GHA maintenance (#4132)

Author: ssbarnea

.github/CODEOWNERS

@@ -1 +1 @@
-*       @ansible-community/molecule @ansible-community/devtools
+*       @ansible/devtools

.github/release-drafter.yml

@@ -1,2 +1,2 @@
-# see https://github.com/ansible/devtools
-_extends: ansible/devtools
+# see https://github.com/ansible/team-devtools
+_extends: ansible/team-devtools

.github/workflows/ack.yml

@@ -1,10 +1,14 @@
----
-# See https://github.com/ansible/devtools/blob/main/.github/workflows/ack.yml
+# See https://github.com/ansible/team-devtools/blob/main/.github/workflows/ack.yml
 name: ack
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 on:
   pull_request_target:
     types: [opened, labeled, unlabeled, synchronize]
 
 jobs:
   ack:
-    uses: ansible/devtools/.github/workflows/ack.yml@main
+    uses: ansible/team-devtools/.github/workflows/ack.yml@main

.github/workflows/push.yml

@@ -1,5 +1,4 @@
----
-# See https://github.com/ansible/devtools/blob/main/.github/workflows/push.yml
+# See https://github.com/ansible/team-devtools/blob/main/.github/workflows/push.yml
 name: push
 on:
   push:
@@ -10,4 +9,4 @@ on:
 
 jobs:
   ack:
-    uses: ansible/devtools/.github/workflows/push.yml@main
+    uses: ansible/team-devtools/.github/workflows/push.yml@main

.github/workflows/release.yml

@@ -1,5 +1,3 @@
----
-# cspell:ignore mislav
 name: release
 
 on:
@@ -8,36 +6,29 @@ on:
 
 jobs:
   pypi:
-    name: Publish to PyPI registry
+    name: release ${{ github.event.ref }}
     environment: release
     runs-on: ubuntu-22.04
+    permissions:
+      id-token: write
 
     env:
       FORCE_COLOR: 1
       PY_COLORS: 1
-      TOXENV: pkg
+      TOX_PARALLEL_NO_SPINNER: 1
 
     steps:
-      - name: Switch to using Python 3.10 by default
+      - name: Switch to using Python 3.12 by default
         uses: actions/setup-python@v5
         with:
-          python-version: 3.10
-
+          python-version: "3.12"
       - name: Install tox
         run: python3 -m pip install --user "tox>=4.0.0"
-
       - name: Check out src from Git
         uses: actions/checkout@v4
         with:
           fetch-depth: 0 # needed by setuptools-scm
-          submodules: true
-
       - name: Build dists
-        run: python -m tox
-
+        run: python -m tox -e pkg
       - name: Publish to pypi.org
-        if: >- # "create" workflows run separately from "push" & "pull_request"
-          github.event_name == 'release'
         uses: pypa/gh-action-pypi-publish@release/v1
-        with:
-          password: ${{ secrets.pypi_password }}

.github/workflows/tox.yml

@@ -1,21 +1,16 @@
 ---
 name: tox
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 on:
   push: # only publishes pushes to the main branch to TestPyPI
     branches: # any integration branch but not tag
       - "main"
   pull_request:
-    branches:
-      - "main"
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
-  cancel-in-progress: true
-
-env:
-  FORCE_COLOR: 1 # tox, pytest, ansible-lint
-  PY_COLORS: 1
+  workflow_call:
 
 jobs:
   pre:
@@ -111,13 +106,20 @@ jobs:
         # produce a single .coverage file at repo root
         run: tox -e coverage
 
+      - name: Archive logs
+        uses: actions/upload-artifact@v4
+        with:
+          name: logs-${{ matrix.name }}.zip
+          path: .tox/**/log/
+
       - name: Upload coverage data
         if: ${{ startsWith(matrix.passed_name, 'py') }}
         uses: codecov/codecov-action@v4
         with:
-          name: ${{ matrix.passed_name }}
+          name: ${{ matrix.name }}
           token: ${{ secrets.CODECOV_TOKEN }}
-          verbose: true # optional (default = false)
+          verbose: true
+          fail_ci_if_error: true
 
       - name: Report failure if git reports dirty status
         run: |
@@ -133,10 +135,14 @@ jobs:
 
     needs:
       - build
-
     runs-on: ubuntu-latest
-
     steps:
+      - name: Merge logs into a single archive
+        uses: actions/upload-artifact/merge@v4
+        with:
+          name: logs.zip
+          pattern: logs-*.zip
+          delete-merged: true
       - name: Decide whether the needed jobs succeeded or failed
         uses: re-actors/alls-green@release/v1
         with:

codecov.yml

@@ -1,9 +1,4 @@
-codecov:
-  require_ci_to_pass: true
 comment: false
 coverage:
   status:
-    patch: false
-    project:
-      default:
-        threshold: 0.5%
+    patch: true # we want github annotations