Repair extraction and modernize tooling

.dockerignore

@@ -0,0 +1,17 @@
+.git
+.agents
+.codex
+.aws
+.local
+.env
+**/.env
+.venv
+env_*
+.pytest_cache
+.mypy_cache
+.ruff_cache
+**/__pycache__
+**/*.egg-info
+**/build
+**/dist
+output_data

.github/workflows/conda.yml

@@ -0,0 +1,46 @@
+name: Conda
+
+on:
+  push:
+    paths: ['environment.yml', 'packaging/conda/**', 'module/**', 'tests/**', '.github/workflows/conda.yml']
+  pull_request:
+    paths: ['environment.yml', 'packaging/conda/**', 'module/**', 'tests/**', '.github/workflows/conda.yml']
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  environment:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v7
+      - uses: mamba-org/setup-micromamba@v3
+        with:
+          environment-file: environment.yml
+          generate-run-shell: true
+      - name: Test the editable environment
+        shell: micromamba-shell {0}
+        run: |
+          python -m pip check
+          python -m pytest
+  package:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v7
+      - uses: mamba-org/setup-micromamba@v3
+        with:
+          environment-name: conda-build
+          create-args: python=3.12 conda-build rattler-build
+          generate-run-shell: true
+      - name: Build and test the package
+        shell: micromamba-shell {0}
+        run: |
+          conda build --override-channels -c conda-forge --python 3.12 --output-folder conda-dist packaging/conda
+          rattler-build build --recipe packaging/conda/conda-forge/recipe.yaml --channel conda-forge --output-dir conda-dist --log-style plain
+      - uses: actions/upload-artifact@v7
+        with:
+          name: conda-package
+          path: conda-dist/noarch/*.conda

.github/workflows/docker.yml

@@ -0,0 +1,57 @@
+name: Containers
+
+on:
+  push:
+    paths: ['docker/**', 'module/**', 'jupyter/examples/**', 'tests/container_smoke.py', '.dockerignore', '.github/workflows/docker.yml']
+  pull_request:
+    paths: ['docker/**', 'module/**', 'jupyter/examples/**', 'tests/container_smoke.py', '.dockerignore', '.github/workflows/docker.yml']
+  workflow_dispatch:
+    inputs:
+      publish:
+        description: Publish tested images to GitHub Container Registry
+        type: boolean
+        default: false
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    timeout-minutes: 25
+    steps:
+      - uses: actions/checkout@v7
+      - name: Build both targets
+        run: |
+          docker build -f docker/Dockerfile --target cli -t collage-test:cli .
+          docker build -f docker/Dockerfile --target notebook -t collage-test:notebook .
+      - name: Test the installed CLI
+        run: |
+          docker run --rm collage-test:cli --help
+          docker run --rm --entrypoint python -v "$PWD/tests/container_smoke.py:/tmp/container_smoke.py:ro" collage-test:cli /tmp/container_smoke.py
+      - name: Execute the bundled notebook
+        run: |
+          docker run --rm collage-test:notebook python -m nbconvert --to notebook --execute /opt/collage/examples/example.ipynb --output /tmp/executed.ipynb --ExecutePreprocessor.timeout=120
+  publish:
+    if: github.event_name == 'workflow_dispatch' && inputs.publish
+    needs: build
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - uses: actions/checkout@v7
+      - name: Authenticate to the registry
+        env:
+          REGISTRY_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: printf '%s' "$REGISTRY_TOKEN" | docker login ghcr.io -u "${{ github.actor }}" --password-stdin
+      - name: Build and publish verified targets
+        env:
+          IMAGE_BASE: ghcr.io/${{ github.repository }}
+          REVISION: ${{ github.sha }}
+        run: |
+          for target in cli notebook; do
+            docker build -f docker/Dockerfile --target "$target" -t "$IMAGE_BASE-$target:$REVISION" -t "$IMAGE_BASE-$target:latest" .
+            docker push "$IMAGE_BASE-$target:$REVISION"
+            docker push "$IMAGE_BASE-$target:latest"
+          done

.github/workflows/docs-examples.yml

@@ -0,0 +1,27 @@
+name: Documentation and examples
+
+on: [push, pull_request, workflow_dispatch]
+
+permissions:
+  contents: read
+
+jobs:
+  documentation:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
+        with:
+          python-version: '3.12'
+          cache: pip
+          cache-dependency-path: |
+            module/requirements.txt
+            module/setup.py
+            module/docs/requirements.txt
+      - name: Install documentation and example dependencies
+        run: python -m pip install -r module/docs/requirements.txt './module[examples]'
+      - name: Build documentation with warnings as errors
+        run: python -m sphinx -W -b html module/docs/source "$RUNNER_TEMP/docs"
+      - name: Execute the notebook without a desktop
+        run: |
+          python -m nbconvert --to notebook --execute jupyter/examples/example.ipynb --output "$RUNNER_TEMP/example.executed.ipynb" --ExecutePreprocessor.timeout=120

.github/workflows/python-publish.yml

@@ -1,29 +1,66 @@
-name: Continuous Delivery
+name: Release packages
 
 on:
   push:
-    tags:
-    - 'v*'
+    paths: ['module/**', 'cli/**', 'tests/**', 'requirements-test.txt', '.github/workflows/python-publish.yml']
+  pull_request:
+    paths: ['module/**', 'cli/**', 'tests/**', 'requirements-test.txt', '.github/workflows/python-publish.yml']
+  release:
+    types: [published]
+  workflow_dispatch:
 
-jobs:
-  deploy:
+permissions:
+  contents: read
 
+jobs:
+  build:
     runs-on: ubuntu-latest
-
     steps:
-    - uses: actions/checkout@v2
-    - name: Set up Python
-      uses: actions/setup-python@v2
-      with:
-        python-version: '3.6'
-    - name: Install dependencies
-      run: |
-        python -m pip install --upgrade pip
-        pip install setuptools wheel twine
-    - name: Build and publish
-      env:
-        TWINE_USERNAME: ${{ secrets.PYPI_USERNAME }}
-        TWINE_PASSWORD: ${{ secrets.PYPI_PASSWORD }}
-      run: |
-        cd module
-        sh setup.sh
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
+        with:
+          python-version: '3.12'
+      - name: Validate release version
+        if: github.event_name == 'release'
+        env:
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
+        run: |
+          test "$RELEASE_TAG" = "v$(cat module/VERSION)"
+      - name: Install and test
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install -r requirements-test.txt twine
+          python -m pip install --no-build-isolation './module[cli]'
+          python -m pip check
+          python -m pytest
+      - name: Build distributions from source archives
+        run: |
+          python -m build --outdir dist/core module
+          python -m build --outdir dist/cli cli
+          python -m twine check --strict dist/core/* dist/cli/*
+      - uses: actions/upload-artifact@v7
+        with:
+          name: python-distributions
+          path: dist/
+  publish:
+    if: github.event_name == 'release' && !github.event.release.prerelease
+    needs: build
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/p/collageradiomics
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@v8
+        with:
+          name: python-distributions
+          path: dist
+      - name: Publish the core with trusted publishing
+        uses: pypa/gh-action-pypi-publish@v1.14.2
+        with:
+          packages-dir: dist/core/
+      - name: Publish the compatibility CLI with trusted publishing
+        uses: pypa/gh-action-pypi-publish@v1.14.2
+        with:
+          packages-dir: dist/cli/

.github/workflows/slicer-tests.yml

@@ -0,0 +1,39 @@
+name: Slicer tests
+
+on:
+  push:
+    paths: ['module/**', 'slicer/**', 'CMakeLists.txt', 'packaging/catalogs/**', 'tests/run_slicer.py', '.github/workflows/slicer-tests.yml']
+  pull_request:
+    paths: ['module/**', 'slicer/**', 'CMakeLists.txt', 'packaging/catalogs/**', 'tests/run_slicer.py', '.github/workflows/slicer-tests.yml']
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  slicer:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    env:
+      SLICER_SHA512: ac76c5061a8fff20d4e59732855f74360930fd4891450085bcbc6a8eb1a1f4ade9a1ca4fc633142661b714dbe8c4604306079f9546e52053faa5e6f99410cf76
+      LIBGL_ALWAYS_SOFTWARE: '1'
+    steps:
+      - uses: actions/checkout@v7
+      - name: Install application prerequisites
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y libglu1-mesa libpulse-mainloop-glib0 libnss3 libasound2t64 qt5dxcb-plugin xvfb
+      - name: Download verified Slicer 5.12.4
+        run: |
+          curl --fail --location --retry 3 https://download.slicer.org/bitstream/6aa1beb7ce9de556d3010204 -o "$RUNNER_TEMP/slicer.tar.gz"
+          printf '%s  %s\n' "$SLICER_SHA512" "$RUNNER_TEMP/slicer.tar.gz" | sha512sum --check -
+          mkdir "$RUNNER_TEMP/slicer"
+          tar -xzf "$RUNNER_TEMP/slicer.tar.gz" --strip-components=1 -C "$RUNNER_TEMP/slicer"
+      - name: Install the checked-out library
+        run: '"$RUNNER_TEMP/slicer/bin/PythonSlicer" -m pip install ./module'
+      - name: Run native extension tests
+        env:
+          XDG_CONFIG_HOME: ${{ runner.temp }}/slicer-config
+          XDG_CACHE_HOME: ${{ runner.temp }}/slicer-cache
+        run: |
+          xvfb-run -a "$RUNNER_TEMP/slicer/Slicer" --ignore-slicerrc --testing --no-main-window --no-splash --python-script tests/run_slicer.py

.github/workflows/tests.yml

@@ -0,0 +1,50 @@
+name: Tests
+
+on:
+  push:
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - python-version: "3.10"
+            constraints: "-c constraints-test.txt"
+          - python-version: "3.11"
+            constraints: ""
+          - python-version: "3.12"
+            constraints: ""
+          - python-version: "3.13"
+            constraints: ""
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
+        with:
+          python-version: ${{ matrix.python-version }}
+          cache: pip
+          cache-dependency-path: |
+            module/pyproject.toml
+            module/requirements.txt
+            requirements-test.txt
+            constraints-test.txt
+      - name: Install test tools and package
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install ${{ matrix.constraints }} -r requirements-test.txt
+          python -m pip install --no-build-isolation ${{ matrix.constraints }} -e './module[cli]'
+          python -m pip check
+      - name: Run core and distribution tests
+        run: python -m pytest
+      - name: Check types and style
+        if: matrix.python-version == '3.11'
+        run: |
+          python -m mypy
+          python -m ruff check module/collageradiomics module/_collageradiomics tests cli
+          python -m ruff format --check module/collageradiomics module/_collageradiomics tests cli

.gitignore

@@ -15,4 +15,11 @@ module/docs/build/*
 module/docs/source/_build/*
 .idea/*
 __pycache__
+.pytest_cache/
 env_*
+.venv/
+.mypy_cache/
+.ruff_cache/
+*.egg-info/
+cli/build/
+cli/dist/

.readthedocs.yml

@@ -1,12 +1,15 @@
 version: 2
-
+build:
+  os: ubuntu-24.04
+  tools:
+    python: '3.12'
 sphinx:
   configuration: module/docs/source/conf.py
-
+  fail_on_warning: true
 formats:
   - pdf
-
 python:
-  version: 3.7
   install:
+    - method: pip
+      path: ./module
     - requirements: module/docs/requirements.txt