Modernize gh actions and pyproject #97

dalito · 2025-12-25T18:06:02Z

This pull request modernizes the project's Python packaging and CI/CD setup. It brings the project in line with modern Python packaging and CI/CD best practices, and ensures compatibility with current Python versions.

Build system and packaging modernization:

Migrated all project metadata and configuration to pyproject.toml, adopting Hatch as the build back-end, and removed legacy files like setup.py, and MANIFEST.in (setup.cfg had to kept for flake8).
Updated the package versioning to use git-based versioning via Hatch and included logic in skosify/__init__.py to retrieve the version dynamically.
Added a tox.ini file for easier local cross-vesrsion testing with tox.

Continuous integration and deployment improvements:

Replaced the old GitHub Actions workflow (python-package.yml) with two new workflows:
- ci.yml for testing (across Python 3.9–3.14) and documentation builds,
- pypi-publish.yml for publishing to PyPI/TestPyPI using trusted publishing and Hatch.
@osma Most likely you need to configure the project in PyPI for modern trusted publishing (since there were no releases for a while)

Documentation updates:

Updated Sphinx configuration (docs/conf.py) to use modern settings, dynamic version retrieval
Updated badges and installation instructions in README.rst to reflect the new CI system and supported Python versions.

I did not modernize the code or break Python 3.6 compatibility but only removed the end-of life Python versions 3.6-3.8 from CI testing. I kept 3.9 which is also end-of-life but it was the newest version before this PR.

- .githook should not be committed - skosify is installed, no skosify.py required install as developer with pip install -e .[dev]

dalito · 2025-12-25T18:58:26Z

docs/background.rst

   Quality of SKOS Vocabularies. Journal on Data Semantics, vol. 3, no.
   1, pp. 47-73, June, 2014
-   (`PDF <https://seco.cs.aalto.fi/publications/2014/suominen-mader-skosquality.pdf>`_)
+   (`PDF <https://seco.cs.aalto.fi/publications/2014/suominen-mader-skosquality.pdf>`__)


Avoids sphinx WARNING: Duplicate explicit target name: "pdf". [docutils]

- pyproject replaces pytest.ini, setup.py, setup.cfg. MANIFEST.in - hatchling as build backend - hatch-vcs for dynamic versioning based on git tags - hatch as build frontend

The RTD theme currently pins Sphinx to <9.0

osma · 2026-01-07T11:48:42Z

Thanks a lot for this PR @dalito ! Whoa, that's a huge amount of work you have put into this PR!

We'll have to look over this and see what to do. As you've surely noticed, it's been a long time since we've done any maintenance work on Skosify. The tool itself has been working fine (for us) so there hasn't been an urgent need to touch it. As a result the codebase has been stagnant.

dalito · 2026-01-07T12:46:35Z

Whoa, that's a huge amount of work you have put into this PR!

I did very similar stuff in several other projects recently so it was mainly adapting not first-time elaboration. The Skosify code required no work (good sign!). Skosify is quite useful so it deserves some fresh air. 😃

juhoinkinen · 2026-01-07T14:27:41Z

Build system and packaging modernization:

Migrated all project metadata and configuration to pyproject.toml, adopting Hatch as the build back-end, and removed legacy files like setup.py, and MANIFEST.in (setup.cfg had to kept for flake8).

Updated the package versioning to use git-based versioning via Hatch and included logic in skosify/__init__.py to retrieve the version dynamically.

Added a tox.ini file for easier local cross-vesrsion testing with tox.

Hi @dalito, could you add also short, basic instructions for how to use Hatch and tox with Skosify to the README? It would help in testing this, as I haven't used those tools before.

juhoinkinen

Just read this through and dropped some comments and questions :)

.github/dependabot.yml

juhoinkinen · 2026-01-07T14:50:02Z

.github/workflows/pypi-publish.yml

Are the different jobs for building and publishing necessary? Running these steps in one job would remove the need for upload-artifact and download-artifact steps.

The main reason is security / isolation. The OpenID connect token is only available in pubishing this way. This is now best practice and also suggested in Python packaging guides.

Ok, to me it feels a bit insecure to also download the distribution to publish from another job, but that is suggested also here https://docs.pypi.org/trusted-publishers/security-model/:

Limit the scope of your publishing job: your publishing job should (ideally) have only two steps:

a. Retrieve the publishable distribution files from a separate build job;

b. Publish the distributions using pypa/gh-action-pypi-publish@release/v1.

By using a separate build job, you keep the number of steps that can access the OIDC token to a bare minimum. This prevents both accidental and malicious disclosure.

For a reference see also this: pypa/gh-action-pypi-publish#324 (comment)

juhoinkinen · 2026-01-07T14:59:57Z

.github/workflows/pypi-publish.yml

+
+      - name: Publish package 📦 to PyPI
+        if: github.event_name == 'release'
+        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e


Suggested change

uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e

uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0

For clarity the version number could be shown as a comment.

Dependabot makes the versions clear in the update-PRs (but would not add/update such version-comment again). I used the current versions from when I made the PR (Dec 25th)

Actually Depedabot does update the version comments, which is surprising but nice, see e.g. here: https://github.com/NatLibFi/Annif/pull/925/changes

Interesting (and quite nice!)

juhoinkinen · 2026-01-07T15:10:48Z

.github/workflows/pypi-publish.yml

+      # GitHub glob matching is limited [1]. So we can't define a pattern matching
+      # pep 440 version definition [N!]N(.N)*[{a|b|rc}N][.postN][.devN]
+      - 'v[0-9]+.[0-9]+.[0-9]+.?*'
+  release:


Do we want to have this workflow trigger on releases too? Previously there was only the trigger on tags.

It is triggered on both. Typically I publish to test-pypi on the tag and to pypi by creating a gh release. Note, that below is still the filter to only publish to PyPI for a GitHub-release. if: github.event_name == 'release'

Tell me what you prefer (or change it - committing to the PR is allowed for maintainers).

Co-authored-by: Juho Inkinen <34240031+juhoinkinen@users.noreply.github.com>

dalito · 2026-01-07T17:02:17Z

I added some notes on using tox and how to build locally to README.rst.

Remove .githooks and script at root

64594fe

- .githook should not be committed - skosify is installed, no skosify.py required install as developer with pip install -e .[dev]

dalito marked this pull request as draft December 25, 2025 18:08

dalito force-pushed the modernize-gh-actions-and-pyproject branch from 222ef73 to 3d2dc16 Compare December 25, 2025 18:24

dalito marked this pull request as ready for review December 25, 2025 18:29

dalito mentioned this pull request Dec 25, 2025

API documentation missing #93

Open

dalito commented Dec 25, 2025

View reviewed changes

dalito added 5 commits December 26, 2025 11:01

Change repo to pyproject

1fa4e79

- pyproject replaces pytest.ini, setup.py, setup.cfg. MANIFEST.in - hatchling as build backend - hatch-vcs for dynamic versioning based on git tags - hatch as build frontend

Rename CI file before renovation/split

bf04f59

Split action to CI/testing and publishing & modernize

bf09762

Update Sphinx config for Sphinx 8.x/9.x

484b02d

The RTD theme currently pins Sphinx to <9.0

Add tox.ini for multiversion tests

a2728fb

dalito force-pushed the modernize-gh-actions-and-pyproject branch from 3d2dc16 to a2728fb Compare December 26, 2025 10:02

dalito added 2 commits December 26, 2025 11:03

Add dependabot config for monthly gh-action updates

777c771

Mention pipx/uv tool install, update Python versions

d7f5fce

dalito force-pushed the modernize-gh-actions-and-pyproject branch from 9cefa0f to d7f5fce Compare December 26, 2025 10:23

osma added the enhancement label Jan 7, 2026

juhoinkinen self-assigned this Jan 7, 2026

juhoinkinen reviewed Jan 7, 2026

View reviewed changes

dalito and others added 2 commits January 7, 2026 16:56

Apply suggestion from @juhoinkinen

15c9ec1

Co-authored-by: Juho Inkinen <34240031+juhoinkinen@users.noreply.github.com>

Add note on tox and building to README

eced5ac

Add version corresponding to hash as comment

ea82539

	uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e
	uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0

Modernize gh actions and pyproject #97

Are you sure you want to change the base?

Modernize gh actions and pyproject #97

Uh oh!

Conversation

dalito commented Dec 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

osma commented Jan 7, 2026

Uh oh!

dalito commented Jan 7, 2026

Uh oh!

juhoinkinen commented Jan 7, 2026

Uh oh!

juhoinkinen left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

dalito commented Jan 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

dalito commented Dec 25, 2025 •

edited

Loading