This PR adds a minimal GitHub configuration and `SECURITY.md` to: - `charmcraft init --profile machine` and - `charmcraft init --profile kubernetes` This configuration includes recommendations from Charm Tech on what Charms should run in CI if they host their git repository on GitHub. As the config lives inside a single `.github` directory, Charmers can easily opt out by removing or ignoring it. ### Rationale Charmers initialise their charm with `charmcraft init``. This command currently doesn’t generate any GitHub configuration, and GitHub is likely to be where the charm source is hosted. We recommend [How to set up continuous integration for a charm](https://canonical.com/juju/docs/ops/latest/howto/set-up-continuous-integration-for-a-charm/) for new charms, and Charmers will need to set up the CI themselves. This leads to higher chances of drifting away from best practices. Therefore, a default GitHub configuration that Charmers can use straightaway speeds up their CI setup while maintaining best practices. ### What's added The same for both profiles: - `.github/workflows/ci.yaml`: lint and unit tests across the Python versions that the Charm supports. At the moment, we have 24.04 base for both kubernetes and machine profiles, so Python 3.12 is selected. - `.github/workflows/integration.yaml`: runs the Jubilant integration tests of the Charm. It follows [set-up-continuous-integration-for-a-charm](https://canonical.com/juju/docs/ops/latest/howto/set-up-continuous-integration-for-a-charm/). - `.github/workflows/publish.yaml`: a simple workflow for publishing the charm to latest/edge on CharmHub, for every push to main. - `.github/workflows/security.yaml`: runs `pip-audit` to scan dependencies of the Charm for vulnerabilities. - `.github/workflows/zizmor.yaml`: runs `zizmor` and upload the result in SARIF format. - `.github/workflows/dependency-review.yaml`: scans PRs for dependencies issues and fails if it finds high severity problems. It only runs on `pull_request`. - `.github/dependabot.yaml`: This file contains the recommended Dependabot config for the Charm repo. It is inspired by Charm Tech convention [OP0xx-dependabot-config-conventions](https://github.com/canonical/charm-tech/blob/main/specs/OP0xx-dependabot-config-conventions.md), where dependencies are grouped into separate PRs for easier review. - `SECURITY.md`: The SECURITY.md file points people to the GitHub security reporting feature as a starting point. This is a requirement for charm public listing - `pyproject.toml` - A new `ci` dependency group with the following tools: `pip-audit`, `tox`, `tox-uv` and `zizmor`. - Pytest log settings that matches [Jubilant log to a file](https://canonical.com/juju/docs/ops/latest/howto/write-integration-tests-for-a-charm/#log-to-a-file). The two profiles differ: - In `integration.yaml`, uses the `k8s` Concierge preset for kubernetes and `machine` for machine. - In `publish.yaml`, the kubernetes profile looks up the latest revision its resource and uploads the charm with `--resource`. Other docs changes: - Updated the init command overview string - Added docs for each file in the `Reference -> Files` section ### Testing - Updated `tests/integration/commands/test_init.py` so the expected files include the new ones. - Generated both profiles with `charmcraft init`, and checked that the workflows files were rendered correctly. - PoCs: [Machine profile](https://github.com/tromai/test-github-config-machine-profile), [Kubernetes profile](https://github.com/tromai/test-github-config-k8s-profile) ### Not included in this PR I don't put the instructions for additional setup to make the workflows pass in this PR: - Run `uv lock` and commit the `uv.lock` file - GitHub repository settings (`publish` environment, `CHARMHUB_TOKEN` secret, Dependency graph, etc.) - For the `publish.yaml` workflow, register the charm with `charmcraft register`, and upload the resources first. - Enable the dependency graph for `dependency-review.yaml` I feel like that could be part of https://github.com/canonical/operator/issues/2771 ### Review order - Added files that are identical between 2 profiles - https://github.com/canonical/charmcraft/commit/1996dfcb99b13c648f28092a7ebda29b6a8edca8 - Added `integration.yaml` - https://github.com/canonical/charmcraft/commit/598b0228b85eda373cb365fd4d09d1cdd0b33b60 - Added `publish.yaml` - https://github.com/canonical/charmcraft/commit/ad4b8bbf463ca9749ae09fb55958e2290a961f2a --- - [x] I've followed the [contribution guidelines](https://github.com/canonical/charmcraft/blob/main/CONTRIBUTING.md). - [x] I've signed the [CLA](http://www.ubuntu.com/legal/contributors/). - [x] I've successfully run `make lint && make test`. - [x] I've added or updated any relevant documentation. - [x] In documents I changed, I [added a meta description](https://canonical-starflow.readthedocs-hosted.com/how-to/add-a-page-meta-description/) if one was missing. - [ ] I've updated the relevant release notes.