Dependency audit

.github/workflows/dependency-audit.yml

@@ -0,0 +1,58 @@
+name: Dependency compatibility and audit
+
+on:
+  push:
+    branches:
+      - master
+      - main
+      - develop
+      - bugfix_*
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  compatibility-and-audit:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.10", "3.11", "3.12", "3.13"]
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: Install Poetry
+        uses: snok/install-poetry@v1
+        with:
+          virtualenvs-create: true
+          virtualenvs-in-project: true
+
+      - name: Install project and dev dependencies
+        run: poetry install --with dev
+
+      - name: Metadata and dependency compatibility checks
+        run: |
+          poetry check
+          poetry run pip check
+
+      - name: Upgrade pip in venv
+        run: poetry run python -m pip install --upgrade pip
+
+      - name: Install vulnerability scanner
+        run: poetry run python -m pip install pip-audit
+
+      - name: Vulnerability audit
+        run: poetry run pip-audit
+
+      - name: Geemap folium import guard
+        run: |
+          poetry run python -c "import geemap.foliumap as geemap; print('geemap folium import successful')"
+
+      - name: Import smoke test
+        run: poetry run python -c "import metobs_toolkit; print('Import successful')"

.github/workflows/main_workflow.yml

@@ -63,6 +63,7 @@ jobs:
           with:
             python-version: '3.10'
 
+
         - name: Install Poetry
           run: |
             curl -sSL https://install.python-poetry.org | python3 -
@@ -285,6 +286,34 @@ jobs:
             run: |
               echo "version tags are not aligned!"
               exit 1
+          - name: Ensure version differs from master
+            if: github.ref != 'refs/heads/master'
+            run: |
+              git fetch origin master --depth=1
+              python - <<'PY'
+              import subprocess
+              import tomllib
+
+              with open("pyproject.toml", "rb") as f:
+                  current = tomllib.load(f)
+              current_version = current["project"]["version"]
+
+              master_pyproject = subprocess.check_output(
+                  ["git", "show", "origin/master:pyproject.toml"], text=True
+              )
+              master = tomllib.loads(master_pyproject)
+              master_version = master["project"]["version"]
+
+              print(f"Current version: {current_version}")
+              print(f"Master version: {master_version}")
+
+              if current_version == master_version:
+                  raise SystemExit(
+                      "Version check failed: current version is identical to origin/master. "
+                      "Please bump [project].version in pyproject.toml."
+                  )
+              print("Version check passed: current version differs from origin/master.")
+              PY
 
     pytest:
         name: Run Pytest framework

pyproject.toml

@@ -4,15 +4,15 @@ requires = ["poetry-core"]
 
 [project]
 name = "MetObs-toolkit"
-version = "1.0.1"
-license = "LICENSE"
+version = "1.0.2"
+license = "MIT"
+license-files = ["LICENSE"]
 authors = [{name = "Thomas Vergauwen", email = "thomas.vergauwen@ugent.be"}]
 description = "A Meteorological observations toolkit for scientists"
 readme = "README.md"
 classifiers = [
   "Development Status :: 5 - Production/Stable",
   "Intended Audience :: Science/Research",
-  "License :: OSI Approved :: MIT License",
   "Natural Language :: English",
   "Operating System :: OS Independent",
   "Programming Language :: Python :: 3",
@@ -30,22 +30,22 @@ requires-python = ">=3.10,<4.0"
 
 
 dependencies=[
-  "cartopy>=0.23",
-  "earthengine-api<=1.6.11", # v1.6.12 not compatible with geemap 0.35.3 (latest of geemap)
+  "cartopy>=0.23,<0.26",
+  "earthengine-api>=1.6.12,<2.0", # geemap>=0.36 requires earthengine-api>=1.6.12
   # "folium>=0.19.5",  # needed for geemap
-  "geemap>=0.35.3",
-  "geopandas>=1.0.1",
-  "mapclassify>=2.8.1",
+  "geemap>=0.36,<0.37", # geemap 0.37.1 has a folium import regression (basemaps.xyz_to_folium)
+  "geopandas>=1.0.1,<2.0",
+  "mapclassify>=2.8.1,<3.0",
   # "numpy>=1.17.3", #in pandas
-  "matplotlib>=3.9.2",
-  "numpy>=1",
-  "pandas>=2",
-  "pint>=0.24.4",
-  "setuptools>=78.1.0",
-  "shapely>=2.0.6",
-  "xarray>=2022.3.0",
-  "pyarrow (>=21.0.0,<22.0.0)",
-  "netcdf4 (>=1.7.2,<2.0.0)"
+  "matplotlib>=3.9.2,<4.0",
+  "numpy>=1.26,<3.0",
+  "pandas>=2.2,<3.0",
+  "pint>=0.24.4,<1.0",
+  "shapely>=2.0.6,<3.0",
+  "xarray>=2022.3.0,<2027.0.0",
+  "pyarrow>=21.0.0,<22.0.0",
+  "netcdf4>=1.7.2,<2.0.0",
+  "pytz>=2024.1,<2027.1"
 ]
 
 [tool.poetry.group.dev.dependencies]
@@ -72,7 +72,7 @@ poetry = "^2"
 # sphinx-rtd-theme = '^1.3.0'
 pydata-sphinx-theme = "^0.15.4"
 # Group of dep packages for building the documentation
-sphinx = ">=7"
+sphinx = ">=7,<9"
 sphinx-copybutton = "^0.5.2"
 sphinx-rtd-theme = "^3.0.1"
 

src/metobs_toolkit/settings_collection/version.py

@@ -1 +1 @@
-__version__ = "1.0.1"
+__version__ = "1.0.2"