ci: update global python (#43)

.github/workflows/ci-docker.yml

@@ -38,7 +38,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Find dockerfiles
         id: find
@@ -86,7 +86,7 @@ jobs:
     steps:
       - name: Checkout
         if: ${{ github.ref == 'refs/heads/master' || github.base_ref == 'master' }}
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Verify Changelog
         id: verify_changelog
@@ -162,7 +162,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Hadolint
         id: hadolint
@@ -192,8 +192,18 @@ jobs:
     name: Docker${{ matrix.tag }}
 
     steps:
+      - name: Maximize build space
+        uses: easimon/maximize-build-space@v8
+        with:
+          root-reserve-mb: 30720  # https://github.com/easimon/maximize-build-space#caveats
+          remove-dotnet: 'true'
+          remove-android: 'true'
+          remove-haskell: 'true'
+          remove-codeql: 'true'
+          remove-docker-images: 'true'
+
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           submodules: recursive
 
@@ -205,9 +215,20 @@ jobs:
           # get branch name
           BRANCH=${GITHUB_HEAD_REF}
 
+          RELEASE=false
+
           if [ -z "$BRANCH" ]; then
             echo "This is a PUSH event"
             BRANCH=${{ github.ref_name }}
+            COMMIT=${{ github.sha }}
+            CLONE_URL=${{ github.event.repository.clone_url }}
+            if [[ $BRANCH == "master" ]]; then
+              RELEASE=true
+            fi
+          else
+            echo "This is a PULL REQUEST event"
+            COMMIT=${{ github.event.pull_request.head.sha }}
+            CLONE_URL=${{ github.event.pull_request.head.repo.clone_url }}
           fi
 
           # determine to push image to dockerhub and ghcr or not
@@ -220,7 +241,6 @@ jobs:
           # setup the tags
           REPOSITORY=${{ github.repository }}
           BASE_TAG=$(echo $REPOSITORY | tr '[:upper:]' '[:lower:]')
-          COMMIT=${{ github.sha }}
 
           TAGS="${BASE_TAG}:${COMMIT:0:7}${{ matrix.tag }},ghcr.io/${BASE_TAG}:${COMMIT:0:7}${{ matrix.tag }}"
 
@@ -259,7 +279,10 @@ jobs:
             elif [[ $line == "# artifacts: "* && $ARTIFACTS == "" ]]; then
               # echo the line and use `sed` to remove the custom directive
               ARTIFACTS=$(echo -e "$line" | sed 's/# artifacts: //')
-            elif [[ $PLATFORMS != "" && $ARTIFACTS != "" ]]; then
+            elif [[ $line == "# no-cache-filters: "* && $NO_CACHE_FILTERS == "" ]]; then
+              # echo the line and use `sed` to remove the custom directive
+              NO_CACHE_FILTERS=$(echo -e "$line" | sed 's/# no-cache-filters: //')
+            elif [[ $PLATFORMS != "" && $ARTIFACTS != "" && $NO_CACHE_FILTERS != "" ]]; then
               # break while loop once all custom directives are found
               break
             fi
@@ -277,16 +300,19 @@ jobs:
           echo "branch=${BRANCH}" >> $GITHUB_OUTPUT
           echo "build_date=$(date -u +'%Y-%m-%dT%H:%M:%SZ')" >> $GITHUB_OUTPUT
           echo "commit=${COMMIT}" >> $GITHUB_OUTPUT
+          echo "clone_url=${CLONE_URL}" >> $GITHUB_OUTPUT
+          echo "release=${RELEASE}" >> $GITHUB_OUTPUT
           echo "artifacts=${ARTIFACTS}" >> $GITHUB_OUTPUT
+          echo "no_cache_filters=${NO_CACHE_FILTERS}" >> $GITHUB_OUTPUT
           echo "platforms=${PLATFORMS}" >> $GITHUB_OUTPUT
           echo "push=${PUSH}" >> $GITHUB_OUTPUT
           echo "tags=${TAGS}" >> $GITHUB_OUTPUT
 
       - name: Set Up QEMU
-        uses: docker/setup-qemu-action@v2
+        uses: docker/setup-qemu-action@v3
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@v3
         id: buildx
 
       - name: Cache Docker Layers
@@ -299,14 +325,14 @@ jobs:
 
       - name: Log in to Docker Hub
         if: ${{ steps.prepare.outputs.push == 'true' }}  # PRs do not have access to secrets
-        uses: docker/login-action@v2
+        uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKER_HUB_USERNAME }}
           password: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }}
 
       - name: Log in to the Container registry
         if: ${{ steps.prepare.outputs.push == 'true' }}  # PRs do not have access to secrets
-        uses: docker/login-action@v2
+        uses: docker/login-action@v3
         with:
           registry: ghcr.io
           username: ${{ secrets.GH_BOT_NAME }}
@@ -315,7 +341,7 @@ jobs:
       - name: Build artifacts
         if: ${{ steps.prepare.outputs.artifacts == 'true' }}
         id: build_artifacts
-        uses: docker/build-push-action@v4
+        uses: docker/build-push-action@v5
         with:
           context: ./
           file: ${{ matrix.dockerfile }}
@@ -328,13 +354,16 @@ jobs:
             BUILD_DATE=${{ steps.prepare.outputs.build_date }}
             BUILD_VERSION=${{ needs.check_changelog.outputs.next_version }}
             COMMIT=${{ steps.prepare.outputs.commit }}
+            CLONE_URL=${{ steps.prepare.outputs.clone_url }}
+            RELEASE=${{ steps.prepare.outputs.release }}
           tags: ${{ steps.prepare.outputs.tags }}
           cache-from: type=local,src=/tmp/.buildx-cache
           cache-to: type=local,dest=/tmp/.buildx-cache
+          no-cache-filters: ${{ steps.prepare.outputs.no_cache_filters }}
 
       - name: Build and push
         id: build
-        uses: docker/build-push-action@v4
+        uses: docker/build-push-action@v5
         with:
           context: ./
           file: ${{ matrix.dockerfile }}
@@ -345,9 +374,12 @@ jobs:
             BUILD_DATE=${{ steps.prepare.outputs.build_date }}
             BUILD_VERSION=${{ needs.check_changelog.outputs.next_version }}
             COMMIT=${{ steps.prepare.outputs.commit }}
+            CLONE_URL=${{ steps.prepare.outputs.clone_url }}
+            RELEASE=${{ steps.prepare.outputs.release }}
           tags: ${{ steps.prepare.outputs.tags }}
           cache-from: type=local,src=/tmp/.buildx-cache
           cache-to: type=local,dest=/tmp/.buildx-cache
+          no-cache-filters: ${{ steps.prepare.outputs.no_cache_filters }}
 
       - name: Arrange Artifacts
         if: ${{ steps.prepare.outputs.artifacts == 'true' }}
@@ -358,6 +390,9 @@ jobs:
           # https://unix.stackexchange.com/a/52816
           find ./ -type f -exec mv -t ./ -n '{}' +
 
+          # remove provenance file
+          rm -f ./provenance.json
+
       - name: Upload Artifacts
         if: ${{ steps.prepare.outputs.artifacts == 'true' }}
         uses: actions/upload-artifact@v3

.github/workflows/python-flake8.yml

@@ -21,7 +21,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Set up Python
         uses: actions/setup-python@v4  # https://github.com/actions/setup-python