[chore] Tooling updates/tweaks (#252)

* Bump pre-commit/ruff versions
* Tidy up tox config
* Bump action versions and harden checkout action
* Lint

.github/workflows/nightly-tests.yml

@@ -24,14 +24,16 @@ jobs:
 
     steps:
       - uses: actions/checkout@v4
-      - name: Set up Python 3.11
+        with:
+          persist-credentials: false
+      - name: Set up Python
         uses: actions/setup-python@v5
         with:
-          python-version: "3.11"
+          python-version: "3.13"
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip
-          pip install "psycopg2>=2.6"
+          pip install "psycopg2>=2.9"
           pip install "git+https://github.com/wagtail/wagtail.git@main#egg=wagtail"
           pip install -e .[testing]
       - name: Test

.github/workflows/publish.yml

@@ -11,13 +11,25 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
+      - name: 🔒 Harden Runner
+        uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
+        with:
+          disable-sudo: true
+          egress-policy: block
+          allowed-endpoints: >
+            files.pythonhosted.org:443
+            github.com:443
+            pypi.org:443
+            api.github.com:443
+
       - uses: actions/checkout@v4
         with:
+          persist-credentials: false
           fetch-depth: 0
 
       - uses: actions/setup-python@v5
         with:
-          python-version: '3.11'
+          python-version: '3.13'
           cache: "pip"
           cache-dependency-path: "**/pyproject.toml"
 
@@ -28,7 +40,7 @@ jobs:
       - name: 🏗️ Build
         run: python -Im flit build
 
-      - uses: actions/upload-artifact@v3
+      - uses: actions/upload-artifact@v4
         with:
           path: ./dist
 
@@ -43,7 +55,7 @@ jobs:
       # Mandatory for trusted publishing
       id-token: write
     steps:
-      - uses: actions/download-artifact@v3
+      - uses: actions/download-artifact@v4
 
       - name: 🚀 Publish package distributions to PyPI
         uses: pypa/gh-action-pypi-publish@release/v1

.github/workflows/ruff.yml

@@ -14,8 +14,10 @@ jobs:
 
     steps:
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
 
-    - run: python -Im pip install --user ruff==0.5.4
+    - run: python -Im pip install --user ruff==0.8.2
 
     - name: Run ruff
       working-directory: ./src

.github/workflows/test.yml

@@ -19,7 +19,7 @@ env:
   PIP_DISABLE_PIP_VERSION_CHECK: "1"
   PIP_NO_PYTHON_VERSION_WARNING: "1"
   # Keep in sync with .pre-commit-config.yaml/default_language_version/python.
-  PYTHON_LATEST: "3.11"
+  PYTHON_LATEST: "3.12"  # because harden runner fails on the 3.13 download
 
 jobs:
   tests:
@@ -32,7 +32,7 @@ jobs:
 
     steps:
       - name: 🔒 Harden Runner
-        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
+        uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
         with:
           disable-sudo: true
           egress-policy: block
@@ -43,6 +43,8 @@ jobs:
             pypi.org:443
             api.github.com:443
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - name: 🐍 Set up Python ${{ matrix.python-version }}
         uses: actions/setup-python@v5
         with:
@@ -60,9 +62,9 @@ jobs:
         run: tox --installpkg ./dist/*.whl
 
       - name: ⬆️ Upload coverage data
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
         with:
-          name: coverage-data
+          name: coverage-data-${{ matrix.python-version }}
           path: .coverage.*
           if-no-files-found: ignore
           include-hidden-files: true
@@ -74,7 +76,7 @@ jobs:
 
     steps:
       - name: 🔒 Harden Runner
-        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
+        uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
         with:
           disable-sudo: true
           egress-policy: block
@@ -85,6 +87,7 @@ jobs:
             api.github.com:443
       - uses: actions/checkout@v4
         with:
+          persist-credentials: false
           fetch-depth: 0
       - uses: actions/setup-python@v5
         with:
@@ -94,9 +97,10 @@ jobs:
       - run: python -Im pip install --upgrade coverage
 
       - name: Download coverage data
-        uses: actions/download-artifact@v3
+        uses: actions/download-artifact@v4
         with:
-          name: coverage-data
+          pattern: coverage-data-*
+          merge-multiple: true
 
       - name: ＋  Combine coverage
         run: |
@@ -106,7 +110,7 @@ jobs:
           echo "## Coverage summary" >> $GITHUB_STEP_SUMMARY
           python -Im coverage report --format=markdown >> $GITHUB_STEP_SUMMARY
       - name: 📈 Upload HTML report if check failed.
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
         with:
           name: html-report
           path: htmlcov

.pre-commit-config.yaml

@@ -3,11 +3,11 @@ ci:
   autoupdate_schedule: 'quarterly'
 
 default_language_version:
-  python: python3.11
+  python: python3.13
 
 repos:
   - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v4.5.0
+    rev: v5.0.0
     hooks:
     - id: check-added-large-files
     - id: check-case-conflict
@@ -19,7 +19,7 @@ repos:
     - id: end-of-file-fixer
     - id: trailing-whitespace
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: 'v0.5.4'
+    rev: 'v0.8.2'  # keep in sync with .github/workflows/ruff.yml
     hooks:
       - id: ruff
         args: [--fix, --exit-non-zero-on-fix]

pyproject.toml

@@ -33,10 +33,10 @@ dependencies = [
 
 [project.optional-dependencies]
 testing = [
-    "coverage>=7.4.0",
+    "coverage>=7.6.0",
 ]
 linting = [
-    "pre-commit>=3.6.0",
+    "pre-commit>=5.0.0",
 ]
 
 [project.urls]

src/wagtailmedia/blocks.py

@@ -1,4 +1,4 @@
-from typing import TYPE_CHECKING, Type
+from typing import TYPE_CHECKING
 
 from django.forms import ModelChoiceField
 from django.template.loader import render_to_string
@@ -52,7 +52,7 @@ def render_basic(self, value, context=None):
             f"You need to implement {self.__class__.__name__}.render_basic"
         )
 
-    def get_comparison_class(self) -> Type["MediaChooserBlockComparison"]:
+    def get_comparison_class(self) -> type["MediaChooserBlockComparison"]:
         return MediaChooserBlockComparison
 
 

src/wagtailmedia/wagtail_hooks.py

@@ -95,7 +95,7 @@ def register_media_permissions_panel():
 def describe_collection_media(collection):
     media_count = get_media_model().objects.filter(collection=collection).count()
     if media_count:
-        url = reverse("wagtailmedia:index") + ("?collection_id=%d" % collection.id)
+        url = reverse("wagtailmedia:index") + f"?collection_id={collection.id}"
         return {
             "count": media_count,
             "count_text": ngettext(

tests/test_admin.py

@@ -2,6 +2,7 @@
 from django.urls import reverse
 from wagtail.models import Page
 from wagtail.test.utils import WagtailTestUtils
+
 from wagtailmedia.blocks import AbstractMediaChooserBlock
 
 

tests/test_api.py

@@ -2,6 +2,7 @@
 
 from django.test import TestCase, override_settings
 from django.urls import reverse
+
 from wagtailmedia.models import get_media_model
 
 from .utils import create_audio, create_video
@@ -66,8 +67,7 @@ def test_basic(self):
 
             # Check detail_url
             self.assertEqual(
-                item["meta"]["detail_url"],
-                "http://localhost/api/media/%d/" % item["id"],
+                item["meta"]["detail_url"], f"http://localhost/api/media/{item['id']}/"
             )
 
             media = Media.objects.get(pk=item["id"])

tests/test_blocks.py

@@ -1,6 +1,7 @@
 from django.core.files.base import ContentFile
 from django.test import TestCase
 from django.urls import reverse
+
 from wagtailmedia.blocks import (
     AbstractMediaChooserBlock,
     AudioChooserBlock,

tests/test_compare.py

@@ -1,5 +1,7 @@
 from django.test import TestCase
 from django.utils.safestring import SafeString
+
+from tests.testapp.models import BlogStreamPage
 from wagtailmedia.blocks import (
     AudioChooserBlock,
     MediaChooserBlockComparison,
@@ -9,8 +11,6 @@
 from wagtailmedia.models import get_media_model
 from wagtailmedia.utils import format_audio_html, format_video_html
 
-from tests.testapp.models import BlogStreamPage
-
 from .utils import create_audio, create_video
 
 

tests/test_edit_handlers.py

@@ -4,10 +4,10 @@
 from wagtail import VERSION as WAGTAIL_VERSION
 from wagtail.admin.panels import FieldPanel, ObjectList
 from wagtail.models import Page
-from wagtailmedia.edit_handlers import MediaChooserPanel, MediaFieldComparison
-from wagtailmedia.widgets import AdminAudioChooser, AdminMediaChooser, AdminVideoChooser
 
 from tests.testapp.models import BlogStreamPage
+from wagtailmedia.edit_handlers import MediaChooserPanel, MediaFieldComparison
+from wagtailmedia.widgets import AdminAudioChooser, AdminMediaChooser, AdminVideoChooser
 
 from .utils import create_audio, create_video
 

tests/test_form_override.py

@@ -1,10 +1,10 @@
 from django import forms
 from django.test import TestCase, override_settings
 from wagtail.admin import widgets
-from wagtailmedia import models
-from wagtailmedia.forms import BaseMediaForm, get_media_base_form, get_media_form
 
 from tests.testapp.forms import AlternateMediaForm, OverridenWidget
+from wagtailmedia import models
+from wagtailmedia.forms import BaseMediaForm, get_media_base_form, get_media_form
 
 
 class TestFormOverride(TestCase):

tests/test_models.py

@@ -4,6 +4,7 @@
 from django.db import transaction
 from django.template import Context, Template
 from django.test import TestCase, override_settings
+
 from wagtailmedia.forms import get_media_form
 from wagtailmedia.models import get_media_model
 

tests/test_permissions.py

@@ -5,6 +5,7 @@
 from django.urls import reverse
 from wagtail.models import Collection, GroupCollectionPermission
 from wagtail.test.utils import WagtailTestUtils
+
 from wagtailmedia import models
 
 

tests/test_settings.py

@@ -1,6 +1,7 @@
 from unittest import mock
 
 from django.test import TestCase, override_settings
+
 from wagtailmedia.settings import WagtailMediaSettings, wagtailmedia_settings
 
 

tests/test_tags.py

@@ -1,6 +1,7 @@
 from unittest.mock import patch
 
 from django.test import TestCase
+
 from wagtailmedia.templatetags.media_tags import wagtail_version_gte
 
 

tests/test_utils.py

@@ -1,5 +1,6 @@
 from django.core.files.base import ContentFile
 from django.test import TestCase
+
 from wagtailmedia.models import get_media_model
 from wagtailmedia.utils import format_audio_html, format_video_html
 

tests/test_views.py

@@ -10,9 +10,9 @@
 from django.urls import NoReverseMatch, reverse
 from wagtail.models import Collection, GroupCollectionPermission
 from wagtail.test.utils import WagtailTestUtils
-from wagtailmedia import models
 
 from tests.testapp.models import EventPage, EventPageRelatedMedia
+from wagtailmedia import models
 
 
 class TestMediaIndexView(TestCase, WagtailTestUtils):

tests/test_widgets.py

@@ -1,5 +1,6 @@
 from django.test import TestCase
 from django.urls import reverse
+
 from wagtailmedia import widgets
 from wagtailmedia.widgets import AdminAudioChooser, AdminMediaChooser, AdminVideoChooser
 

tests/testapp/forms.py

@@ -1,4 +1,5 @@
 from django.forms.widgets import Widget
+
 from wagtailmedia.forms import BaseMediaForm
 
 

tests/testapp/migrations/0001_initial.py

@@ -7,11 +7,12 @@
 import wagtail.blocks
 import wagtail.fields
 import wagtail.search.index
-import wagtailmedia.blocks
 
 from django.conf import settings
 from django.db import migrations, models
 
+import wagtailmedia.blocks
+
 
 try:
     import wagtail.models.media as collections

tests/testapp/models.py

@@ -6,6 +6,7 @@
 from wagtail.admin.panels import FieldPanel, InlinePanel
 from wagtail.fields import RichTextField, StreamField
 from wagtail.models import Orderable, Page
+
 from wagtailmedia.blocks import (
     AbstractMediaChooserBlock,
     AudioChooserBlock,

tests/urls.py

@@ -5,6 +5,7 @@
 from wagtail.admin import urls as wagtailadmin_urls
 from wagtail.api.v2.router import WagtailAPIRouter
 from wagtail.documents import urls as wagtaildocs_urls
+
 from wagtailmedia.api.views import MediaAPIViewSet
 
 

tests/utils.py

@@ -3,6 +3,7 @@
 from typing import Optional
 
 from django.core.files.base import ContentFile
+
 from wagtailmedia.models import MediaType, get_media_model