chore: migrate to starflow and Makefile

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,5 +1,5 @@
 - [ ] Have you followed the guidelines for contributing?
 - [ ] Have you signed the [CLA](http://www.ubuntu.com/legal/contributors/)?
-- [ ] Have you successfully run `tox`?
+- [ ] Have you successfully run `make lint && make test`?
 
------
+---

.github/release-drafter.yml

@@ -15,7 +15,7 @@ categories:
   - title: "Tooling"
     label:
       - "tooling"
-change-template: '- $TITLE @$AUTHOR (#$NUMBER)'
+change-template: "- $TITLE @$AUTHOR (#$NUMBER)"
 template: |
   Special thanks to the contributors that made this release happen: $CONTRIBUTORS
 

.github/renovate.json5

@@ -1,159 +1,3 @@
 {
-  // Configuration file for RenovateBot: https://docs.renovatebot.com/configuration-options
-  extends: ["config:recommended", ":semanticCommitTypeAll(build)"],
-  labels: ["dependencies"],  // For convenient searching in GitHub
-  baseBranches: ["$default", "/^hotfix\\/.*/"],
-  pip_requirements: {
-    fileMatch: ["^tox.ini$", "(^|/)requirements([\\w-]*)\\.txt$", "^.pre-commit-config.yaml$"]
-  },
-   packageRules: [
-    {
-      // Internal package minor patch updates get top priority, with auto-merging
-      groupName: "internal package minor releases",
-      matchPackagePatterns: ["^craft-.*"],
-      matchUpdateTypes: ["minor", "patch", "pin", "digest"],
-      prPriority: 10,
-      automerge: true,
-      minimumReleaseAge: "0 seconds",
-      schedule: ["at any time"],
-      matchBaseBranches: ["$default"],  // Only do minor releases on main
-    },
-    {
-      // Same as above, but for hotfix branches, only for patch, and without auto-merging.
-      groupName: "internal package patch releases (hotfix)",
-      matchPackagePatterns: ["^craft-.*"],
-      matchUpdateTypes: ["patch", "pin", "digest"],
-      prPriority: 10,
-      minimumReleaseAge: "0 seconds",
-      schedule: ["at any time"],
-      matchBaseBranches: ["/^hotfix\\/.*/"],  // All hotfix branches
-    },
-    {
-      // Automerge patches, pin changes and digest changes.
-      // Also groups these changes together.
-      groupName: "bugfixes",
-      excludeDepPatterns: ["lint/.*", "types/.*"],
-      matchUpdateTypes: ["patch", "pin", "digest"],
-      prPriority: 3, // Patches should go first!
-      automerge: true
-    },
-    {
-      // Update all internal packages in one higher-priority PR
-      groupName: "internal packages",
-      matchDepPatterns: ["craft-.*", "snap-.*"],
-      matchCategories: ["python"],
-      prPriority: 2,
-      matchBaseBranches: ["$default"],  // Not for hotfix branches
-    },
-    {
-      // GitHub Actions are higher priority to update than most dependencies since they don't tend to break things.
-      groupName: "GitHub Actions",
-      matchManagers: ["github-actions"],
-      prPriority: 1,
-      automerge: true,
-    },
-    // Everything not in one of these rules gets priority 0 and falls here.
-    {
-      //Do all pydantic-related updates together
-      groupName: "pydantic etc.",
-      matchPackagePatterns: ["^pydantic"],
-    },
-    {
-      // Minor changes can be grouped and automerged for dev dependencies, but are also deprioritised.
-      groupName: "development dependencies (non-major)",
-      groupSlug: "dev-dependencies",
-      matchDepPatterns: [
-        "dev/.*",
-        "lint/.*",
-        "types/.*"
-      ],
-      matchPackagePatterns: [
-        // Brought from charmcraft. May not be complete.
-        // This helps group dependencies in requirements-dev.txt files.
-        "^(.*/)?autoflake$",
-        "^(.*/)?black$",
-        "^(.*/)?codespell$",
-        "^(.*/)?coverage$",
-        "^(.*/)?flake8$",
-        "^(.*/)?hypothesis$",
-        "^(.*/)?mypy$",
-        "^(.*/)?pycodestyle$",
-        "^(.*/)?docstyle$",
-        "^(.*/)?pyfakefs$",
-        "^(.*/)?pyflakes$",
-        "^(.*/)?pylint$",
-        "^(.*/)?pytest",
-        "^(.*/)?responses$",
-        "^(.*/)?ruff$",
-        "^(.*/)?twine$",
-        "^(.*/)?tox$",
-        "^(.*/)?types-",
-      ],
-      matchUpdateTypes: ["minor", "patch", "pin", "digest"],
-      prPriority: -1,
-      automerge: true
-    },
-    {
-      // Documentation related updates
-      groupName: "documentation dependencies",
-      groupSlug: "doc-dependencies",
-      matchPackageNames: ["Sphinx", "furo"],
-      matchPackagePatterns: ["[Ss]phinx.*$"],
-      matchDepPatterns: ["docs/.*"],
-      matchBaseBranches: ["$default"],  // Not for hotfix branches
-    },
-    {
-      // Other major dependencies get deprioritised below minor dev dependencies.
-      matchUpdateTypes: ["major"],
-      prPriority: -2,
-      matchBaseBranches: ["$default"],  // Not for hotfix branches
-    },
-    {
-      // Major dev dependencies are stone last, but grouped.
-      groupName: "development dependencies (major versions)",
-      groupSlug: "dev-dependencies",
-      matchDepTypes: ["devDependencies"],
-      matchUpdateTypes: ["major"],
-      prPriority: -3,
-      matchBaseBranches: ["$default"],  // Not for hotfix branches
-    },
-    {
-      // Pyright makes regular breaking changes in patch releases, so we separate these
-      // and do them independently.
-      matchPackageNames: ["pyright", "types/pyright"],
-      prPriority: -4,
-      matchBaseBranches: ["$default"],  // Not for hotfix branches
-    }
-  ],
-  customManagers: [
-    {
-      // tox.ini can get updates too if we specify for each package.
-      fileMatch: ["tox.ini"],
-      customType: "regex",
-      depTypeTemplate: "devDependencies",
-      matchStrings: [
-        "# renovate: datasource=(?<datasource>\\S+)\n\\s+(?<depName>.*?)(\\[[\\w]*\\])*[=><]=?(?<currentValue>.*?)\n"
-      ]
-    },
-    {
-      // .pre-commit-config.yaml version updates
-      fileMatch: [".pre-commit-config.yaml"],
-      customType: "regex",
-      datasourceTemplate: "pypi",
-      depTypeTemplate: "lint",
-      matchStrings: [
-        "- repo: .*/<(?<depName>\\S+)\\s*\\n\\s*rev:\s+\"?v?(?<currentValue>\\S*)\"?",
-      ]
-    }
-  ],
-  timezone: "Etc/UTC",
-  schedule: ["every weekend"],
-  prConcurrentLimit: 2, // No more than 2 open PRs at a time.
-  branchConcurrentLimit: 20, // No more than 20 open branches at a time.
-  prCreation: "not-pending", // Wait until status checks have completed before raising the PR
-  prNotPendingHours: 4, // ...unless the status checks have been running for 4+ hours.
-  prHourlyLimit: 1, // No more than 1 PR per hour.
-  minimumReleaseAge: "2 days",
-  automergeStrategy: "squash", // Squash & rebase when auto-merging.
-  semanticCommitType: "build"  // use `build` as commit header type (i.e. `build(deps): <description>`)
+  extends: ["github>canonical/starflow:renovate.json5"],
 }

.github/workflows/security-scan.yaml → .github/workflows/policy.yaml

@@ -1,15 +1,17 @@
-name: Security scan
+name: Check policy
 on:
   pull_request:
   push:
     branches:
       - main
       - hotfix/*
-      - work/secscan  # For development
+      - work/check-policy # For development
 
 jobs:
+  policy:
+    uses: canonical/starflow/.github/workflows/policy.yaml@main
   python-scans:
-    name: Scan Python project
+    name: Security scan
     uses: canonical/starflow/.github/workflows/scan-python.yaml@main
     with:
       packages: python-apt-dev

.github/workflows/qa.yaml

@@ -0,0 +1,22 @@
+name: QA
+on:
+  push:
+    branches:
+      - "main"
+      - "feature/*"
+      - "hotfix/*"
+      - "release/*"
+      - "renovate/*"
+  pull_request:
+
+jobs:
+  lint:
+    uses: canonical/starflow/.github/workflows/lint-python.yaml@main
+  test:
+    uses: canonical/starflow/.github/workflows/test-python.yaml@main
+    with:
+      # Limiting to amd64 as a workaround for https://github.com/canonical/craft-archives/issues/144
+      # When fixing that bug, add arm64 runners as well for fast tests.
+      fast-test-platforms: '[["jammy", "amd64"], ["noble", "amd64"]]'
+      slow-test-platforms: '[["jammy", "amd64"]]'
+      lowest-python-platform: self-hosted-linux-amd64-jammy-edge