Workflow and test driver fixes

.github/workflows/bandit.yml

@@ -2,10 +2,7 @@ name: Security check - Bandit
 
 on:
   workflow_dispatch:
-  pull_request:
   push:
-    branches:
-      - master
 
 jobs:
   build:
@@ -19,5 +16,5 @@ jobs:
       uses: VCTLabs/bandit-report-artifacts@master
       with:
         project_path: pystache
-        ignore_failure: false
-        baseline_file: bandit_baseline.json
+        ignore_failure: true
+        exclude_paths: 'pystache/tests'

.github/workflows/ci.yml

@@ -23,7 +23,7 @@ jobs:
       fail-fast: false
       matrix:
         os: [ubuntu-20.04, macos-latest, windows-latest]
-        python-version: [3.6, 3.7, 3.8, 3.9]
+        python-version: ['3.6', '3.7', '3.8', '3.9', '3.10']
     steps:
     - name: Set git crlf/eol
       run: |
@@ -52,7 +52,7 @@ jobs:
 
     - name: Test with specs and pystache-test
       run: |
-        tox -e setup . ext/spec/specs
+        tox -e setup ext/spec/specs
 
     - name: Check pkg builds
       run: |

.github/workflows/coverage.yml

@@ -1,27 +1,21 @@
-# internal coverage PR comment and badge v0.0.3
-# needs separate jobs for coverage checkout/run and PR coverage report comment
-# badge and comment job logic should be tuned for personal vs org use
-# (see badge job comments below)
-# as of Nov 2021: broken on forks, needs much refactoring for previous behavior
+# internal coverage with PR comment and badge v0.0.4
+# Note this works for public orgs but probably only for "internal"
+# pull requests. In the case of fork PRs, there needs to be org-level
+# github app with private key => ACCESS_TOKEN, with more job isolation
+# and output passing in this workflow.
+#
+# This version has updated actions and coverage value regex, no fork isolation
+# yet. Badge and comment job logic should be tuned for personal vs org use
+# (fork PRs still needs the big refactor; see badge job comments below).
 name: Coverage
 
 on:
   workflow_dispatch:
-  pull_request_target:
-    types:
-      - opened
-      - synchronize
-      - reopened
+  pull_request:
   push:
     branches:
       - master
 
-## This workflow needs the `pull-request` permissions to work
-## Refs: https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#permissions
-permissions:
-  pull-requests: write
-  contents: read
-
 jobs:
   pre_ci:
     name: Prepare CI environment
@@ -34,8 +28,8 @@ jobs:
     - name: Checkout Project
       uses: actions/checkout@v2
       with:
-        ref: ${{ github.event.pull_request.head.ref }}
-        repository: ${{ github.event.pull_request.head.repo.full_name }}
+        # We need to fetch with a depth of 2 for pull_request so we can do HEAD^2
+        fetch-depth: 2
 
     - name: Environment
       run: |
@@ -46,7 +40,7 @@ jobs:
       env:
         COMMIT_PUSH: ${{ github.event.head_commit.message }}
       run: |
-        COMMIT_MESSAGE="${COMMIT_PUSH:-$(git log --format=%B -n 1 HEAD)}"
+        COMMIT_MESSAGE="${COMMIT_PUSH:-$(git log --format=%B -n 1 HEAD^2)}"
         echo "::set-output name=commit_message::${COMMIT_MESSAGE}"
 
     - name: Extract branch name
@@ -142,9 +136,7 @@ jobs:
     steps:
     - uses: actions/checkout@v2
       with:
-        ref: ${{ github.event.pull_request.head.ref }}
-        repository: ${{ github.event.pull_request.head.repo.full_name }}
-
+        fetch-depth: 0
 
     - uses: actions/setup-python@v2
       with:
@@ -157,55 +149,47 @@ jobs:
 
     - name: Generate coverage and fix pkg name
       run: |
-        tox -e py39-linux
+        tox -e py
 
-    - name: Code Coverage Summary Report (Text & Value)
-      uses: irongut/CodeCoverageSummary@v1.0.5
+    - name: Code Coverage Summary Report (data)
+      uses: irongut/CodeCoverageSummary@v1.1.0
       with:
         filename: coverage.xml
         output: 'both'
 
+    - uses: actions/upload-artifact@v2
+      with:
+        name: src_coverage_rpts
+        path: |
+          coverage.xml
+          code-coverage-results.txt
+        retention-days: 1
+
     - name: Check code coverage
       id: coverage
       env:
         VALUE: "Branch Rate"
       run: |
-        COVERAGE="$( cat code-coverage-results.txt | egrep "^${VALUE}" | sed -e 's#^.* \([0-9]*\)%.*#\1#' )"
+        COVERAGE=$( cat code-coverage-results.txt | grep -e ^Summary | grep -o -E "${VALUE} = .{3}" | egrep -o '([0-9]+)' )
         echo "##[set-output name=coverage;]${COVERAGE}"
         echo "##[set-output name=coverage-rounded-display;]${COVERAGE}%"
+        echo "Current coverage is: ${COVERAGE}%"
 
     - name: Code Coverage Summary Report
-      uses: irongut/CodeCoverageSummary@v1.0.5
+      uses: irongut/CodeCoverageSummary@v1.1.0
       if: ${{ github.event_name == 'pull_request' }}
       with:
         filename: coverage.xml
         format: 'markdown'
         output: 'both'
 
-    - name: Upload coverage results for comment
-      uses: actions/upload-artifact@v2
-      with:
-        name: pr-coverage
-        path: code-coverage-results.md
-        retention-days: 1
-
-  comment_cov_report:
-    name: Comment on PR with coverage summary report
-    runs-on: ubuntu-20.04
-    needs: [cov_data, base]
-
-    steps:
-    # artifact downloaded to directory: (upload)name/file
-    - uses: actions/download-artifact@v2
-
     - name: Add Coverage PR Comment
       uses: marocchino/[email protected]
       if: ${{ github.event_name == 'pull_request' && github.actor == github.repository_owner }}
       with:
         header: coverage
-        path: pr-coverage/code-coverage-results.md
-        hide_and_recreate: true
-        hide_classify: "OUTDATED"
+        recreate: true
+        path: code-coverage-results.md
 
   test:
     name: Coverage check
@@ -231,7 +215,6 @@ jobs:
     name: Comment on PR with coverage delta
     runs-on: ubuntu-20.04
     needs: [test, base]
-    if: ${{ github.actor == github.repository_owner }}
 
     steps:
     - name: Environment
@@ -294,9 +277,8 @@ jobs:
       if: env.HAVE_BASE_COVERAGE == 'true'
       with:
         header: delta
+        recreate: true
         path: coverage-delta.md
-        hide_and_recreate: true
-        hide_classify: "OUTDATED"
 
   badge:
     # Only generate and publish if these conditions are met:
@@ -361,6 +343,6 @@ jobs:
     - name: Push badge commit
       uses: ad-m/github-push-action@master
       with:
-        github_token: ${{ secrets.VORPAL_PAT }}
+        github_token: ${{ secrets.GITHUB_TOKEN }}
         branch: badges
         directory: badges

.github/workflows/release.yml

@@ -19,10 +19,7 @@ jobs:
       fail-fast: false
       matrix:
         os: [ubuntu-20.04, macos-latest, windows-latest]
-        python-version: [3.6, 3.7, 3.8, 3.9]
-        exclude:
-          - os: windows-latest
-            python-version: 2.7
+        python-version: ['3.6', '3.7', '3.8', '3.9', '3.10']
 
     steps:
     - name: Set git crlf/eol
@@ -86,7 +83,7 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
           tag_name: ${{ env.VERSION }}
-          name: Release ${{ env.VERSION }}
+          name: Release v${{ env.VERSION }}
           body_path: CHANGES.md
           draft: false
           prerelease: false

README.md

@@ -216,7 +216,7 @@ To test Pystache with multiple versions of Python (with a single
 command!) and different platforms, you can use [tox](http://pypi.python.org/pypi/tox):
 
     pip install tox
-    tox -e setup
+    tox -e py
 
 To run tests on multiple versions with coverage, run:
 
@@ -234,11 +234,11 @@ The test harness parses the spec's (more human-readable) yaml files if
 [PyYAML](https://pypi.python.org/pypi/PyYAML) is present. Otherwise, it
 parses the json files. To install PyYAML--
 
-    pip install pyyaml
+    pip install pyyaml  # note this is installed automatically by tox
 
 Once the submodule is available, you can run the full test set with:
 
-    tox -e setup . ext/spec/specs
+    tox -e setup ext/spec/specs
 
 To run a subset of the tests, you can use
 [nose](https://somethingaboutorange.com/mrl/projects/nose/0.11.1/testing.html):

pystache/tests/doctesting.py

@@ -11,11 +11,11 @@
 import sys
 import traceback
 
-if sys.version_info >= (3,):
-    # Then pull in modules needed for 2to3 conversion.  The modules
-    # below are not necessarily available in older versions of Python.
-    from lib2to3.main import main as lib2to3main  # new in Python 2.6?
-    from shutil import copyfile
+# if sys.version_info >= (3,):
+#    # Then pull in modules needed for 2to3 conversion.  The modules
+#    # below are not necessarily available in older versions of Python.
+#    from lib2to3.main import main as lib2to3main  # new in Python 2.6?
+#    from shutil import copyfile
 
 from pystache.tests.common import TEXT_DOCTEST_PATHS
 from pystache.tests.common import get_module_names

pystache/tests/spectesting.py

@@ -237,6 +237,7 @@ def parse(u):
     def code_constructor(loader, node):
         value = loader.construct_mapping(node)
         # ast.literal_eval will not work here => lambda expression
+        # plus this a test, and spec tests are optional => #nosec ?
         return eval(value['python'], {})
 
     yaml.add_constructor('!code', code_constructor)

setup.cfg

@@ -3,10 +3,10 @@ name = pystache
 version = attr: pystache.__version__
 author = Chris Wanstrath
 author_email = [email protected]
-maintainer = Steve Arnold
-maintainer_email = [email protected]
+maintainer = Thomas David Baker
+maintainer_email = [email protected]
 description = Mustache for Python
-url = https://github.com/sarnold/pystache
+url = https://github.com/PennyDreadfulMTG/pystache
 license = MIT
 license_files = LICENSE
 classifiers =
@@ -35,7 +35,8 @@ console_scripts =
 
 [options.extras_require]
 test =
-    nose
+    pytest
+    pytest-cov
 
 cov =
     coverage
@@ -58,14 +59,3 @@ ignore =
     .pep8speaks.yml
     coverage*
     conda/**
-
-[nosetests]
-traverse-namespace = 1
-verbosity = 3
-with-coverage = 1
-with-doctest = 1
-doctest-extension = rst
-cover-package = pystache
-cover-xml = 1
-# set the default ignore here so we can append on cmdline
-ignore-files = (?:^\.|^_,|^setup\.py$)

tox.ini

@@ -1,15 +1,16 @@
 [tox]
-envlist = py{36,37,38,39}-{linux,macos,windows}
+envlist = py{36,37,38,39,310}-{linux,macos,windows}
 skip_missing_interpreters = true
 isolated_build = true
-#skipsdist = true
+skipsdist = true
 
 [gh-actions]
 python =
     3.6: py36
     3.7: py37
     3.8: py38
     3.9: py39
+    3.10: py310
 
 [gh-actions:env]
 PLATFORM =
@@ -23,12 +24,12 @@ allowlist_externals = bash
 
 deps =
     pip>=20.0.1
-    nose
-    coverage
-    coverage_python_version
+    .[test,cov]
 
 commands =
-    nosetests -sx . {posargs}
+    #nosetests -sx . {posargs}
+    python -m pytest . --capture=no --doctest-modules --doctest-glob="*.rst" --doctest-glob="*.py" --cov pystache --cov-branch --cov-report term-missing
+    coverage xml
     bash -c './gh/fix_pkg_name.sh'
 
 [testenv:bare]
@@ -62,15 +63,15 @@ commands =
 passenv = CI PYTHON PYTHONIOENCODING
 
 deps =
+    pip>=20.0.1
     pyyaml
-    twine
 
+# this is becoming even more deprecated (possibly failing) BUT,
 # to run the spec tests, first init the git submodule, and then run
-# something like: tox -e setup . ext/spec/specs
+# something like: tox -e setup ext/spec/specs
 commands =
-    python setup.py install
-    twine check dist/*
-    pystache-test {posargs}
+    python -m pip install .
+    pystache-test {toxinidir} {posargs}
 
 [testenv:lint]
 # oddly, this produces different results than running the same pylint
@@ -125,6 +126,18 @@ commands =
         python -m pip install $WHL_FILE'
     pystache-test
 
+[testenv:sec]
+passenv = CI PYTHON PYTHONIOENCODING
+skip_install = true
+
+deps =
+    pip>=20.0.1
+    bandit
+
+commands =
+    bandit -r pystache/ -x pystache/tests
+    #bandit -r pystache/
+
 [testenv:docs]
 passenv = CI PYTHON PYTHONIOENCODING
 allowlist_externals = bash