[pull] master from metabrainz:master

.github/workflows/package-macos.yml

@@ -6,13 +6,18 @@ permissions: {}
 
 jobs:
   package-macos:
-    runs-on: macos-11
+    runs-on: macos-13
     strategy:
       matrix:
         setup:
-        - macos-deployment-version: 11
-          python-version: 3.12.1-macos11
-          python-sha256sum: 6178e42679eb83196240fc58b1438f481c32c2b0557f28ccf43aa7b1b80b7c4a
+        - macos-deployment-version: '11.0'
+          target-arch: 'x86_64'
+          python-version: 3.13.1-macos11
+          python-sha256sum: 67c6f0a3190851e0013214d5abd725a42ec398ff1b50eec47826820fd052d86b
+        - macos-deployment-version: '11.0'
+          target-arch: 'arm64'
+          python-version: 3.13.1-macos11
+          python-sha256sum: 67c6f0a3190851e0013214d5abd725a42ec398ff1b50eec47826820fd052d86b
     env:
       DISCID_VERSION: 0.6.4
       DISCID_SHA256SUM: 829133dd38acbdaa2b989de59e256c8d139ac34cb4dd4b8fd3c9d55a97c824f3
@@ -21,6 +26,7 @@ jobs:
       PYTHON_VERSION: ${{ matrix.setup.python-version }}
       PYTHON_SHA256SUM: ${{ matrix.setup.python-sha256sum }}
       MACOSX_DEPLOYMENT_TARGET: ${{ matrix.setup.macos-deployment-version }}
+      TARGET_ARCH: ${{ matrix.setup.target-arch }}
       CODESIGN: 0
     steps:
     - uses: actions/checkout@v4
@@ -45,13 +51,12 @@ jobs:
     - name: Install dependencies
       run: |
         pip3 install -r requirements-build.txt
-        pip3 install -r requirements-macos-${MACOSX_DEPLOYMENT_TARGET}.txt
+        pip3 install --no-binary "charset-normalizer,PyYAML" -r requirements-macos-${MACOSX_DEPLOYMENT_TARGET}.txt
       env:
         PYINSTALLER_COMPILE_BOOTLOADER: "1"
     - name: Run tests
       timeout-minutes: 30
-      run: |
-        python3 setup.py test
+      run: pytest --verbose
     - name: Prepare code signing certificate
       run: |
         if [ -n "$CODESIGN_MACOS_P12_URL" ] && [ -n "$AWS_ACCESS_KEY_ID" ]; then
@@ -78,5 +83,5 @@ jobs:
     - name: Archive production artifacts
       uses: actions/upload-artifact@v4
       with:
-        name: macos-app-${{ matrix.setup.macos-deployment-version }}
+        name: macos-app-${{ matrix.setup.macos-deployment-version }}-${{ matrix.setup.target-arch }}
         path: artifacts/

.github/workflows/package-pypi.yml

@@ -16,7 +16,8 @@ jobs:
     - uses: actions/checkout@v4
     - uses: actions/setup-python@v5
       with:
-        python-version: 3.12
+        python-version: 3.13
+        cache: 'pip'
     - name: Install dependencies (Linux)
       if: runner.os == 'linux'
       run: |
@@ -25,16 +26,16 @@ jobs:
     - name: Install dependencies
       run: |
         python -m pip install --upgrade pip
-        python -m pip install --upgrade setuptools
+        python -m pip install --upgrade build pytest
         pip install --upgrade -r requirements.txt
     - name: Run tests
       timeout-minutes: 30
       run: |
-        python setup.py test
+        pytest
     - name: Build Python source distribution
       run: |
         git clean -dfx
-        python setup.py clean sdist --formats=gztar,zip
+        python -m build --sdist
     - name: Prepare GPG signing key
       run: |
         if [ -n "$CODESIGN_GPG_URL" ] && [ -n "$AWS_ACCESS_KEY_ID" ]; then
@@ -56,7 +57,7 @@ jobs:
     - name: Sign source archives
       if: env.CODESIGN == '1'
       run: |
-        for f in dist/*.{zip,tar.gz}; do
+        for f in dist/*.tar.gz; do
           gpg --armor --local-user "$CODESIGN_GPG_IDENTITY" --output "${f}.asc" --detach-sig "$f"
         done
       env:
@@ -76,14 +77,15 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [macos-11, windows-2019]
-        python-version: ['3.9', '3.10', '3.11', '3.12']
+        os: [macos-13, windows-2019]
+        python-version: ['3.9', '3.10', '3.11', '3.12', '3.13']
     steps:
     - uses: actions/checkout@v4
     - name: Set up Python ${{ matrix.python-version }}
       uses: actions/setup-python@v5
       with:
         python-version: ${{ matrix.python-version }}
+        cache: 'pip'
     - name: Install gettext (macOS)
       if: runner.os == 'macOS'
       run: |
@@ -108,42 +110,18 @@ jobs:
     - name: Install dependencies
       run: |
         python -m pip install --upgrade pip
-        python -m pip install --upgrade setuptools wheel
+        python -m pip install --upgrade build pytest
         pip install --upgrade -r requirements.txt
     - name: Run tests
       timeout-minutes: 30
       run: |
-        python setup.py test
+        pytest
     - name: Build Python binary distribution
       run: |
-        python setup.py clean bdist_wheel
+        python -m build --wheel
     - name: Upload artifacts
       uses: actions/upload-artifact@v4
       with:
         name: picard-bdist-${{ runner.os }}-${{ matrix.python-version }}
         path: dist/*.whl
 
-  pypi-release:
-    runs-on: ubuntu-latest
-    if: startsWith(github.ref, 'refs/tags/')
-    needs:
-      - pypi-bdist
-      - pypi-sdist
-    environment:
-      name: pypi
-      url: https://pypi.org/p/picard
-    permissions:
-      id-token: write  # required for PyPI upload
-    steps:
-    - uses: actions/download-artifact@v4
-      with:
-        pattern: picard-?dist*
-        path: dist/
-        merge-multiple: true
-    - name: Prepare distributions
-      run: |
-        ls -l dist/
-        # Remove zip source distribution (only a single sdist is allowed)
-        rm dist/picard-*.zip*
-    - name: Publish package distributions to PyPI
-      uses: pypa/gh-action-pypi-publish@release/v1

.github/workflows/package-windows.yml

@@ -9,14 +9,15 @@ jobs:
     runs-on: windows-2019
     strategy:
       matrix:
-        type:
-        - store-app
-        - signed-app
-        - installer
-        - portable
+        setup:
+          - type: installer
+          - type: portable
+            build-portable: 1
+          - type: store-app
+            disable-autoupdate: 1
       fail-fast: false
     env:
-      CODESIGN: 0
+      CODESIGN: ${{ !!secrets.AZURE_CERT_PROFILE_NAME }}
     steps:
     - uses: actions/checkout@v4
       with:
@@ -25,16 +26,17 @@ jobs:
     - name: Set up Python
       uses: actions/setup-python@v5
       with:
-        python-version: 3.12
+        python-version: 3.13
+        cache: 'pip'
+        cache-dependency-path: |
+          requirements-build.txt
+          requirements-win.txt
     - name: Setup Windows build environment
       run: |
         & .\scripts\package\win-setup.ps1 `
           -DiscidVersion $Env:DISCID_VERSION -DiscidSha256Sum $Env:DISCID_SHA256SUM `
           -FpcalcVersion $Env:FPCALC_VERSION -FpcalcSha256Sum $Env:FPCALC_SHA256SUM
         Add-Content $env:GITHUB_PATH "C:\Program Files (x86)\Windows Kits\10\bin\10.0.18362.0\x64"
-        $ReleaseTag = $(git describe --match "release-*" --abbrev=0 --always HEAD)
-        $BuildNumber = $(git rev-list --count "$ReleaseTag..HEAD")
-        Add-Content $env:GITHUB_ENV "BUILD_NUMBER=$BuildNumber"
         New-Item -Name .\artifacts -ItemType Directory
       env:
         DISCID_VERSION: 0.6.4
@@ -57,80 +59,73 @@ jobs:
     - name: Patch build version
       if: startsWith(github.ref, 'refs/tags/') != true
       run: |
+        $ReleaseTag = $(git describe --match "release-*" --abbrev=0 --always HEAD)
+        $BuildNumber = $(git rev-list --count "$ReleaseTag..HEAD")
         python setup.py patch_version --platform=$Env:BUILD_NUMBER.$(git rev-parse --short HEAD)
     - name: Run tests
       timeout-minutes: 30
-      run: python setup.py test
-    - name: Prepare code signing certificate
-      if: matrix.type != 'store-app'
+      run: pytest --verbose
+    - name: Prepare clean build environment
       run: |
-        If ($Env:CODESIGN_P12_URL -And $Env:AWS_ACCESS_KEY_ID) {
-          pip install awscli
-          aws s3 cp "$Env:CODESIGN_P12_URL" .\codesign.pfx
-          Add-Content $env:GITHUB_ENV "CODESIGN=1"
-        } Else {
-          Write-Output "::warning::No code signing certificate available, skipping code signing."
-        }
-      env:
-        AWS_DEFAULT_REGION: eu-central-1
-        AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
-        AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-        CODESIGN_P12_URL: ${{ secrets.CODESIGN_P12_URL }}
-    - name: Build Windows 10 store app package
-      if: matrix.type == 'store-app'
+        Remove-Item -Path build,dist/picard,locale -Recurse -ErrorAction Ignore
+        python setup.py clean
+    - name: Build
       run: |
-        & .\scripts\package\win-package-appx.ps1 -BuildNumber $Env:BUILD_NUMBER
-        Move-Item .\dist\*.msix .\artifacts
+        python setup.py build --build-number=$BuildNumber
+        python setup.py build_ext
+        pyinstaller --noconfirm --clean picard.spec
+        If ($env:PICARD_BUILD_PORTABLE -ne "1") {
+          dist\picard\_internal\fpcalc -version
+        }
       env:
         PICARD_APPX_PUBLISHER: CN=0A9169B7-05A3-4ED9-8876-830F17846709
-    - name: Build Windows 10 signed app package
-      if: matrix.type == 'signed-app' && env.CODESIGN == '1'
-      run: |
-        $CertificateFile = ".\codesign.pfx"
-        $CertificatePassword = ConvertTo-SecureString -String $Env:CODESIGN_P12_PASSWORD -Force -AsPlainText
-        & .\scripts\package\win-package-appx.ps1 -BuildNumber $Env:BUILD_NUMBER `
-          -CertificateFile $CertificateFile -CertificatePassword $CertificatePassword
-        Move-Item .\dist\*.msix .\artifacts
-      env:
-        CODESIGN_P12_PASSWORD: ${{ secrets.CODESIGN_P12_PASSWORD }}
+        PICARD_BUILD_PORTABLE: ${{ matrix.setup.build-portable }}
+        PICARD_DISABLE_AUTOUPDATE: ${{ matrix.setup.disable-autoupdate }}
+    - name: Sign picard.exe
+      uses: azure/[email protected]
+      if: matrix.setup.type != 'portable' && env.CODESIGN == 'true'
+      with:
+        azure-tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+        azure-client-id: ${{ secrets.AZURE_CLIENT_ID }}
+        azure-client-secret: ${{ secrets.AZURE_CLIENT_SECRET }}
+        endpoint: ${{ secrets.AZURE_ENDPOINT }}
+        trusted-signing-account-name: ${{ secrets.AZURE_CODE_SIGNING_NAME }}
+        certificate-profile-name: ${{ secrets.AZURE_CERT_PROFILE_NAME }}
+        files-folder: dist\picard
+        files-folder-filter: exe
+        files-folder-recurse: true
+        timestamp-rfc3161: http://timestamp.acs.microsoft.com
+        timestamp-digest: SHA256
     - name: Build Windows installer
-      if: matrix.type == 'installer'
+      if: matrix.setup.type == 'installer'
       run: |
-        # choco install nsis
-        If ($Env:CODESIGN -eq "1") {
-          $CertificateFile = ".\codesign.pfx"
-          $CertificatePassword = ConvertTo-SecureString -String $Env:CODESIGN_P12_PASSWORD -Force -AsPlainText
-        } Else {
-          $CertificateFile = $null
-          $CertificatePassword = $null
-        }
-        & .\scripts\package\win-package-installer.ps1 -BuildNumber $Env:BUILD_NUMBER `
-          -CertificateFile $CertificateFile -CertificatePassword $CertificatePassword
+        makensis.exe /INPUTCHARSET UTF8 installer\picard-setup.nsi
         Move-Item .\installer\*.exe .\artifacts
-        dist\picard\_internal\fpcalc -version
-      env:
-        CODESIGN_P12_PASSWORD: ${{ secrets.CODESIGN_P12_PASSWORD }}
     - name: Build Windows portable app
-      if: matrix.type == 'portable'
+      if: matrix.setup.type == 'portable'
       run: |
-        If ($Env:CODESIGN -eq "1") {
-          $CertificateFile = ".\codesign.pfx"
-          $CertificatePassword = ConvertTo-SecureString -String $Env:CODESIGN_P12_PASSWORD -Force -AsPlainText
-        } Else {
-          $CertificateFile = $null
-          $CertificatePassword = $null
-        }
-        & .\scripts\package\win-package-portable.ps1 -BuildNumber $Env:BUILD_NUMBER `
-          -CertificateFile $CertificateFile -CertificatePassword $CertificatePassword
         Move-Item .\dist\*.exe .\artifacts
-      env:
-        CODESIGN_P12_PASSWORD: ${{ secrets.CODESIGN_P12_PASSWORD }}
-    - name: Cleanup
-      if: env.CODESIGN == '1'
-      run: Remove-Item .\codesign.pfx
+    - name: Build Windows 10 store app package
+      if: matrix.setup.type == 'store-app'
+      run: |
+        & .\scripts\package\win-package-appx.ps1 dist\picard
+        Move-Item .\dist\*.msix .\artifacts
+    - name: Sign final executable
+      uses: azure/[email protected]
+      if: matrix.setup.type != 'store-app' && env.CODESIGN == 'true'
+      with:
+        azure-tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+        azure-client-id: ${{ secrets.AZURE_CLIENT_ID }}
+        azure-client-secret: ${{ secrets.AZURE_CLIENT_SECRET }}
+        endpoint: ${{ secrets.AZURE_ENDPOINT }}
+        trusted-signing-account-name: ${{ secrets.AZURE_CODE_SIGNING_NAME }}
+        certificate-profile-name: ${{ secrets.AZURE_CERT_PROFILE_NAME }}
+        files-folder: artifacts
+        files-folder-filter: exe
+        timestamp-rfc3161: http://timestamp.acs.microsoft.com
+        timestamp-digest: SHA256
     - name: Archive production artifacts
       uses: actions/upload-artifact@v4
-      if: matrix.type != 'signed-app' || env.CODESIGN == '1'
       with:
-        name: windows-${{ matrix.type }}
+        name: windows-${{ matrix.setup.type }}
         path: artifacts/

.github/workflows/package.yml

@@ -45,20 +45,43 @@ jobs:
     permissions:
       id-token: write
 
+  pypi-release:
+    runs-on: ubuntu-latest
+    if: startsWith(github.ref, 'refs/tags/')
+    needs:
+      - package-pypi
+    environment:
+      name: pypi
+      url: https://pypi.org/p/picard
+    permissions:
+      id-token: write  # required for PyPI upload
+    steps:
+    - uses: actions/download-artifact@v4
+      with:
+        pattern: picard-?dist*
+        path: dist/
+        merge-multiple: true
+    - name: Prepare distributions
+      run: |
+        ls -l dist/
+        # Remove zip source distribution (only a single sdist is allowed)
+        rm dist/picard-*.zip*
+    - name: Publish package distributions to PyPI
+      uses: pypa/gh-action-pypi-publish@release/v1
+
   github-release:
     runs-on: ubuntu-latest
     if: startsWith(github.ref, 'refs/tags/')
     needs:
       - package-macos
       - package-windows
-      - package-pypi
     permissions:
       contents: write
     steps:
     - uses: actions/checkout@v4
     - uses: actions/setup-python@v5
       with:
-        python-version: 3.12
+        python-version: 3.13
     - uses: actions/download-artifact@v4
       with:
         name: macos-app-10.14

.github/workflows/ruff.yml

@@ -0,0 +1,10 @@
+name: Ruff
+on: [ push, pull_request ]
+jobs:
+  ruff:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/ruff-action@v3
+        with:
+          version: "latest"