.editorconfig

@@ -0,0 +1,38 @@
+# Editor configuration options.
+# See: https://spec.editorconfig.org/
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+indent_size = 4
+indent_style = space
+insert_final_newline = true
+max_line_length = 88
+trim_trailing_whitespace = true
+
+[.editorconfig]
+max_line_length = off
+
+[{Makefile,*.mk}]
+indent_style = tab
+
+[{*.py,*.pyi}]
+max_line_length = 88
+
+[{*.bash,*.sh,*.zsh}]
+indent_size = 2
+tab_width = 2
+
+[{*.har,*.json,*.json5}]
+indent_size = 2
+max_line_length = off
+
+[{*.markdown,*.md,*.rst}]
+ij_visual_guides = none
+
+[{*.toml,Cargo.lock,Cargo.toml.orig,Gopkg.lock,Pipfile,poetry.lock}]
+max_line_length = off
+
+[{*.yaml,*.yml}]
+indent_size = 2

.github/ISSUE_TEMPLATE/bug.yaml

@@ -62,4 +62,3 @@ body:
     id: additional-context
     attributes:
       label: Additional context
-

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,6 +1,6 @@
 - [ ] Have you followed the [guidelines for contributing](https://github.com/canonical/snapcraft/blob/main/CONTRIBUTING.md)?
 - [ ] Have you signed the [CLA](http://www.ubuntu.com/legal/contributors/)?
-- [ ] Have you successfully run `tox run -m lint`?
-- [ ] Have you successfully run `tox run -e test-py310`? (supported versions: `py39`, `py310`, `py311`, `py312`)
+- [ ] Have you successfully run `make lint`?
+- [ ] Have you successfully run `make test`?
 
------
+---

.github/release-drafter.yml

@@ -15,10 +15,10 @@ categories:
   - title: "Tooling"
     label:
       - "tooling"
-change-template: '- $TITLE @$AUTHOR (#$NUMBER)'
+change-template: "- $TITLE @$AUTHOR (#$NUMBER)"
 template: |
   Special thanks to the contributors that made this release happen: $CONTRIBUTORS
-  
+
   ## Full list of changes
 
   $CHANGES

.github/spread-problem-matcher.json

@@ -1,14 +1,14 @@
 {
-    "problemMatcher": [
+  "problemMatcher": [
+    {
+      "owner": "spread-error",
+      "pattern": [
         {
-            "owner": "spread-error",
-            "pattern": [
-                {
-                    "regexp": "^\\d+-\\d+-\\d+ \\d+:\\d+:\\d+ ((Error) (preparing|executing|restoring) .+) : .*$",
-                    "message": 1,
-                    "severity": 2
-                }
-            ]
+          "regexp": "^\\d+-\\d+-\\d+ \\d+:\\d+:\\d+ ((Error) (preparing|executing|restoring) .+) : .*$",
+          "message": 1,
+          "severity": 2
         }
-    ]
+      ]
+    }
+  ]
 }

.github/workflows/check-renovate.yaml

@@ -10,7 +10,7 @@ on:
     inputs:
       enable_ssh_access:
         type: boolean
-        description: 'Enable ssh access'
+        description: "Enable ssh access"
         required: false
         default: false
 
@@ -25,7 +25,7 @@ jobs:
         with:
           node-version: 22
       - name: Install renovate
-        run: npm install --global renovate
+        run: npm install --global re2 renovate
       - name: Enable ssh access
         uses: mxschmitt/action-tmate@v3
         if: ${{ inputs.enable_ssh_access }}
@@ -34,7 +34,7 @@ jobs:
       - name: Check renovate config
         run: renovate-config-validator .github/renovate.json5
       - name: Renovate dry-run
-        run: renovate --dry-run --autodiscover
+        run: renovate --dry-run=full --autodiscover --print-config
         env:
           RENOVATE_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           RENOVATE_USE_BASE_BRANCH_CONFIG: ${{ github.ref }}

.github/workflows/policy.yaml

@@ -0,0 +1,22 @@
+name: Check policy
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+      - hotfix/*
+      - work/check-policy # For development
+
+jobs:
+  policy:
+    uses: canonical/starflow/.github/workflows/policy.yaml@main
+  python-scans:
+    name: Security scan
+    uses: canonical/starflow/.github/workflows/scan-python.yaml@main
+    with:
+      # 1. requirements-noble.txt can't build on jammy
+      # 2. Ignore requirements files in spread tests, as some of these intentionally
+      #    contain vulnerable versions.
+      # 3. Docs contain requirements.txt files that don't specify versions.
+      requirements-find-args: '! -name requirements-noble.txt ! -path "./tests/spread*" ! -path "./docs/**"'
+      trivy-extra-args: "--severity HIGH,CRITICAL --ignore-unfixed --skip-dirs tests/spread/"

.github/workflows/publish.yaml

@@ -1,6 +1,6 @@
 name: CI
 
-on: 
+on:
   pull_request:
   push:
     branches:
@@ -10,7 +10,12 @@ on:
 
 jobs:
   publish:
-    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        runner:
+          - [self-hosted, amd64]
+          - [self-hosted, arm64]
+    runs-on: ${{ matrix.runner }}
     steps:
       - name: Decision to Publish
         id: decisions

.github/workflows/qa.yaml

@@ -0,0 +1,24 @@
+name: QA
+on:
+  push:
+    branches:
+      - "main"
+      - "feature/*"
+      - "hotfix/*"
+      - "release/*"
+      - "renovate/*"
+  pull_request:
+
+jobs:
+  lint:
+    uses: canonical/starflow/.github/workflows/lint-python.yaml@main
+  test:
+    uses: canonical/starflow/.github/workflows/test-python.yaml@main
+    with:
+      # Snapcraft currently only tests on Python 3.12 on Ubuntu 24.04
+      fast-test-platforms: '["ubuntu-24.04"]'
+      slow-test-platforms: '["ubuntu-24.04"]'
+      lowest-python-platform: "ubuntu-24.04"
+      fast-test-python-versions: '["3.12"]'
+      slow-test-python-versions: '["3.12"]'
+      lowest-python-version: "3.12"

.github/workflows/release-drafter.yaml

@@ -0,0 +1,16 @@
+name: Release Drafter
+
+on:
+  push:
+    # branches to consider in the event; optional, defaults to all
+    branches:
+      - main
+
+jobs:
+  update_release_draft:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Release Drafter
+        uses: release-drafter/release-drafter@v6.1.0
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/release-publish.yaml

@@ -0,0 +1,23 @@
+name: Release
+on:
+  push:
+    tags:
+      # These tags should be protected, remember to enable the rule:
+      # https://github.com/canonical/starbase/settings/tag_protection
+      - "[0-9]+.[0-9]+.[0-9]+"
+
+permissions:
+  contents: write
+
+jobs:
+  github-release:
+    runs-on: [self-hosted]
+    steps:
+      - name: Create a Prerelease
+        uses: softprops/action-gh-release@v2
+        with:
+          # Generate release notes on the new GH release
+          generate_release_notes: true
+          # Mark this new release as a pre-release, to be marked manually
+          # as the latest stable release later.
+          prerelease: true

.github/workflows/spread-scheduled.yaml

@@ -31,7 +31,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        type: [craft-parts, v2]
+        type: [plugins/craft-parts, plugins/v2]
     steps:
       - name: Cleanup job workspace
         run: |
@@ -49,7 +49,7 @@ jobs:
           path: tests
       - name: Kernel plugin test
         run: |
-          spread google:ubuntu-22.04-64:tests/spread/plugins/${{ matrix.type }}/kernel
+          spread google:ubuntu-22.04-64:tests/spread/${{ matrix.type }}/kernel
 
   remote-build:
     runs-on: [spread-installed]
@@ -78,3 +78,50 @@ jobs:
             google:ubuntu-22.04-64:tests/spread/core22/remote-build \
             google:ubuntu-24.04-64:tests/spread/core24/remote-build \
             google:fedora-39-64:tests/spread/core24/remote-build:no_platforms
+
+  matter-sdk:
+    runs-on: [spread-installed]
+    needs: [snap-build]
+    steps:
+      - name: Cleanup job workspace
+        run: |
+          rm -rf "${{ github.workspace }}"
+          mkdir "${{ github.workspace }}"
+      - name: Checkout snapcraft
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          submodules: true
+      - name: Download snap artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: snap
+          path: tests
+      - name: matter-sdk test
+        run: |
+          spread google:ubuntu-22.04-64:tests/spread/core24-suites/plugins/matter-sdk
+
+  colcon-plugins:
+    runs-on: [spread-installed]
+    needs: [snap-build]
+    steps:
+      - name: Cleanup job workspace
+        run: |
+          rm -rf "${{ github.workspace }}"
+          mkdir "${{ github.workspace }}"
+      - name: Checkout snapcraft
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          submodules: true
+      - name: Download snap artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: snap
+          path: tests
+      - name: colcon plugin test
+        run: |
+          spread google:ubuntu-22.04-64:tests/spread/core24-suites/plugins/colcon-hello \
+            google:ubuntu-22.04-64:tests/spread/core24-suites/plugins/colcon-msg-package \
+            google:ubuntu-22.04-64:tests/spread/core24-suites/plugins/colcon-packages-ignore \
+            google:ubuntu-22.04-64:tests/spread/core24-suites/plugins/colcon-talker-listener

.github/workflows/tics.yaml

@@ -3,13 +3,13 @@ name: TICS
 on:
   push:
     branches:
-    - main
-    # to easy test changes to the workflow
-    - tiobe
+      - main
+      # to easy test changes to the workflow
+      - tiobe
 
 jobs:
   CI:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -22,22 +22,32 @@ jobs:
           sudo apt-get update
           echo "::endgroup::"
           echo "::group::apt-get install..."
-          sudo apt-get install -y python3 python3-dev libapt-pkg-dev libyaml-dev xdelta3 patchelf
+          sudo apt-get install -y python3 python3-dev libapt-pkg-dev libyaml-dev umoci
           echo "::endgroup::"
-          echo "::group::pip install"
-          python -m pip install 'tox<5.0' tox-gh
+          echo "::group::snap install"
+          sudo snap install --classic astral-uv
+          echo "::endgroup::"
+          echo "::group::install requirements"
+          uv sync --frozen --group dev
           echo "::endgroup::"
 
-      - name: Setup Tox environment
-        run: tox --workdir /tmp/tox run-parallel --parallel auto --parallel-no-spinner --parallel-live --colored yes -e test-all-py310 --notest
+      - name: Install project
+        run: |
+          python -m pip install -e .
 
-      - name: Test with tox
-        run: tox --workdir /tmp/tox run --skip-pkg-install --result-json results/tox-py310.json --colored yes -e test-all-py310
+      - name: Run coverage
+        run: |
+          make test-coverage
+
+      - name: Upload test results
+        if: success() || failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: test-results-ubuntu-24.04
+          path: results/
 
       - name: Run TICS analysis
         uses: tiobe/tics-github-action@v3
-        env:
-          PATH: "/tmp/tox/test-all-py310/bin:/snap/bin:/home/runner/.local/bin:/home/runner/.cargo/bin:/bin:/usr/bin:/usr/local/bin:"
         with:
           mode: qserver
           project: snapcraft