/tag-exists-action@v1.2.0
+      - uses: mukunku/tag-exists-action@v1.7.0
         id: check_tag
         with:
           tag: "v${{ steps.get_version.outputs.DARC_VERSION }}"
@@ -54,11 +56,13 @@ jobs:
   github:
     name: GitHub Release
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     needs: [ version_check ]
     if: ${{ startsWith(github.ref_name, 'v') || needs.version_check.outputs.DARC_TAG_EXISTS == 'false' }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           # ref: v${{ needs.version_check.outputs.DARC_VERSION }}
           fetch-depth: 0
@@ -71,7 +75,7 @@ jobs:
 
       - name: Create Release
         id: create_release
-        uses: softprops/action-gh-release@v1
+        uses: softprops/action-gh-release@v3.0.2
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # This token is provided by Actions, you do not need to create your own token
         with:
@@ -91,11 +95,13 @@ jobs:
   tag:
     name: Conda Tag
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     needs: [ version_check ]
     if: ${{ startsWith(github.ref_name, 'v') || needs.version_check.outputs.DARC_TAG_EXISTS == 'false' }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           token: ${{ secrets.DARC }}
           # ref: v${{ needs.version_check.outputs.DARC_VERSION }}
@@ -155,22 +161,15 @@ jobs:
     strategy:
       matrix:
         python-version:
-          - "3.8"
-          - "3.9"
-          - "3.10"
-          - "3.11"
-          - "3.12"
-          - "pypy3.8"
-          - "pypy3.9"
-          - "pypy3.10"
+          - "3.14"
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           ref: v${{ needs.version_check.outputs.DARC_VERSION }}
           fetch-depth: 0
 
-      - uses: actions/setup-python@v4
+      - uses: actions/setup-python@v7
         with:
           python-version: ${{ matrix.python-version }}
 
@@ -191,7 +190,7 @@ jobs:
           python util/wheel_rename.py dist/*.whl
 
       - name: No Source Distribution for Python ${{ matrix.python-version }}
-        if: ${{ matrix.python-version != '3.12' }}
+        if: ${{ matrix.python-version != '3.14' }}
         run: |
           rm dist/*.tar.gz
 
@@ -209,7 +208,7 @@ jobs:
           skip-existing: true
 
       - name: Upload package to GitHub Release
-        uses: softprops/action-gh-release@v1
+        uses: softprops/action-gh-release@v3.0.2
         with:
           # allowUpdates: true
           files: |
@@ -229,18 +228,14 @@ jobs:
           - ubuntu-latest
           # - windows-latest  # skip for now
         python-version:
-          - "3.8"
-          - "3.9"
-          - "3.10"
-          - "3.11"
-          - "3.12"
+          - "3.14"
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           ref: conda-${{ needs.version_check.outputs.DARC_VERSION }}+0
           fetch-depth: 0
 
-      - uses: actions/setup-python@v4
+      - uses: actions/setup-python@v7
         with:
           python-version: ${{ matrix.python-version }}
 
@@ -275,65 +270,58 @@ jobs:
           python -m pip download -r conda/requirements.txt -d conda/wheels
 
       - name: Conda environment creation and activation
-        uses: conda-incubator/setup-miniconda@v3
-        env:
-          DARC_VERSION: ${{ needs.version_check.outputs.DARC_VERSION }}
-          DARC_BUILD: "0"
+        uses: conda-incubator/setup-miniconda@v4.0.1
         with:
           python-version: ${{ matrix.python-version }}
-          environment-file: conda/conda-build.yaml    # Path to the build conda environment
+          activate-environment: base
           auto-update-conda: false
-          auto-activate-base: false
+          auto-activate: true
+          channels: conda-forge,defaults
+          conda-remove-defaults: false
           show-channel-urls: true
 
-      - name: Build and upload the conda packages (macOS)
-        uses: uibcdf/action-build-and-upload-conda-packages@v1.2.0
-        if: ${{ matrix.os == 'macos-latest' }}
-        env:
-          DARC_VERSION: ${{ needs.version_check.outputs.DARC_VERSION }}
-          DARC_BUILD: "0"
-        with:
-          meta_yaml_dir: conda/darc
-          python-version: ${{ matrix.python-version }} # Values previously defined in `matrix`
-          platform_osx-64: true
-          user: jarryshaw
-          label: ${{ needs.version_check.outputs.DARC_CONDA_LABEL }}
-          token: ${{ secrets.ANACONDA_TOKEN }} # Replace with the right name of your secret
-
-      - name: Build and upload the conda packages (Ubuntu)
-        uses: uibcdf/action-build-and-upload-conda-packages@v1.2.0
-        if: ${{ matrix.os == 'ubuntu-latest' }}
-        env:
-          DARC_VERSION: ${{ needs.version_check.outputs.DARC_VERSION }}
-          DARC_BUILD: "0"
-        with:
-          meta_yaml_dir: conda/darc
-          python-version: ${{ matrix.python-version }} # Values previously defined in `matrix`
-          platform_linux-64: true
-          user: jarryshaw
-          label: ${{ needs.version_check.outputs.DARC_CONDA_LABEL }}
-          token: ${{ secrets.ANACONDA_TOKEN }} # Replace with the right name of your secret
-
-      - name: Build and upload the conda packages (Windows)
-        uses: uibcdf/action-build-and-upload-conda-packages@v1.2.0
-        if: ${{ matrix.os == 'windows-latest' }}
+      - name: Install conda build tools
+        run: |
+          conda install -n base --override-channels -c conda-forge -y conda-build
+          conda build --version
+
+      - name: Build conda packages
+        id: conda_build
+        shell: bash -el {0}
         env:
           DARC_VERSION: ${{ needs.version_check.outputs.DARC_VERSION }}
           DARC_BUILD: "0"
+        working-directory: conda/darc
+        run: |
+          set -euo pipefail
+
+          out_dir="$(mktemp -d -t compilation-XXXXXXXXXX)"
+          echo "out_dir=$out_dir" >> "$GITHUB_OUTPUT"
+          conda build . --package-format .tar.bz2 --no-anaconda-upload --output-folder "$out_dir" --python "${{ matrix.python-version }}"
+          package_paths="$(find "$out_dir" -type f \( -name '*.tar.bz2' -o -name '*.conda' \) -print | sort)"
+          if [ -z "$package_paths" ]; then
+            echo "::error::No conda package was built"
+            exit 1
+          fi
+          printf '%s\n' "$package_paths"
+          {
+            echo 'packages<<EOF'
+            printf '%s\n' "$package_paths"
+            echo EOF
+          } >> "$GITHUB_OUTPUT"
+
+      - name: Upload conda packages to Anaconda
+        uses: anaconda/actions/upload-package@v0.3.1
         with:
-          meta_yaml_dir: conda/darc
-          python-version: ${{ matrix.python-version }} # Values previously defined in `matrix`
-          platform_win-64: true
-          user: jarryshaw
-          label: ${{ needs.version_check.outputs.DARC_CONDA_LABEL }}
-          token: ${{ secrets.ANACONDA_TOKEN }} # Replace with the right name of your secret
+          token: ${{ secrets.ANACONDA_TOKEN }}
+          channel: jarryshaw
+          packages: ${{ steps.conda_build.outputs.packages }}
+          labels: ${{ needs.version_check.outputs.DARC_CONDA_LABEL }}
 
       - name: Upload package to GitHub Release
         if: ${{ matrix.os == 'ubuntu-latest' }}
-        uses: softprops/action-gh-release@v1
+        uses: softprops/action-gh-release@v3.0.2
         with:
-          # allowUpdates: true
-          files: |
-            /tmp/compilation-*/**/*.tar.bz2
+          files: ${{ steps.conda_build.outputs.packages }}
           tag_name: "v${{ needs.version_check.outputs.DARC_VERSION }}"
           token: "${{ secrets.GITHUB_TOKEN }}"