Set up pre-commit hooks, trusted publishing, and more thorough CI

.github/copilot-instructions.md

@@ -0,0 +1,3 @@
+python-otbr-api is a Python library exposing a typed async API to interact with an Open Thread Border Router (OTBR) over its REST API.
+
+- `prek run` is used to check the code formatting and style.

.github/dependabot.yml

@@ -5,8 +5,12 @@ updates:
     schedule:
       interval: daily
     open-pull-requests-limit: 10
+    cooldown:
+      default-days: 7
   - package-ecosystem: pip
     directory: "/"
     schedule:
       interval: weekly
     open-pull-requests-limit: 10
+    cooldown:
+      default-days: 7

.github/workflows/ci.yml

@@ -0,0 +1,191 @@
+name: CI
+
+on:
+  push:
+  pull_request: ~
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+permissions:
+  contents: read
+
+jobs:
+  prepare-base:
+    name: Prepare base dependencies
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python-version: ["3.14"]
+    steps:
+      - name: Check out code from GitHub
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
+      - name: Set up Python ${{ matrix.python-version }}
+        id: python
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
+        with:
+          python-version: ${{ matrix.python-version }}
+          allow-prereleases: true
+          check-latest: true
+      - name: Restore base Python virtual environment
+        id: cache-venv
+        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+        with:
+          path: venv
+          key: >-
+            1-${{ runner.os }}-base-venv-${{ steps.python.outputs.python-version }}-${{ hashFiles('pyproject.toml') }}
+      - name: Create Python virtual environment
+        if: steps.cache-venv.outputs.cache-hit != 'true'
+        run: |
+          curl -LsSf https://astral.sh/uv/install.sh | sh
+          uv venv venv
+          . venv/bin/activate
+          uv pip install -U pip setuptools prek
+          uv pip install -e .[dev]
+      - name: Cache base Python virtual environment
+        if: steps.cache-venv.outputs.cache-hit != 'true'
+        uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+        with:
+          path: venv
+          key: ${{ steps.cache-venv.outputs.cache-primary-key }}
+
+  prek:
+    name: Run prek
+    runs-on: ubuntu-latest
+    needs: prepare-base
+    steps:
+      - name: Check out code from GitHub
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
+      - name: Set up Python 3.11
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
+        id: python
+        with:
+          python-version: "3.11"
+          check-latest: true
+      - name: Restore base Python virtual environment
+        id: cache-venv
+        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+        with:
+          fail-on-cache-miss: true
+          path: venv
+          key: >-
+            1-${{ runner.os }}-base-venv-${{ steps.python.outputs.python-version }}-${{ hashFiles('pyproject.toml') }}
+      - name: Restore prek environment from cache
+        id: cache-prek
+        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+        with:
+          path: ~/.cache/prek
+          key: |
+            1-${{ runner.os }}-prek-${{ hashFiles('prek.toml') }}
+      - name: Install prek hooks
+        if: steps.cache-prek.outputs.cache-hit != 'true'
+        run: |
+          . venv/bin/activate
+          prek prepare-hooks
+      - name: Cache prek environment
+        if: steps.cache-prek.outputs.cache-hit != 'true'
+        uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+        with:
+          path: ~/.cache/prek
+          key: ${{ steps.cache-prek.outputs.cache-primary-key }}
+      - name: Lint and static analysis
+        run: |
+          . venv/bin/activate
+          prek run --show-diff-on-failure --color=always --all-files
+
+  pytest:
+    runs-on: ubuntu-latest
+    needs: prepare-base
+    strategy:
+      matrix:
+        python-version: ["3.14"]
+    name: Run tests Python ${{ matrix.python-version }}
+    steps:
+      - name: Check out code from GitHub
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
+        id: python
+        with:
+          python-version: ${{ matrix.python-version }}
+          allow-prereleases: true
+          check-latest: true
+      - name: Restore base Python virtual environment
+        id: cache-venv
+        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+        with:
+          fail-on-cache-miss: true
+          path: venv
+          key: >-
+            1-${{ runner.os }}-base-venv-${{ steps.python.outputs.python-version }}-${{ hashFiles('pyproject.toml') }}
+      - name: Set up uv
+        run: |
+          curl -LsSf https://astral.sh/uv/install.sh | sh
+      - name: Register Python problem matcher
+        run: |
+          echo "::add-matcher::.github/workflows/matchers/python.json"
+      - name: Install Pytest Annotation plugin
+        run: |
+          . venv/bin/activate
+          uv pip install pytest-github-actions-annotate-failures pytest-cov
+      - name: Run pytest
+        run: |
+          . venv/bin/activate
+          pytest \
+            -qq \
+            --durations=10 \
+            --cov=python_otbr_api \
+            -o console_output_style=count \
+            tests
+      - name: Upload coverage artifact
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: coverage-${{ matrix.python-version }}
+          include-hidden-files: true
+          path: .coverage
+
+  coverage:
+    name: Process test coverage
+    runs-on: ubuntu-latest
+    needs: pytest
+    steps:
+      - name: Check out code from GitHub
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
+      - name: Set up Python 3.11
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
+        id: python
+        with:
+          python-version: "3.11"
+          check-latest: true
+      - name: Restore base Python virtual environment
+        id: cache-venv
+        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+        with:
+          fail-on-cache-miss: true
+          path: venv
+          key: >-
+            1-${{ runner.os }}-base-venv-${{ steps.python.outputs.python-version }}-${{ hashFiles('pyproject.toml') }}
+      - name: Download all coverage artifacts
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+      - name: Combine coverage results
+        run: |
+          . venv/bin/activate
+          pip install coverage
+          coverage combine coverage*/.coverage*
+          coverage report
+          coverage xml
+      - name: Upload coverage to Codecov
+        if: ${{ github.event.repository.fork == false }}
+        uses: codecov/codecov-action@75cd11691c0faa626561e295848008c8a7dddffe # v5
+        with:
+          token: ${{ secrets.CODECOV_TOKEN }}
+          fail_ci_if_error: false

.github/workflows/matchers/python.json

@@ -0,0 +1,18 @@
+{
+  "problemMatcher": [
+    {
+      "owner": "python",
+      "pattern": [
+        {
+          "regexp": "^\\s*File\\s\\\"(.*)\\\",\\sline\\s(\\d+),\\sin\\s(.*)$",
+          "file": 1,
+          "line": 2
+        },
+        {
+          "regexp": "^\\s*raise\\s(.*)\\(\\'(.*)\\'\\)$",
+          "message": 2
+        }
+      ]
+    }
+  ]
+}

.github/workflows/publish-to-pypi.yml

@@ -0,0 +1,47 @@
+name: Build and Publish to PyPI
+
+on:
+  release:
+    types:
+      - published
+  workflow_dispatch:
+  push:
+    paths:
+      - ".github/workflows/publish-to-pypi.yml"
+  pull_request:
+    paths:
+      - ".github/workflows/publish-to-pypi.yml"
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+permissions:
+  contents: read
+
+jobs:
+  publish:
+    name: Build and publish python-otbr-api
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write # required for PyPI trusted publishing (OIDC)
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
+        with:
+          python-version: "3.11"
+
+      - name: Install build tools
+        run: pip install build
+
+      - name: Build sdist and wheel
+        run: python -m build
+
+      - name: Publish python-otbr-api to PyPI
+        if: github.event_name == 'release'
+        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # release/v1

.github/workflows/release-drafter.yml

@@ -5,11 +5,22 @@ on:
     branches:
       - main
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+
 jobs:
   update_release_draft:
+    name: Update release draft
     runs-on: ubuntu-latest
+    permissions:
+      contents: write # release-drafter writes the draft release
+      pull-requests: write # release-drafter labels merged PRs
     steps:
       # Drafts your next Release notes as Pull Requests are merged into "main"
-      - uses: release-drafter/release-drafter@v7.2.1
+      - uses: release-drafter/release-drafter@563bf132657a13ded0b01fcb723c5a58cdd824e2 # v7.2.1
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.gitignore

@@ -5,15 +5,23 @@ tmp/
 
 *.py[cod]
 *.egg
-htmlcov
+htmlcov/
+.coverage
+coverage.xml
 
 .projectile
 .venv/
 venv/
 .mypy_cache/
+.pytest_cache/
+.ruff_cache/
 *.egg-info/
 
 # Visual Studio Code
 .vscode/*
 
-dist
+build/
+dist/
+
+# Claude Code one-off scripts
+claude/