Modernize the Python template

.dockerignore

@@ -0,0 +1,10 @@
+.git
+**/.venv
+**/__pycache__
+**/.pytest_cache
+**/.ruff_cache
+**/*.egg-info
+**/dist
+**/build
+**/.env
+**/.env.*

.editorconfig

@@ -0,0 +1,18 @@
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+insert_final_newline = true
+trim_trailing_whitespace = true
+indent_style = space
+indent_size = 4
+
+[*.{yaml,yml}]
+indent_size = 2
+
+[Makefile]
+indent_style = tab
+
+[*.md]
+trim_trailing_whitespace = false

.gitattributes

@@ -0,0 +1,7 @@
+* text=auto
+*.sh text eol=lf
+Makefile text eol=lf
+*.py text eol=lf
+*.toml text eol=lf
+*.yaml text eol=lf
+*.yml text eol=lf

.github/dependabot.yml

@@ -0,0 +1,26 @@
+version: 2
+updates:
+  - package-ecosystem: uv
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    groups:
+      development-tools:
+        patterns: ["pytest*", "ruff", "ty", "pre-commit"]
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      actions:
+        patterns: ["*"]
+  - package-ecosystem: docker
+    directories:
+      - /templates/service
+      - /services/*
+    schedule:
+      interval: weekly
+    groups:
+      container-images:
+        patterns: ["*"]

.github/workflows/test_all_services_and_packages.yaml

@@ -1,25 +1,69 @@
-name: Test All Services and Packages
+name: CI
 
 on:
   pull_request:
-    branches: [ main ]
   push:
-#    branches: [ main ]
+    branches: [main]
   workflow_dispatch:
 
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
-  test:
+  check:
     runs-on: ubuntu-latest
-
+    timeout-minutes: 15
     strategy:
+      fail-fast: false
       matrix:
-        folder: [services/*, packages/*]
-
+        python-version: ["3.12", "3.13", "3.14", "3.15"]
     steps:
-      - name: Checkout code
-        uses: actions/checkout@v2
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+        with:
+          version: "0.13.4"
+          python-version: ${{ matrix.python-version }}
+          enable-cache: true
+      - run: uv sync --all-packages --locked
+      - run: make lint
+      - name: Check formatting
+        if: ${{ !cancelled() }}
+        run: uv run --locked ruff format --check --diff .
+      - name: Check types
+        if: ${{ !cancelled() }}
+        run: make typecheck
+      - name: Run tests
+        if: ${{ !cancelled() }}
+        run: make test
 
-      - name: Test ${{ matrix.folder }}
-        uses: ./.github/actions/test-service-or-package
+  smoke:
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 20
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            arguments: --docker
+          - os: macos-latest
+            arguments: ""
+          - os: windows-latest
+            arguments: ""
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
         with:
-          target_path: ${{ matrix.folder }}
+          version: "0.13.4"
+          python-version: "3.14"
+          enable-cache: true
+      - run: uv sync --locked
+      - name: Generate, test, build, and install workspace members
+        run: uv run --locked python scripts/smoke_test.py ${{ matrix.arguments }}

.github/workflows/test_service_or_package.yaml

@@ -1,41 +1,42 @@
-name: Validate Code
+name: Validate One Workspace Member
 
 on:
   workflow_dispatch:
     inputs:
       target_path:
-        description: 'The path of the package or service to validate'
+        description: "Workspace member path, for example services/my-service"
         required: true
+        type: string
+
+permissions:
+  contents: read
 
 jobs:
-  validate_code:
+  validate:
     runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        python-version: ["3.11"]
+    timeout-minutes: 15
     steps:
-    - uses: actions/checkout@v2
-
-    - name: Set up Python ${{ matrix.python-version }}
-      uses: actions/setup-python@v2
-      with:
-        python-version: ${{ matrix.python-version }}
-
-    - name: Install Poetry
-      run: pip install poetry
-
-    - name: Install Dependencies
-      run: poetry install
-      working-directory: ${{ github.workspace }}/${{ github.event.inputs.target_path }}
-
-    - name: Lint
-      run: make -f Makefile lint
-      working-directory: ${{ github.workspace }}/${{ github.event.inputs.target_path }}
-
-    - name: Format
-      run: make -f Makefile format args="--check"
-      working-directory: ${{ github.workspace }}/${{ github.event.inputs.target_path }}
-
-    - name: Test
-      run: make -f Makefile test
-      working-directory: ${{ github.workspace }}/${{ github.event.inputs.target_path }}
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+        with:
+          version: "0.13.4"
+          python-version: "3.14"
+          enable-cache: true
+      - run: uv sync --all-packages --locked
+      - name: Validate selected member
+        env:
+          TARGET_PATH: ${{ inputs.target_path }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          if [[ ! "$TARGET_PATH" =~ ^(services|packages)/[a-z][a-z0-9_-]*$ ]] || [[ ! -f "$TARGET_PATH/pyproject.toml" ]]; then
+            echo "Expected an existing services/<name> or packages/<name> workspace member" >&2
+            exit 1
+          fi
+          cd "$TARGET_PATH"
+          uv run --locked ruff check src tests
+          uv run --locked ruff format --check src tests
+          uv run --locked ty check src tests
+          uv run --locked pytest tests