build: modernize repo tooling and remove sample-plugin leftovers

.annotation_safe_list.yml

@@ -21,29 +21,3 @@ contenttypes.ContentType:
   ".. no_pii:": "This model has no PII"
 sessions.Session:
   ".. no_pii:": "This model has no PII"
-social_django.Association:
-  ".. no_pii:": "This model has no PII"
-social_django.Code:
-  ".. pii:": "Email address"
-  ".. pii_types:": other
-  ".. pii_retirement:": local_api
-social_django.Nonce:
-  ".. no_pii:": "This model has no PII"
-social_django.Partial:
-  ".. no_pii:": "This model has no PII"
-social_django.UserSocialAuth:
-  ".. no_pii:": "This model has no PII"
-waffle.Flag:
-  ".. no_pii:": "This model has no PII"
-waffle.Sample:
-  ".. no_pii:": "This model has no PII"
-waffle.Switch:
-  ".. no_pii:": "This model has no PII"
-openedx_catalog.CatalogCourse:
-  ".. no_pii:": "This model has no PII"
-openedx_catalog.CourseRun:
-  ".. no_pii:": "This model has no PII"
-organizations.HistoricalOrganization:
-  ".. no_pii:": "This model has no PII"
-organizations.HistoricalOrganizationCourse:
-  ".. no_pii:": "This model has no PII"

.coveragerc

@@ -1,10 +1,8 @@
 [run]
 branch = True
 data_file = .coverage
-source=sample_plugin
+source=openedx_search
 omit =
     test_settings.py
     */migrations/*
     *admin.py
-    */static/*
-    */templates/*

.editorconfig

@@ -64,7 +64,7 @@
 # SERIOUSLY.
 #
 # ------------------------------
-# Generated by edx-lint version: 5.2.5
+# Generated by edx-lint version: 6.2.0
 # ------------------------------
 [*]
 end_of_line = lf
@@ -97,4 +97,4 @@ max_line_length = 72
 [*.rst]
 max_line_length = 79
 
-# f2f02689fced7a2e0c62c2f9803184114dc2ae4b
+# 1fa0c820cb13bc717a559f365e5caac85c69459b

.github/dependabot.yml

@@ -0,0 +1,8 @@
+version: 2
+updates:
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      # Check for updates to GitHub Actions every week
+        interval: "weekly"

.github/workflows/add-depr-ticket-to-depr-board.yml

@@ -0,0 +1,19 @@
+# Run the workflow that adds new tickets that are either:
+# - labelled "DEPR"
+# - title starts with "[DEPR]"
+# - body starts with "Proposal Date" (this is the first template field)
+# to the org-wide DEPR project board
+
+name: Add newly created DEPR issues to the DEPR project board
+
+on:
+  issues:
+    types: [opened]
+
+jobs:
+  routeissue:
+    uses: openedx/.github/.github/workflows/add-depr-ticket-to-depr-board.yml@master
+    secrets:
+      GITHUB_APP_ID: ${{ secrets.GRAPHQL_AUTH_APP_ID }}
+      GITHUB_APP_PRIVATE_KEY: ${{ secrets.GRAPHQL_AUTH_APP_PEM }}
+      SLACK_BOT_TOKEN: ${{ secrets.SLACK_ISSUE_BOT_TOKEN }}

.github/workflows/add-remove-label-on-comment.yml

@@ -0,0 +1,20 @@
+# This workflow runs when a comment is made on the ticket
+# If the comment starts with "label: " it tries to apply
+# the label indicated in rest of comment.
+# If the comment starts with "remove label: ", it tries
+# to remove the indicated label.
+# Note: Labels are allowed to have spaces and this script does
+# not parse spaces (as often a space is legitimate), so the command
+# "label: really long lots of words label" will apply the
+# label "really long lots of words label"
+
+name: Allows for the adding and removing of labels via comment
+
+on:
+  issue_comment:
+    types: [created]
+
+jobs:
+  add_remove_labels:
+    uses: openedx/.github/.github/workflows/add-remove-label-on-comment.yml@master
+

.github/workflows/ci.yml

@@ -0,0 +1,86 @@
+name: CI
+
+# Every check that runs on a pull request, aggregated behind a single
+# "all required checks passed" job. Branch protection only needs to require
+# that one name, so adding or retiring a Django version from the matrix never
+# requires a change to the repository settings.
+
+on:
+  pull_request:
+    branches:
+      - "**"
+  # So the release workflow can run every check before it publishes anything.
+  workflow_call:
+
+concurrency:
+  # On a pull request, group by the PR so a new push supersedes the run still
+  # going for the previous one. Any other event -- notably the workflow_call
+  # from the release -- keys on the unique run id, so release runs never queue
+  # behind or cancel each other.
+  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.ref || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+permissions:
+  contents: read
+
+jobs:
+  run_tests:
+    name: tests
+    runs-on: ${{ matrix.os }}
+    strategy:
+      matrix:
+        os: [ubuntu-latest]
+        python-version: ["3.12"]
+        toxenv: [quality, docs, pii_check, django52, django60]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: setup python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0
+        with:
+          # Every matrix job populates the uv cache with a different set of tox
+          # dependencies, so give each one its own cache key.
+          cache-suffix: ${{ matrix.toxenv }}
+
+      - name: Install CI dependencies
+        run: uv sync --group ci
+
+      - name: Run Tests
+        env:
+          TOXENV: ${{ matrix.toxenv }}
+        # `uv sync` does not put tox on PATH, so run it through uv.
+        run: uv run tox
+
+      - name: Run coverage
+        if: matrix.python-version == '3.12' && matrix.toxenv == 'django52'
+        uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
+        with:
+          token: ${{ secrets.CODECOV_TOKEN }}
+          flags: unittests
+          fail_ci_if_error: true
+
+  required_checks:
+    # This name is what branch protection requires, so changing it means
+    # updating the repository settings at the same moment.
+    name: all required checks passed
+    # `always()` so this still reports when something upstream fails. A skipped
+    # required check never reports, which blocks the pull request forever.
+    if: always()
+    needs: [run_tests]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check that every job succeeded
+        run: |
+          results='${{ join(needs.*.result, ' ') }}'
+          echo "Job results: $results"
+          for result in $results; do
+            if [ "$result" != "success" ]; then
+              echo "::error::A required job reported '$result'."
+              exit 1
+            fi
+          done
+          echo "All jobs succeeded."

.github/workflows/commitlint.yml

@@ -0,0 +1,10 @@
+# Run commitlint on the commit messages in a pull request.
+
+name: Lint Commit Messages
+
+on:
+  - pull_request
+
+jobs:
+  commitlint:
+    uses: openedx/.github/.github/workflows/commitlint.yml@master

.github/workflows/release.yml

@@ -0,0 +1,100 @@
+name: Semantic Release
+
+on:
+  push:
+    branches: [main]
+
+jobs:
+  # The same aggregate a pull request has to pass, so the release runs exactly
+  # the checks that were required to merge.
+  run_ci:
+    uses: ./.github/workflows/ci.yml
+
+  release:
+    needs: [run_ci]
+    runs-on: ubuntu-latest
+    if: github.ref_name == 'main'
+    concurrency:
+      group: ${{ github.workflow }}-release-${{ github.ref_name }}
+      cancel-in-progress: false
+
+    permissions:
+      contents: write
+
+    steps:
+      # Check out the branch that triggered the workflow, then force it back to
+      # the workflow sha: the branch may have moved while CI was running, and we
+      # must not release changes that were never evaluated.
+      - name: Setup | Checkout Repository on Release Branch
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.ref_name }}
+
+      - name: Setup | Force release branch to be at workflow sha
+        run: |
+          git reset --hard ${{ github.sha }}
+
+      - name: Action | Semantic Version Release
+        id: release
+        uses: python-semantic-release/python-semantic-release@9a026e9303981c866c3425723009becb2437c757 # v10.6.2
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          git_committer_name: "github-actions"
+          git_committer_email: "actions@users.noreply.github.com"
+          changelog: "false"
+          # Commit, tag, push and build, but don't create the GitHub release.
+          # We create it ourselves in the next step so that the distributions
+          # are attached before the release is published.
+          vcs_release: "false"
+
+      # If the repo has immutable releases enabled, assets cannot be attached
+      # after a release is published. `gh release create` with the assets
+      # creates it as a draft, uploads them, and only then publishes it:
+      # https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/immutable-releases
+      - name: Publish | Create GitHub Release with Assets
+        if: steps.release.outputs.released == 'true'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          RELEASE_NOTES: ${{ steps.release.outputs.release_notes }}
+          TAG: ${{ steps.release.outputs.tag }}
+        run: |
+          printf '%s' "$RELEASE_NOTES" > "$RUNNER_TEMP/release_notes.md"
+          gh release create "$TAG" \
+            --verify-tag \
+            --title "$TAG" \
+            --notes-file "$RUNNER_TEMP/release_notes.md" \
+            dist/*
+
+      - name: Upload | Distribution Artifacts
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        if: steps.release.outputs.released == 'true'
+        with:
+          name: distribution-artifacts
+          path: dist
+          if-no-files-found: error
+
+    outputs:
+      released: ${{ steps.release.outputs.released || 'false' }}
+      version: ${{ steps.release.outputs.version }}
+
+  publish_to_pypi:
+    # A separate job so that publishing runs with the least token privilege,
+    # and so that a failed upload can be retried without redoing the release.
+    runs-on: ubuntu-latest
+    needs: release
+    if: github.ref_name == 'main' && needs.release.outputs.released == 'true'
+
+    permissions:
+      contents: read
+      # PyPI trusted publishing (OIDC); no API token is stored in the repo.
+      id-token: write
+
+    steps:
+      - name: Setup | Download Build Artifacts
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: distribution-artifacts
+          path: dist
+
+      - name: Publish to PyPi
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2

.github/workflows/self-assign-issue.yml

@@ -0,0 +1,12 @@
+# This workflow runs when a comment is made on the ticket
+# If the comment starts with "assign me" it assigns the author to the
+# ticket (case insensitive)
+
+name: Assign comment author to ticket if they say "assign me"
+on:
+  issue_comment:
+    types: [created]
+
+jobs:
+  self_assign_by_comment:
+    uses: openedx/.github/.github/workflows/self-assign-issue.yml@master

.github/workflows/upgrade-python-requirements.yml

@@ -0,0 +1,27 @@
+name: Upgrade Python Requirements
+
+on:
+  schedule:
+    - cron: "0 0 * * 1"
+  workflow_dispatch:
+    inputs:
+      branch:
+        description: "Target branch against which to create requirements PR"
+        required: true
+        default: 'main'
+
+jobs:
+  call-upgrade-python-requirements-workflow:
+    uses: openedx/.github/.github/workflows/upgrade-python-requirements.yml@master
+    with:
+      branch: ${{ github.event.inputs.branch || 'main' }}
+      # optional parameters below; fill in if you'd like github or email notifications
+      # user_reviewers: ""
+      # team_reviewers: ""
+      # email_address: ""
+      # send_success_notification: false
+    secrets:
+      requirements_bot_github_token: ${{ secrets.REQUIREMENTS_BOT_GITHUB_TOKEN }}
+      requirements_bot_github_email: ${{ secrets.REQUIREMENTS_BOT_GITHUB_EMAIL }}
+      edx_smtp_username: ${{ secrets.EDX_SMTP_USERNAME }}
+      edx_smtp_password: ${{ secrets.EDX_SMTP_PASSWORD }}

.gitignore

@@ -54,16 +54,13 @@ ghostdriver.log
 output/*.html
 output/*/index.html
 
-# Sphinx
+# Sphinx (sphinx-apidoc output is regenerated on every build)
 docs/_build
 docs/modules.rst
-docs/sample_plugin.rst
-docs/sample_plugin.*.rst
-
-# Private requirements
-requirements/private.in
-requirements/private.txt
+docs/openedx_search.rst
+docs/openedx_search.*.rst
 
 # Test cruft
 default.db
 pii_report
+pyproject.toml.orig