refactor: contract CANFAR interfaces while preserving behavior

.github/workflows/ci.yml

@@ -2,9 +2,7 @@ name: Continous Integration
 
 on:
   pull_request:
-    branches: [ main ]
-    paths-ignore:
-      - 'docs/**'
+    branches: [ main, feat/interfaces ]
   push:
     branches: [ main ]
     paths-ignore:
@@ -41,84 +39,8 @@ jobs:
 
   tests:
     needs: pre-commit-checks
-    strategy:
-      fail-fast: false
-      matrix:
-        python-version: ['3.10', '3.11', '3.12', '3.13', '3.14']
-        os: [ubuntu-latest]
-    runs-on: ${{ matrix.os }}
-    timeout-minutes: 10
-    env:
-      CANFAR_BASEURL: ${{ secrets.CANFAR_BASEURL }}
-      CANFAR_USERNAME: ${{ secrets.CANFAR_USERNAME }}
-      CANFAR_PASSWORD: ${{ secrets.CANFAR_PASSWORD }}
+    uses: ./.github/workflows/reusable-tests.yml
+    with:
+      full-suite: false
+    secrets:
       CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
-    steps:
-    - name: Harden Runner
-      timeout-minutes: 10
-      uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
-      with:
-        egress-policy: audit
-
-    -
-      name: Setup code repository
-      timeout-minutes: 10
-      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      with:
-        fetch-depth: 1
-    -
-      name: Setup uv
-      timeout-minutes: 10
-      uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
-      with:
-        enable-cache: true
-    -
-      name: Setup Python ${{ matrix.python-version }}
-      timeout-minutes: 10
-      run: |
-        uv python install ${{ matrix.python-version }}
-        uv venv --python ${{ matrix.python-version }}
-        uv sync --all-extras --dev
-    -
-      name: Login to CANFAR
-      timeout-minutes: 10
-      if: ${{ env.CANFAR_BASEURL != '' && env.CANFAR_USERNAME != '' && env.CANFAR_PASSWORD != '' }}
-      run: |
-        set -euo pipefail
-        printf "machine %s\n  login %s\n  password %s\n" "${CANFAR_BASEURL}" "${CANFAR_USERNAME}" "${CANFAR_PASSWORD}" > ~/.netrc
-        uv run cadc-get-cert --days-valid 1 --netrc-file ~/.netrc
-        rm ~/.netrc
-        test -f "${HOME}/.ssl/cadcproxy.pem"
-    -
-      name: Run tests
-      timeout-minutes: 10
-      run: |
-        set -euo pipefail
-        if [ -n "${CANFAR_BASEURL}" ] && [ -n "${CANFAR_USERNAME}" ] && [ -n "${CANFAR_PASSWORD}" ]; then
-          uv run pytest tests -m "not slow" --cov --cov-report=xml --junitxml=junit.xml -o junit_family=legacy
-        else
-          uv run pytest tests -m "not slow" --cov --cov-report=xml --junitxml=junit.xml -o junit_family=legacy
-        fi
-    -
-      name: Remove CANFAR Certificate
-      timeout-minutes: 10
-      if: always()
-      run: |
-        rm -rf ~/.ssl/
-    -
-      name: Upload coverage to Codecov
-      timeout-minutes: 10
-      if: ${{ !cancelled() && env.CODECOV_TOKEN != '' }}
-      uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
-      with:
-        fail_ci_if_error: true # Fail the CI if an error occurs during the upload
-        token: ${{ env.CODECOV_TOKEN }}
-        flags: ${{ matrix.python-version }}
-        verbose: true # optional (default = false)
-    -
-      name: Upload test results to Codecov
-      timeout-minutes: 10
-      if: ${{ !cancelled() && env.CODECOV_TOKEN != '' }}
-      uses: codecov/test-results-action@0fa95f0e1eeaafde2c782583b36b28ad0d8c77d3 # v1.2.1
-      with:
-        token: ${{ env.CODECOV_TOKEN }}

.github/workflows/edge.yml

@@ -4,80 +4,18 @@ on:
   repository_dispatch:
     types: [edge-build]
 
-env:
-  GHCR_REGISTRY: ghcr.io
-  IMAGE_NAME: opencadc/canfar
-  IMAGE_TAG: edge
-
 permissions:
   contents: read
 
 jobs:
   edge-build:
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
+    uses: ./.github/workflows/reusable-container.yml
     permissions:
       packages: write
       attestations: write
       id-token: write
-    steps:
-      - name: Harden Runner
-        timeout-minutes: 10
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
-        with:
-          egress-policy: audit
-
-      -
-        name: Client Payload
-        timeout-minutes: 10
-        run: |
-          echo "Client Payload: ${{ toJson(github.event.client_payload) }}"
-      -
-        name: Checkout Code
-        timeout-minutes: 10
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      -
-        name: Setup Docker Buildx
-        timeout-minutes: 10
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
-        with:
-          install: true
-      -
-        name: Perform GHCR Login
-        timeout-minutes: 10
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-      -
-        name: Build & Push Docker Image
-        timeout-minutes: 10
-        id: build
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
-        with:
-          context: .
-          target: production
-          file: Dockerfile
-          platforms: linux/amd64,linux/arm64
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
-          provenance: mode=max
-          sbom: true
-          push: true
-          labels: |
-            org.opencontainers.image.title=canfar
-            org.opencontainers.image.version=edge
-            org.opencontainers.image.description='Python Client for CANFAR Science Platform'
-            org.opencontainers.image.licenses=AGPL-3.0
-            org.opencontainers.image.source=https://github.com/opencadc/canfar
-          tags: |
-            ${{ env.GHCR_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.IMAGE_TAG }}
-      -
-        name: Attest GHCR Container Image
-        timeout-minutes: 10
-        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
-        with:
-          subject-name: ${{ env.GHCR_REGISTRY }}/${{ env.IMAGE_NAME }}
-          subject-digest: ${{ steps.build.outputs.digest }}
-          push-to-registry: true
+    with:
+      client-payload: ${{ toJson(github.event.client_payload) }}
+      image-description: Python Client for CANFAR Science Platform
+      image-tags: ghcr.io/opencadc/canfar:edge
+      image-version: edge

.github/workflows/full-tests.yml

@@ -0,0 +1,23 @@
+name: Full Tests
+
+on:
+  pull_request_target:
+    types: [closed]
+    branches: [ main ]
+    paths:
+      - 'canfar/**'
+      - 'tests/**'
+
+permissions: read-all
+
+jobs:
+  tests:
+    if: ${{ github.event.pull_request.merged == true && github.event.pull_request.base.ref == 'main' }}
+    uses: ./.github/workflows/reusable-tests.yml
+    with:
+      full-suite: true
+    secrets:
+      CANFAR_BASEURL: ${{ secrets.CANFAR_BASEURL }}
+      CANFAR_USERNAME: ${{ secrets.CANFAR_USERNAME }}
+      CANFAR_PASSWORD: ${{ secrets.CANFAR_PASSWORD }}
+      CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}

.github/workflows/release.yml

@@ -4,84 +4,21 @@ on:
   repository_dispatch:
     types: [release-build]
 
-env:
-  GHCR_REGISTRY: ghcr.io
-  IMAGE_NAME: opencadc/canfar
-  IMAGE_TAG_LATEST: latest
-  IMAGE_TAG_RELEASE: ${{ github.event.client_payload.tag_name }}
-
 permissions:
   contents: read
 
 jobs:
   release-build:
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
+    uses: ./.github/workflows/reusable-container.yml
     permissions:
       packages: write # Upload package to ghcr.io
       attestations: write # Attest the build provenance
       id-token: write # Genereate OIDC token for attestations
-    steps:
-      - name: Harden Runner
-        timeout-minutes: 10
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
-        with:
-          egress-policy: audit
-
-      -
-        name: Client Payload
-        timeout-minutes: 10
-        run: |
-          echo "Client Payload: ${{ toJson(github.event.client_payload) }}"
-      -
-        name: Checkout Code
-        timeout-minutes: 10
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          ref: ${{ github.event.client_payload.tag_name }}
-      -
-        name: Setup Docker Buildx
-        timeout-minutes: 10
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
-        with:
-          install: true
-      -
-        name: Perform GHCR Login
-        timeout-minutes: 10
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-      -
-        name: Build & Push Docker Image
-        timeout-minutes: 10
-        id: build
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
-        with:
-          context: .
-          target: production
-          file: Dockerfile
-          platforms: linux/amd64,linux/arm64
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
-          provenance: mode=max
-          sbom: true
-          push: true
-          labels: |
-            org.opencontainers.image.title=canfar
-            org.opencontainers.image.version=${{ env.IMAGE_TAG_RELEASE }}
-            org.opencontainers.image.description='Python Client for CANFAR Science Portal'
-            org.opencontainers.image.licenses=AGPL-3.0
-            org.opencontainers.image.source=https://github.com/opencadc/canfar
-          tags: |
-            ${{ env.GHCR_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.IMAGE_TAG_RELEASE }}
-            ${{ env.GHCR_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.IMAGE_TAG_LATEST }}
-      -
-        name: Attest GHCR Container Image
-        timeout-minutes: 10
-        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
-        with:
-          subject-name: ${{ env.GHCR_REGISTRY }}/${{ env.IMAGE_NAME }}
-          subject-digest: ${{ steps.build.outputs.digest }}
-          push-to-registry: true
+    with:
+      client-payload: ${{ toJson(github.event.client_payload) }}
+      checkout-ref: ${{ github.event.client_payload.tag_name }}
+      image-description: Python Client for CANFAR Science Portal
+      image-tags: |
+        ghcr.io/opencadc/canfar:${{ github.event.client_payload.tag_name }}
+        ghcr.io/opencadc/canfar:latest
+      image-version: ${{ github.event.client_payload.tag_name }}