refactor: migrate to PDM

.github/dependabot.yaml

@@ -1,19 +1,30 @@
+---
 version: 2
+
 updates:
-  - package-ecosystem: "github-actions"
-    directory: "/"
+  - package-ecosystem: github-actions
+    directory: /
     schedule:
-      interval: "monthly"
+      interval: monthly
     groups:
       ci-dependencies:
         patterns:
-          - "*"
+          - '*'
 
-  - package-ecosystem: "pip"
-    directory: "/"
+  - package-ecosystem: pip
+    directory: /
     schedule:
-      interval: "monthly"
+      interval: monthly
     groups:
       python-dependencies:
         patterns:
-          - "*"
+          - '*'
+
+  - package-ecosystem: docker
+    directory: /
+    schedule:
+      interval: monthly
+    groups:
+      docker-dependencies:
+        patterns:
+          - '*'

.github/workflows/image-build-push.yaml

@@ -35,27 +35,27 @@ jobs:
 
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
+      - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871  # v4.2.1
 
       - name: Install cosign
-        uses: sigstore/cosign-installer@dc72c7d5c4d10cd6bcb8cf6e3fd625a9e5e537da # v3.7.0
+        uses: sigstore/cosign-installer@dc72c7d5c4d10cd6bcb8cf6e3fd625a9e5e537da  # v3.7.0
 
       - name: Set up Docker Buildx
         id: buildx
-        uses: docker/setup-buildx-action@c47758b77c9736f4b2ef4073d4d51994fabfe349 # v3.7.1
+        uses: docker/setup-buildx-action@c47758b77c9736f4b2ef4073d4d51994fabfe349  # v3.7.1
         with:
           platforms: ${{ matrix.platform }}
 
       - name: Log in to container registry (${{ env.REGISTRY }})
-        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
+        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567  # v3.3.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Extract Docker metadata
         id: docker_meta
-        uses: docker/metadata-action@8e5442c4ef9f78752691e2d8f8d19755c6f78e81 # v5.5.1
+        uses: docker/metadata-action@8e5442c4ef9f78752691e2d8f8d19755c6f78e81  # v5.5.1
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           tags: |
@@ -67,7 +67,7 @@ jobs:
 
       - name: Build and push Docker image
         id: docker_build_push
-        uses: docker/build-push-action@4f58ea79222b3b9dc2c8bbdd6debcef730109a75 # v6.9.0
+        uses: docker/build-push-action@4f58ea79222b3b9dc2c8bbdd6debcef730109a75  # v6.9.0
         with:
           builder: ${{ steps.buildx.outputs.name }}
           build-args: |
@@ -98,7 +98,7 @@ jobs:
 
       - name: Upload digest
         if: ${{ github.ref == 'refs/heads/main' || startswith(github.event.ref, 'refs/tags/v') }}
-        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
+        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882  # v4.4.3
         with:
           if-no-files-found: error
           name: digests
@@ -113,24 +113,24 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: Download digests
-        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
+        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16  # v4.1.8
         with:
           name: digests
           path: /tmp/digests
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@c47758b77c9736f4b2ef4073d4d51994fabfe349 # v3.7.1
+        uses: docker/setup-buildx-action@c47758b77c9736f4b2ef4073d4d51994fabfe349  # v3.7.1
 
       - name: Log in to container registry (${{ env.REGISTRY }})
-        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
+        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567  # v3.3.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Extract Docker metadata
         id: docker_meta
-        uses: docker/metadata-action@8e5442c4ef9f78752691e2d8f8d19755c6f78e81 # v5.5.1
+        uses: docker/metadata-action@8e5442c4ef9f78752691e2d8f8d19755c6f78e81  # v5.5.1
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           tags: |

.github/workflows/lint-test.yaml

@@ -0,0 +1,35 @@
+---
+name: Lint & Test
+
+on:
+  push:
+    branches:
+      - main
+    tags:
+      - v*
+  pull_request:
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  lint_test:
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871  # v4.2.1
+
+      - name: Setup PDM
+        uses: pdm-project/setup-pdm@568ddd69406b30de1774ec0044b73ae06e716aa4  # v4.1
+        with:
+          python-version: '3.11'
+          cache: true
+
+      - name: Install dependencies
+        run: pdm install --no-self
+
+      - name: Run pre-commit
+        run: pdm pre-commit
+
+      - name: Run tests
+        run: pdm test

.markdownlint.yaml

@@ -0,0 +1,5 @@
+---
+MD013:
+  line_length: 120
+
+MD024: false

.pre-commit-config.yaml

@@ -1,18 +1,98 @@
+---
+default_language_version:
+  python: python3
+  node: system
+
 repos:
+  - repo: meta
+    hooks:
+      - id: check-hooks-apply
+      - id: check-useless-excludes
+
   - repo: https://github.com/pre-commit/pre-commit-hooks
     rev: cef0300fd0fc4d2a87a85fa2093c6b283ea36f4b  # frozen: v5.0.0
     hooks:
-      - id: check-case-conflict
+      - id: check-added-large-files
       - id: check-merge-conflict
-      - id: check-toml
-      - id: check-yaml
-      - id: check-json
-      - id: trailing-whitespace
-        args: [ --markdown-linebreak-ext=md ]
-      - id: mixed-line-ending
-        args: [ --fix=lf ]
       - id: end-of-file-fixer
-  - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: "8983acb92ee4b01924893632cf90af926fa608f0"  # frozen: v0.7.0
+      - id: name-tests-test
+        args:
+          - --pytest-test-first
+      - id: trailing-whitespace
+        args:
+          - --markdown-linebreak-ext=md
+        exclude: \.gitignore
+
+  - repo: local
+    hooks:
+      - id: ruff-format
+        name: Ruff (Format)
+        description: Format Python files
+        language: system
+        entry: pdm run format
+        types_or:
+          - python
+          - pyi
+
+      - id: ruff-lint
+        name: Ruff (Lint)
+        description: Lint Python files
+        language: system
+        entry: pdm run lint
+        args:
+          - --exit-non-zero-on-fix
+        types_or:
+          - python
+          - pyi
+
+      - id: pyright
+        name: Pyright
+        description: Type-check Python files
+        language: system
+        entry: pdm run type-check
+        types_or:
+          - python
+          - pyi
+        pass_filenames: false
+
+  - repo: https://github.com/python-jsonschema/check-jsonschema
+    rev: 37cd56d9d154dfb0648eaee8efc1040512700c47  # frozen: 0.29.4
+    hooks:
+      - id: check-github-workflows
+
+  - repo: https://github.com/lyz-code/yamlfix
+    rev: 8072181c0f2eab9f2dd8db2eb3b9556d7cd0bd74  # frozen: 1.17.0
+    hooks:
+      - id: yamlfix
+        args:
+          - --config-file
+          - .yamlfix.toml
+
+  - repo: https://github.com/adrienverge/yamllint
+    rev: 81e9f98ffd059efe8aa9c1b1a42e5cce61b640c6  # frozen: v1.35.1
+    hooks:
+      - id: yamllint
+        args:
+          - --strict
+
+  - repo: https://github.com/igorshubovych/markdownlint-cli
+    rev: aa975a18c9a869648007d33864034dbc7481fe5e  # frozen: v0.42.0
+    hooks:
+      - id: markdownlint-fix
+
+  - repo: https://github.com/ComPWA/taplo-pre-commit
+    rev: 23eab0f0eedcbedebff420f5fdfb284744adc7b3  # frozen: v0.9.3
+    hooks:
+      - id: taplo-format
+      - id: taplo-lint
+
+  - repo: https://github.com/sirwart/ripsecrets
+    rev: 033ec5192b738b6712701be920cba545c2775050  # frozen: v0.1.8
+    hooks:
+      - id: ripsecrets
+
+  - repo: https://github.com/crate-ci/typos
+    rev: 515e0fc2601a0905af8ad0800975c861be1074f1  # frozen: v1.26.0
     hooks:
-      - id: ruff
+      - id: typos
+        args: []

.taplo.toml

@@ -0,0 +1,4 @@
+[formatting]
+column_width = 120
+compact_inline_tables = true
+indent_tables = true

.yamlfix.toml

@@ -0,0 +1,4 @@
+line_length = 120
+section_whitelines = 1
+sequence_style = 'block_style'
+whitelines = 1

.yamllint.yaml

@@ -0,0 +1,15 @@
+---
+extends: default
+
+ignore-from-file:
+  - .git/info/exclude
+  - .gitignore
+
+rules:
+  line-length:
+    max: 120
+    allow-non-breakable-words: true
+    allow-non-breakable-inline-mappings: true
+
+  truthy:
+    check-keys: false

Dockerfile

@@ -1,17 +1,21 @@
-FROM python:3.12-slim@sha256:babc0d450bf9ed2b369814bc2f466e53a6ea43f1201f6df4e7988751f755c52c
+FROM python:3.12-slim@sha256:032c52613401895aa3d418a4c563d2d05f993bc3ecc065c8f4e2280978acd249
 
 # Define Git SHA build argument for Sentry
 ARG git_sha="development"
 ENV GIT_SHA=$git_sha
 
-COPY requirements/requirements.txt .
-RUN python -m pip install --requirement requirements.txt
+WORKDIR /app
+
+RUN python -m pip install --no-cache-dir -U pip setuptools wheel
+RUN python -m pip install --no-cache-dir pdm
+
+COPY pyproject.toml pdm.lock ./
+RUN pdm export --prod -o requirements.txt && python -m pip install --no-cache-dir -r requirements.txt
 
-COPY pyproject.toml pyproject.toml
 COPY src/ src/
-RUN python -m pip install .
+RUN python -m pip install --no-cache-dir .
 
-RUN adduser --disabled-password loader
+RUN useradd --no-create-home --shell=/bin/bash loader
 USER loader
 
 CMD [ "python", "-m", "loader" ]

README.md

@@ -1,3 +1,3 @@
-# dragonfly-loader
+# Dragonfly Loader
 
-Automated job for loading new releases into the Mainframe
+An automated job to load new releases from the PyPI RSS feed into the [Dragonfly Mainframe](https://github.com/vipyrsec/dragonfly-mainframe).