QA Updates WIP

.cspell.json

@@ -0,0 +1,22 @@
+{
+    "version": "0.2",
+    "words": [
+	    "colour",
+	    "colours",
+	    "docstrings",
+	    "Kartoza",
+	    "pgdata",
+	    "pytest",
+	    "qgis",
+	    "QGIS",
+	    "sandboxed",
+	    "timlinux",
+	    "Friesen",
+	    "Víctor",
+	    "Olaya",
+	    "Samweli",
+	    "Twesa",
+	    "QGIS",
+	    "autopep"
+    ]
+}

.github/workflows/build.yml

@@ -14,10 +14,10 @@ jobs:
 
     steps:
     - name: Get source code
-      uses: actions/checkout@v2
+      uses: actions/checkout@v5
 
     - name: Set up Python
-      uses: actions/setup-python@v2
+      uses: actions/setup-python@v5
       with:
         python-version: ${{ env.PYTHON_VERSION }}
 
@@ -35,7 +35,7 @@ jobs:
         GITHUB_REF: ${{ github.ref }}
         GITHUB_SHA: ${{ github.sha}}
       run: |
-        paver package.sentry=${SENTRY_KEY} package.segments=$SEGMENTS_KEY package.version=${GITHUB_SHA::7} package
+        paver package.sentry="${SENTRY_KEY}" package.segments="${SEGMENTS_KEY}" package.version="${GITHUB_SHA::7}" package
         mkdir tmp
         unzip planet_explorer.zip -d tmp
 
@@ -53,14 +53,13 @@ jobs:
         qgis_version: [ "3.44", "3.42", "3.40", "3.38", "release-3_36" ]
     env:
       QGIS_TEST_VERSION: ${{ matrix.qgis_version }}
-      # cf https://docs.qgis.org/3.16/en/docs/user_manual/introduction/qgis_configuration.html#running-qgis-with-advanced-settings
       QGIS_COMMAND: qgis --noplugins --noversioncheck --nologo --version-migration --code ./planet_explorer/tests/install_plugin.py
 
     steps:
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@v3
       - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
         with:
           submodules: recursive
 
@@ -74,7 +73,7 @@ jobs:
         run: (cd tmp && zip -r ../planet_explorer_${{github.sha}}.zip .)
 
       - name: Pull qgis image
-        run: docker pull qgis/qgis:${QGIS_TEST_VERSION}
+        run: docker pull "qgis/qgis:${QGIS_TEST_VERSION}"
 
       - name: Run install test
-        run: docker run --rm -v `pwd`:/tests_directory -t -w /tests_directory qgis/qgis:${QGIS_TEST_VERSION} sh -c "xvfb-run ${QGIS_COMMAND}"
+        run: docker run --rm -v "$(pwd)":/tests_directory -t -w /tests_directory "qgis/qgis:${QGIS_TEST_VERSION}" sh -c "xvfb-run ${QGIS_COMMAND}"

.github/workflows/lint.yml

@@ -14,13 +14,22 @@ jobs:
     name: Lint
     steps:
       - name: Check out source repository
-        uses: actions/checkout@v2
+        uses: actions/checkout@v5
       - name: Set up Python environment
-        uses: actions/setup-python@v2
+        uses: actions/setup-python@v5
         with:
           python-version: "3.8"
       - name: Install pre-commit
         run: pip install pre-commit
+      - name: Install Python dependencies
+        run: |
+          if [ -f requirements.txt ]; then pip install -r requirements.txt; fi
+          if [ -f dev-requirements.txt ]; then pip install -r dev-requirements.txt; fi
+      - name: Install system dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y shellcheck
+          # Add any other system dependencies here
       - name: Run pre-commit
         run: pre-commit run --all --verbose
       - name: Analysis (git diff)

.github/workflows/release.yml

@@ -13,10 +13,10 @@ jobs:
 
     steps:
     - name: Get source code
-      uses: actions/checkout@v2
+      uses: actions/checkout@v5
 
     - name: Set up Python
-      uses: actions/setup-python@v2
+      uses: actions/setup-python@v5
       with:
         python-version: ${{ env.PYTHON_VERSION }}
 
@@ -34,7 +34,7 @@ jobs:
         SEGMENTS_KEY: ${{ secrets.SEGMENTS_KEY }}
         GITHUB_REF: ${{ github.ref }}
       run: |
-        paver package.sentry=${SENTRY_KEY} package.segments=$SEGMENTS_KEY package.version=${GITHUB_REF##*/} package
+        paver package.sentry="${SENTRY_KEY}" package.segments="${SEGMENTS_KEY}" package.version="${GITHUB_REF##*/}" package
 
     - name: Create/update release on GitHub
       uses: ncipollo/[email protected]
@@ -45,7 +45,7 @@ jobs:
         artifacts: "planet_explorer.zip"
 
     - name: Checkout code
-      uses: actions/checkout@v2
+      uses: actions/checkout@v5
       with:
         ref: release
     - name: Update custom plugin repository to include latest release
@@ -59,3 +59,11 @@ jobs:
         git add -A
         git commit -m "Update plugins.xml"
         git push --force origin release
+    - name: Set up QGIS
+      uses: docker/setup-buildx-action@v3
+
+    - name: Pull QGIS Docker image
+      run: docker pull "qgis/qgis:${QGIS_TEST_VERSION}"
+
+    - name: Run QGIS commands
+      run: docker run --rm -v "$(pwd)":/tests_directory -t -w /tests_directory "qgis/qgis:${QGIS_TEST_VERSION}" sh -c "xvfb-run ${QGIS_COMMAND}"

.github/workflows/testing.yml

@@ -19,14 +19,14 @@ jobs:
       QGIS_TEST_VERSION: ${{ matrix.qgis_version }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
         with:
           submodules: recursive
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@v3
 
       - name: Test on QGIS
         env:
           PLANET_USER: ${{ secrets.PLANET_USER }}
           PLANET_PASSWORD: ${{ secrets.PLANET_PASSWORD }}
-        run: docker compose -f .docker/docker-compose.gh.yml run -e PLANET_USER=${PLANET_USER} -e PLANET_PASSWORD=${PLANET_PASSWORD} qgis /usr/src/.docker/run-docker-tests.sh
+        run: docker compose -f .docker/docker-compose.gh.yml run -e "PLANET_USER=${PLANET_USER}" -e "PLANET_PASSWORD=${PLANET_PASSWORD}" qgis /usr/src/.docker/run-docker-tests.sh

.gitignore

@@ -19,3 +19,4 @@ shell.nix
 .privoxy-cache/ca-cert.pem
 .privoxy.pid
 scripts/list_proxies.py
+codeql-db

.markdownlint.yaml

@@ -0,0 +1,7 @@
+{
+  "MD003": {
+    "style": "atx"
+  },
+  "MD013": false,  # allow long lines
+  "MD033": false   # allow inline HTML
+}

.pre-commit-config.yaml

@@ -13,12 +13,125 @@ repos:
       - id: check-json
         exclude: ^(planet_explorer/planet_api/request-result-samples/)
   - repo: https://github.com/psf/black
-    rev: 22.6.0
+    rev: 24.4.0
     hooks:
       - id: black
+        name: "🖤 black"
+        language_version: python3
+        additional_dependencies: []
+  - repo: local
+    hooks:
+      - id: remove-core-file
+        name: "🗑️ Remove core file if it exists"
+        entry: bash -c '[[ -f core && ! -d core ]] && rm core || exit 0'
+        language: system
+        stages:
+          - pre-commit
+  - repo: local
+    hooks:
+      - id: ensure-utf8-encoding
+        name: "🌐 Ensure UTF-8 encoding declaration in Python files"
+        entry: bash scripts/encoding_check.sh
+        language: system
+        types: [python]
+        stages: [pre-commit]
+  - repo: local
+    hooks:
+      - id: ensure-google-docstrings
+        name: "📚 Ensure Google-style docstrings in Python modules"
+        entry: bash scripts/docstrings_check.sh
+        language: system
+        types: [python]
+        stages: [pre-commit]
   - repo: https://github.com/PyCQA/flake8
     rev: 6.0.0
     hooks:
       - id: flake8
+        name: "🐍 flake8 Python Linter"
         language_version: python3
         args: ['--extend-ignore=E203']
+  - repo: https://github.com/PyCQA/isort
+    rev: 6.0.1
+    hooks:
+      - id: isort
+        name: "📦 isort - sort Python imports"
+        entry: isort --check --diff
+        language: python
+        types: [python]
+        stages: [pre-commit]
+  - repo: local
+    hooks:
+      - id: nixfmt
+        name: "❄️ Nixfmt (RFC style)"
+        description: Format Nix code with nixfmt-rfc-style
+        entry: nixfmt
+        language: system
+        args: ["--"]
+        types: [nix]
+  - repo: local
+    hooks:
+      - id: markdownlint
+        name: "📝 markdownlint - Markdown linter"
+        entry: markdownlint
+        language: system
+        types: [markdown]
+        stages: [pre-commit]
+  - repo: local
+    hooks:
+      - id: cspell
+        name: "🔤 cspell - Spell checker for Markdown"
+        entry: cspell --config=.cspell.json --no-progress --no-summary
+        language: system
+        types: [markdown]
+        stages: [pre-commit]
+  - repo: local
+    hooks:
+      - id: yamllint
+        name: "🔍 yamllint - YAML linter"
+        entry: yamllint
+        language: system
+        types: [yaml]
+        stages: [pre-commit]
+  - repo: local
+    hooks:
+      - id: actionlint
+        name: "🤖 actionlint - GitHub Actions workflow linter"
+        entry: actionlint
+        language: system
+        types: [yaml]
+        files: ^\.github/workflows/.*\.ya?ml$
+        stages: [pre-commit]
+  - repo: local
+    hooks:
+      - id: bandit-scripts
+        name: "🔒 Bandit - Python security analysis"
+        entry: bandit -r scripts
+        language: system
+        types: [python]
+        stages: [pre-commit]
+  - repo: local
+    hooks:
+      - id: shellcheck-scripts
+        name: "🐚 ShellCheck - scripts"
+        entry: shellcheck
+        language: system
+        files: ^scripts/.*\.(sh|bash|zsh)$
+        pass_filenames: true
+
+  - repo: local
+    hooks:
+      - id: bearer-plugin
+        name: "🛡️ Bearer - Security & privacy scanner - planet_explorer"
+        entry: bearer scan --exit-code 1 planet_explorer
+        language: system
+        pass_filenames: false
+
+  # - repo: local
+  #   hooks:
+  #     - id: codeql-scan
+  #       name: "🔎 CodeQL - Static code analysis"
+  #       entry: codeql database analyze --format=sarifv2.1.0 --output=codeql-results.sarif codeql-db codeql-db/db-python-queries planet_explorer
+  #       language: system
+  #       pass_filenames: false
+  #       stages: [pre-commit]
+  #       description: "Run CodeQL static analysis on the planet_explorer folder"

.yamllint

@@ -0,0 +1,2 @@
+rules:
+  document-start: disable

AUTHORS.md

@@ -1,3 +1,7 @@
+# Plugin Authors
+
 Larry Shaffer <[email protected]>
 Erik Friesen <[email protected]>
 Víctor Olaya <[email protected]>
+Tim Sutton <[email protected]>
+Samweli Twesa <[email protected]>

CONTRIBUTE.md

@@ -1,20 +1,30 @@
-Contributing
-============
+# Contributing
 
-Contributing to Planet Explorer QGIS plugin
-===========================================
+## Contributing to Planet Explorer QGIS plugin
 
-Planet Explorer QGIS plugin is an open source project and we appreciate contributions very much.
+Planet Explorer QGIS plugin is an open source project and we appreciate
+contributions very much.
 
-Proper formatting
------------------
+## Proper formatting
 
 Before making a pull request, please make sure your code is properly formatted.
 To check for formatting errors use
 
     paver pep8
 
-to automatically format you code run following command **before** issuing
+to automatically format your code run following command **before** issuing
 `git commit`
 
     paver autopep8
+
+## Pre-commit QA checks
+
+There are a number of pre-commit checks that should all pass before committing
+new code or submitting a PR. You can manually run these using the following
+command:
+
+   pre-commit run --all-files -v
+
+You can run a specific check e.g. markdown linting like this:
+
+    pre-commit run markdownlint --all-files -v

bearer.ignore

@@ -0,0 +1,20 @@
+{
+  "b96ee51bac26b53bef2c0b7b35bad630_0": {
+    "author": "Tim Sutton",
+    "comment": "User must be able to download to a directory of their choosing.",
+    "false_positive": true,
+    "ignored_at": "2025-08-12T15:22:30Z"
+  },
+  "b96ee51bac26b53bef2c0b7b35bad630_1": {
+    "author": "Tim Sutton",
+    "comment": "User must be able to download to a directory of their choosing.",
+    "false_positive": true,
+    "ignored_at": "2025-08-12T15:20:16Z"
+  },
+  "b96ee51bac26b53bef2c0b7b35bad630_2": {
+    "author": "Tim Sutton",
+    "comment": "User must be able to download to a directory of their choosing.",
+    "false_positive": true,
+    "ignored_at": "2025-08-12T15:19:01Z"
+  }
+}