Merge pull request vacanza#3769 from vacanza/dev

v0.103

Author: arkid15r

.github/PULL_REQUEST_TEMPLATE.md

@@ -24,7 +24,7 @@ Your PR description goes here.
 - [ ] Existing code quality improvement (best practice, cleanup, refactoring, optimization)
 - [ ] Documentation update
 - [ ] Test suite update
-- [ ] Development process update (CI/CD, project configuration, internal tooling)
+- [ ] Development process update (CI, release workflows, project configuration, internal tooling)
 - [ ] Dependency update (version deprecation/pin/upgrade)
 - [ ] Bugfix (non-breaking change which fixes an issue)
 - [ ] Breaking change (a code change causing existing functionality to break)

.github/workflows/check-country-holiday-updates.yml

@@ -27,12 +27,13 @@ permissions:
 
 jobs:
   check-country-updates:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04-arm
     steps:
       - name: Checkout holidays repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           fetch-depth: 0 # Get full commit history to accurately determine when each file was last modified
+          persist-credentials: false
           repository: vacanza/holidays
           token: ${{ secrets.GITHUB_TOKEN }}
 

.github/workflows/check-financial-holiday-updates.yml

@@ -27,12 +27,13 @@ permissions:
 
 jobs:
   check-financial-updates:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04-arm
     steps:
       - name: Checkout holidays repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           fetch-depth: 0 # Get full commit history to accurately determine when each file was last modified
+          persist-credentials: false
           repository: vacanza/holidays
           token: ${{ secrets.GITHUB_TOKEN }}
 

.github/workflows/ci-cd.yml

@@ -0,0 +1,49 @@
+name: CI
+
+on:
+  merge_group:
+  pull_request:
+    branches:
+      - dev
+      - main
+      - v1
+  push:
+    branches:
+      - dev
+      - v1
+  workflow_dispatch:
+
+env:
+  FORCE_COLOR: 1
+
+concurrency:
+  # Don't cancel push CI: cancelled runs never conclude success, so pre-release
+  # workflow_run would miss that commit. Still cancel superseded PR/merge_group runs.
+  group: ${{ github.repository }}-ci-${{ github.head_ref || github.ref }}
+  cancel-in-progress: ${{ github.event_name != 'push' }}
+
+permissions: {}
+
+jobs:
+  run-code-checks:
+    name: Code checks
+    permissions:
+      contents: read
+    uses: ./.github/workflows/run-code-checks.yml
+
+  run-code-ql:
+    name: CodeQL
+    permissions:
+      contents: read
+      security-events: write
+    uses: ./.github/workflows/run-code-ql.yml
+
+  run-code-tests:
+    name: Code tests
+    needs:
+      - run-code-checks
+    permissions:
+      contents: read
+    secrets:
+      CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
+    uses: ./.github/workflows/run-code-tests.yml