Maintenance/automation final

.github/PULL_REQUEST_TEMPLATE.md

@@ -25,8 +25,8 @@
 
 <!-- Please check each item below -->
 
-- [ ] My code follows the code style of this project (`ruff check .`, `ruff format .`)
+- [ ] My code follows the code style of this project (`spin lint`)
 - [ ] I have added tests that prove my fix is effective or that my feature works
 - [ ] I have run the full test suite and all tests pass
-- [ ] I have updated the documentation accordingly (`make -C docs html` builds without warnings)
-- [ ] I have added an entry to `CHANGELOG.md` (if applicable)
+- [ ] I have updated the documentation accordingly (`spin docs` builds without warnings)
+- [ ] I have added a numbered Towncrier fragment in `docs/changes/devel/` (if applicable)

.github/dependabot.yml

@@ -1,13 +1,20 @@
 version: 2
 updates:
-  - package-ecosystem: "pip"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 10
-
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
       interval: "weekly"
+      day: "monday"
+      time: "05:17"
+      timezone: "UTC"
+    cooldown:
+      default-days: 7
+    commit-message:
+      prefix: "[dependabot]"
+    groups:
+      github-actions:
+        patterns:
+          - "*"
+    labels:
+      - "no-changelog-entry-needed"
     open-pull-requests-limit: 10

.github/workflows/autofix.yml

@@ -0,0 +1,88 @@
+name: autofix.ci
+
+on:  # yamllint disable-line rule:truthy
+  pull_request:
+    branches: [main]
+    types: [opened, synchronize, labeled, unlabeled]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.number || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+  pull-requests: read
+
+jobs:
+  autofix:
+    name: Apply repository fixes
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
+        with:
+          python-version: "3.12"
+          cache: pip
+      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d  # v10.0.1
+      - name: Install shared lockfile checker
+        run: >-
+          python -m pip install
+          "mne-tools @ git+https://github.com/mne-tools/mne-tools.git@2e7c4b5469ef311a169e16c7f97cd0ce68508a61"
+      - name: Install maintenance tools
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install --group lint --group changelog
+      - name: Number the changelog fragment
+        env:
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+        run: python scripts/rename_towncrier.py --pr-number "$PR_NUMBER"
+      - name: Detect dependency changes
+        id: changed
+        env:
+          GH_REPO: ${{ github.repository }}
+          GH_PR_NUMBER: ${{ github.event.pull_request.number }}
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          changed_files="$(gh api --paginate \
+            --header 'Accept: application/vnd.github+json' \
+            "repos/${GH_REPO}/pulls/${GH_PR_NUMBER}/files?per_page=100" \
+            --jq '.[].filename')"
+          if grep -Eq '^(pyproject\.toml|tools/pylock\.ci-old\.toml|\.github/workflows/autofix\.yml)$' <<<"$changed_files"; then
+            echo "dependencies=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "dependencies=false" >> "$GITHUB_OUTPUT"
+          fi
+      - name: Regenerate lower-bound lockfile
+        if: steps.changed.outputs.dependencies == 'true'
+        run: >-
+          uv pip compile pyproject.toml --python "3.12"
+          --python-platform "x86_64-unknown-linux-gnu" --group test
+          --group lockfile_extras --resolution lowest-direct --format pylock.toml
+          --output-file tools/pylock.ci-old.toml --no-cache
+      - name: Validate lower-bound lockfile
+        if: steps.changed.outputs.dependencies == 'true'
+        run: |
+          python -m mne_tools.check_lockfile \
+            "$GITHUB_WORKSPACE" \
+            tools/pylock.ci-old.toml \
+            --groups lockfile_extras
+      - name: Run repository hooks
+        run: prek run --all-files
+      - name: Verify autofix working tree
+        run: |
+          git status --short
+          if git status --short | grep -F -- '.ci/mne-tools'; then
+            echo 'Unexpected nested mne-tools repository in the working tree.' >&2
+            exit 1
+          fi
+      - name: Apply fixes through autofix.ci
+        if: success() || failure()
+        uses: autofix-ci/action@c5b2d67aa2274e7b5a18224e8171550871fc7e4a  # v1.3.4

.github/workflows/check_changelog.yml

@@ -0,0 +1,27 @@
+name: Changelog
+
+on:  # yamllint disable-line rule:truthy
+  pull_request:
+    branches: [main]
+    types: [opened, synchronize, labeled, unlabeled]
+
+permissions:
+  contents: read
+  pull-requests: read
+
+jobs:
+  changelog:
+    name: Check changelog entry
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: scientific-python/action-towncrier-changelog@165df35cfb3ff4b5bfea7645c4b923c6e8c7b54a  # v2.0.0
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          BOT_USERNAME: changelog-bot

.github/workflows/dependency-review.yml

@@ -0,0 +1,21 @@
+name: Dependency review
+
+on:  # yamllint disable-line rule:truthy
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  dependency-review:
+    name: Dependency review
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294  # v5.0.0
+        with:
+          fail-on-severity: high

.github/workflows/docs.yml

@@ -1,6 +1,6 @@
 name: Docs
 
-on:
+on:  # yamllint disable-line rule:truthy
   push:
     branches: [main]
   pull_request:
@@ -27,11 +27,11 @@ jobs:
       run:
         shell: bash
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           fetch-depth: 0
           persist-credentials: false
-      - uses: actions/setup-python@v7
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
         with:
           python-version: "3.14"
           cache: pip
@@ -52,7 +52,7 @@ jobs:
         run: python -m pip check
       - name: Restore documentation datasets
         id: docs-data-cache
-        uses: actions/cache/restore@v6
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v6.1.0
         with:
           path: ${{ env.MNE_DATA }}
           key: docs-data-${{ runner.os }}-${{ hashFiles('scripts/prefetch_docs_data.py', 'pyproject.toml') }}
@@ -66,7 +66,7 @@ jobs:
           (github.event_name == 'push' ||
            github.event_name == 'schedule' ||
            github.event_name == 'workflow_dispatch')
-        uses: actions/cache/save@v6
+        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v6.1.0
         with:
           path: ${{ env.MNE_DATA }}
           key: docs-data-${{ runner.os }}-${{ hashFiles('scripts/prefetch_docs_data.py', 'pyproject.toml') }}
@@ -83,7 +83,7 @@ jobs:
           test -s docs/_build/html/auto_examples/zapline/plot_03_epoched_data.html
           echo "$(find docs/_build/html -name '*.html' | wc -l) HTML pages built"
       - name: Upload documentation artifact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
         with:
           name: docs-html-stable-mne
           path: docs/_build/html/
@@ -99,11 +99,11 @@ jobs:
       run:
         shell: bash
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           fetch-depth: 0
           persist-credentials: false
-      - uses: actions/setup-python@v7
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
         with:
           python-version: "3.14"
           cache: pip
@@ -112,7 +112,7 @@ jobs:
           python -m pip install --upgrade pip
           python -m pip install -e . --group doc
           python -c "import mne; print(mne.__version__)" > "$RUNNER_TEMP/docs-mne-stable-version"
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           repository: mne-tools/mne-python
           path: .ci/mne-python
@@ -142,7 +142,7 @@ jobs:
               raise SystemExit("MNE main installation did not replace stable MNE")
           PY
       - name: Restore documentation datasets
-        uses: actions/cache/restore@v6
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v6.1.0
         with:
           path: ${{ env.MNE_DATA }}
           key: docs-data-${{ runner.os }}-${{ hashFiles('scripts/prefetch_docs_data.py', 'pyproject.toml') }}
@@ -165,7 +165,7 @@ jobs:
           test -s docs/_build/html/auto_examples/zapline/plot_03_epoched_data.html
           echo "$(find docs/_build/html -name '*.html' | wc -l) HTML pages built"
       - name: Upload documentation artifact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
         with:
           name: docs-html-mne-main
           path: docs/_build/html/
@@ -181,12 +181,12 @@ jobs:
       contents: write
     steps:
       - name: Download stable-MNE documentation
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
         with:
           name: docs-html-stable-mne
           path: docs/_build/html/
       - name: Deploy to GitHub Pages
-        uses: peaceiris/actions-gh-pages@v4
+        uses: peaceiris/actions-gh-pages@1ef5a1b1df4c63fe21a2242edbee6cac921ece01  # v4.1.0
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           publish_dir: docs/_build/html/

.github/workflows/release.yml

@@ -1,6 +1,6 @@
 name: Release
 
-on:
+on:  # yamllint disable-line rule:truthy
   release:
     types: [published]
   push:
@@ -20,13 +20,13 @@ jobs:
       run:
         shell: bash
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           fetch-depth: 0
           persist-credentials: false
-      - uses: actions/setup-python@v7
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
         with:
-          python-version: "3.11"
+          python-version: "3.12"
       - name: Install build dependencies
         run: |
           python -m pip install --upgrade pip
@@ -108,7 +108,7 @@ jobs:
           "$wheel_test/bin/python" "$GITHUB_WORKSPACE/scripts/check_base_install.py"
           "$wheel_test/bin/python" -m pip check
       - name: Upload release distributions
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
         with:
           name: release-dists
           path: dist/
@@ -127,11 +127,11 @@ jobs:
       name: pypi
       url: https://pypi.org/p/mne-denoise
     steps:
-      - uses: actions/download-artifact@v8
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
         with:
           name: release-dists
           path: dist/
       - name: Publish package distributions to PyPI
-        uses: pypa/gh-action-pypi-publish@release/v1
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33  # v1.14.2
         with:
           print-hash: true