Merge remote-tracking branch 'upstream/master' into pr/684

.github/codespell_exclude_lines.txt

@@ -0,0 +1,8 @@
+        "/RADME",  # wrong filename
+        "/CANGES",  # wrong filename
+        "/dataset_descrption.json",  # wrong filename
+        "/dataset_description.jon",  # wrong extension
+        "/participants.sv",  # wrong extension
+        "/participnts.tsv",  # wrong filename
+        "/particpants.json"  # wrong filename
+        "/participants.son"  # wrong extension

.github/dependabot.yml

@@ -0,0 +1,11 @@
+# https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+  - package-ecosystem: "gitsubmodule"
+    directory: "/"
+    schedule:
+      interval: "weekly"

.github/workflows/build-test-deploy.yml

@@ -0,0 +1,156 @@
+# This file tests the claimed support range of PyBIDS including
+#
+# * Operating systems: Linux, OSX
+
+on:
+  push:
+    branches:
+      - master
+      - maint/*
+      - test-pypi-uploads
+    tags:
+      - '*'
+  pull_request: {}
+  schedule:
+    # 8am EST / 9am EDT Mondays
+    - cron: '0 13 * * 1'
+  # Allow job to be triggered manually from GitHub interface
+  workflow_dispatch:
+
+defaults:
+  run:
+    shell: bash
+
+# Force tox and pytest to use color
+env:
+  FORCE_COLOR: true
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    name: Build & verify package
+    runs-on: ubuntu-latest
+    permissions:
+      attestations: write
+      id-token: write
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: hynek/build-and-inspect-python-package@v2
+        with:
+          attest-build-provenance-github: ${{ github.event_name != 'pull_request' }}
+
+  test:
+    # Check each OS, all supported Python, minimum versions and latest releases
+    runs-on: ${{ matrix.os }}
+    needs: [build]
+    strategy:
+      matrix:
+        os: ['ubuntu-latest', 'macos-latest']
+        python-version: ['3.9', '3.10', '3.11', '3.12']
+        dependencies: ['full', 'pre']
+        source: ['repo']
+        include:
+          - os: ubuntu-latest
+            python-version: '3.9'
+            dependencies: min
+            source: 'repo'
+          - os: ubuntu-latest
+            python-version: '3'
+            dependencies: full
+            source: 'sdist'
+        exclude:
+          # Drop pre tests for SPEC-0-unsupported Python versions
+          # See https://scientific-python.org/specs/spec-0000/
+          - python-version: '3.9'
+            dependencies: pre
+          - python-version: '3.10'
+            dependencies: pre
+      fail-fast: false
+
+    env:
+      DEPENDS: ${{ matrix.dependencies }}
+
+    steps:
+      - uses: actions/checkout@v4
+        if: matrix.source == 'repo'
+        with:
+          submodules: recursive
+          fetch-depth: 0
+      - name: Download packages built by build-and-inspect-python-package
+        if: matrix.source == 'sdist'
+        uses: actions/download-artifact@v4
+        with:
+          name: Packages
+          path: dist
+      - name: Extract sdist
+        if: matrix.source == 'sdist'
+        run: tar --strip-components=1 -xzf dist/*.tar.gz
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+          allow-prereleases: true
+      - name: Display Python version
+        run: python -c "import sys; print(sys.version)"
+      - name: Install tox
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install tox tox-gh-actions
+      - name: Show tox config
+        run: tox c
+      - name: Run tox
+        run: tox -v --exit-and-dump-after 1200
+      - uses: codecov/codecov-action@v5
+        if: ${{ always() }}
+        with:
+          files: cov.xml
+          token: ${{ secrets.CODECOV_TOKEN }}
+
+  test-publish:
+    name: Push package to test.pypi.org
+    if: github.event_name == 'push'
+    runs-on: ubuntu-latest
+    needs: [build]
+    permissions:
+      attestations: write
+      id-token: write
+
+    steps:
+      - name: Download packages built by build-and-inspect-python-package
+        uses: actions/download-artifact@v4
+        with:
+          name: Packages
+          path: dist
+
+      - name: Upload package to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          repository-url: https://test.pypi.org/legacy/
+          skip-existing: true
+
+  publish:
+    name: Publish released package to pypi.org
+    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags')
+    runs-on: ubuntu-latest
+    needs: [test, test-publish]
+    permissions:
+      attestations: write
+      id-token: write
+
+    steps:
+      - name: Download packages built by build-and-inspect-python-package
+        uses: actions/download-artifact@v4
+        with:
+          name: Packages
+          path: dist
+
+      - name: Upload package to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1

.github/workflows/codespell.yml

@@ -13,5 +13,5 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v4
       - uses: codespell-project/actions-codespell@master

.github/workflows/docs.yml

@@ -9,47 +9,51 @@ on:
       - docs/*
     tags:
       - '*'
+  pull_request:
+  workflow_dispatch:
 
 defaults:
   run:
     shell: bash
 
+# Force tox to use color
+env:
+  FORCE_COLOR: true
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
 jobs:
   docs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
         include:
-          - python-version: 3.9
+          - python-version: '3.11'
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v4
         with:
           submodules: recursive
           fetch-depth: 0
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v2
+        uses: actions/setup-python@v5
         with:
           python-version: ${{ matrix.python-version }}
       - name: Display Python version
         run: python -c "import sys; print(sys.version)"
-      - name: Create virtual environment
-        run: tools/ci/create_venv.sh
-      - name: Install pybids
-        run: tools/ci/install_extras.sh
-        env:
-          EXTRA_PIP_FLAGS: ""
-          CHECK_TYPE: doc
       - name: Build documentation
-        run: |
-            source tools/ci/activate.sh
-            make -C doc html
+        run: pipx run tox -e docs
       - name: Upload docs as artifacts
-        uses: actions/upload-artifact@v2
+        uses: actions/upload-artifact@v4
         with:
             path: doc/_build/html
       - name: Deploy (on tags)
         if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags')
-        uses: peaceiris/actions-gh-pages@v3
+        uses: peaceiris/actions-gh-pages@v4
         with:
             github_token: ${{ secrets.GITHUB_TOKEN }}
             publish_dir: doc/_build/html