feat!: replace current secrets implementation with a secrets service

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,6 +1,6 @@
 - [ ] Have you followed the guidelines for contributing?
 - [ ] Have you signed the [CLA](http://www.ubuntu.com/legal/contributors/)?
-- [ ] Have you successfully run `tox`?
+- [ ] Have you successfully run `make lint && make test`?
 - [ ] Have you added an entry to the changelog (`docs/reference/changelog.rst`)?
 
------
+---

.github/release-drafter.yaml

@@ -15,7 +15,7 @@ categories:
   - title: "Tooling"
     label:
       - "tooling"
-change-template: '- $TITLE @$AUTHOR (#$NUMBER)'
+change-template: "- $TITLE @$AUTHOR (#$NUMBER)"
 template: |
   Special thanks to the contributors that made this release happen: $CONTRIBUTORS
 

.github/release-drafter.yml

@@ -15,7 +15,7 @@ categories:
   - title: "Tooling"
     label:
       - "tooling"
-change-template: '- $TITLE @$AUTHOR (#$NUMBER)'
+change-template: "- $TITLE @$AUTHOR (#$NUMBER)"
 template: |
   Special thanks to the contributors that made this release happen: $CONTRIBUTORS
 

.github/workflows/check-renovate.yaml

@@ -10,7 +10,7 @@ on:
     inputs:
       enable_ssh_access:
         type: boolean
-        description: 'Enable ssh access'
+        description: "Enable ssh access"
         required: false
         default: false
 

.github/workflows/policy.yaml

@@ -0,0 +1,17 @@
+name: Check policy
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+      - hotfix/*
+      - work/check-policy # For development
+
+jobs:
+  policy:
+    uses: canonical/starflow/.github/workflows/policy.yaml@main
+  python-scans:
+    name: Security scan
+    uses: canonical/starflow/.github/workflows/scan-python.yaml@main
+    with:
+      uv-export-extra-args: "--extra remote"

.github/workflows/qa.yaml

@@ -0,0 +1,23 @@
+name: QA
+on:
+  push:
+    branches:
+      - "main"
+      - "feature/*"
+      - "hotfix/*"
+      - "release/*"
+      - "renovate/*"
+  pull_request:
+
+jobs:
+  lint:
+    uses: canonical/starflow/.github/workflows/lint-python.yaml@main
+  test:
+    uses: canonical/starflow/.github/workflows/test-python.yaml@main
+    with:
+      fast-test-platforms: '[["jammy", "amd64"], ["noble", "amd64"]]'
+      fast-test-python-versions: '["3.10", "3.12"]'
+      slow-test-platforms: '[["jammy", "amd64"], ["noble", "amd64"]]'
+      slow-test-python-versions: '["3.10", "3.12"]'
+      lowest-python-platform: '["jammy", "amd64"]'
+      lowest-python-version: "3.10"

.pre-commit-config.yaml

@@ -2,7 +2,7 @@
 # See https://pre-commit.com/hooks.html for more hooks
 repos:
   - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v4.6.0
+    rev: "v5.0.0"
     hooks:
       - id: trailing-whitespace
       - id: end-of-file-fixer
@@ -12,19 +12,17 @@ repos:
       - id: check-toml
       - id: fix-byte-order-marker
       - id: mixed-line-ending
-  - repo: https://github.com/charliermarsh/ruff-pre-commit
-    # renovate: datasource=pypi;depName=ruff
+  - repo: https://github.com/astral-sh/ruff-pre-commit
     rev: "v0.9.3"
     hooks:
+      # Run the linter
       - id: ruff
         args: [--fix, --exit-non-zero-on-fix]
-  - repo: https://github.com/psf/black
-    # renovate: datasource=pypi;depName=black
-    rev: "24.8.0"
+      # Run the formatter
+      - id: ruff-format
+  - repo: https://github.com/pre-commit/mirrors-prettier
+    rev: "" # Intentionally blank, despite the warning.
     hooks:
-      - id: black
-  - repo: https://github.com/adrienverge/yamllint.git
-    # renovate: datasource=pypi;depName=yamllint
-    rev: "v1.35.1"
-    hooks:
-      - id: yamllint
+      - id: prettier
+        additional_dependencies:
+          - [email protected]

.prettierignore

@@ -0,0 +1 @@
+tests/**/*.yaml

.readthedocs.yaml

@@ -9,14 +9,23 @@ version: 2
 sphinx:
   configuration: docs/conf.py
 
+# Optionally build your docs in additional formats such as PDF
+# formats:
+#  - pdf
+#  - epub
+
 build:
-  os: ubuntu-22.04
+  os: ubuntu-24.04
   tools:
     python: "3.12"
-
-python:
-  install:
-    - method: pip
-      path: .
-      extra_requirements:
-        - docs
+  jobs:
+    post_checkout:
+      - git fetch --tags --unshallow # Also fetch tags
+    post_system_dependencies:
+      - asdf plugin add uv
+      - asdf install uv latest
+      - asdf global uv latest
+    create_environment:
+      - uv venv "${READTHEDOCS_VIRTUALENV_PATH}"
+    install:
+      - UV_PROJECT_ENVIRONMENT="${READTHEDOCS_VIRTUALENV_PATH}" uv sync --frozen --group docs