update and improve GitHub Actions workflows

.github/workflows/build.yml

@@ -0,0 +1,41 @@
+# this workflow builds the package and, only when triggered by a release, publishes it to PyPI
+name: build
+
+# events that trigger this workflow to run
+on:
+  release:
+    types: [ released ]
+  pull_request:
+  workflow_dispatch:
+
+# only allow one instance of this workflow to run per commit or ref; cancel in-progress ones
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+# these jobs use the OpenAstronomy reusable build / publish workflow
+jobs:
+  build:
+    uses: OpenAstronomy/github-actions-workflows/.github/workflows/publish_pure_python.yml@v1
+    with:
+      # only upload wheels to PyPI if the triggering event was a release
+      upload_to_pypi: ${{ (github.event_name == 'release') && (github.event.action == 'released') }}
+    secrets:
+      pypi_token: ${{ secrets.PYPI_PASSWORD_STSCI_MAINTAINER }}
+
+  # use the following block instead if your Python package uses C extensions
+
+  #  uses: OpenAstronomy/github-actions-workflows/.github/workflows/publish.yml@v1
+  #  with:
+  #    # only upload wheels to PyPI if the triggering event was a release
+  #    upload_to_pypi: ${{ (github.event_name == 'release') && (github.event.action == 'released') }}
+  #    targets: |
+  #      # Linux wheels
+  #      - cp3*-manylinux_x86_64
+  #      # MacOS wheels
+  #      - cp3*-macosx_x86_64
+  #      # Until we have arm64 runners, we can't automatically test arm64 wheels
+  #      - cp3*-macosx_arm64
+  #    sdist: true
+  #  secrets:
+  #    pypi_token: ${{ secrets.PYPI_PASSWORD_STSCI_MAINTAINER }}

.github/workflows/tests.yml

@@ -0,0 +1,42 @@
+# this workflow uses Tox to configure and run reproducible test environments (defined in `tox.ini`)
+name: tests
+
+# events that trigger this workflow to run
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+
+# only allow one instance of this workflow to run per commit or ref; cancel in-progress ones
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+# these jobs use the OpenAstronomy reusable Tox workflow, which runs Tox envs
+jobs:
+  # run check toxenvs
+  check:
+    uses: OpenAstronomy/github-actions-workflows/.github/workflows/tox.yml@v1
+    with:
+      default_python: "3.12"
+      envs: |
+        - linux: check-style
+        - linux: check-security
+  # run test toxenvs
+  test:
+    uses: OpenAstronomy/github-actions-workflows/.github/workflows/tox.yml@v1
+    with:
+      envs: |
+        - linux: py39-oldestdeps-cov-parallel
+          pytest-results-summary: true
+        - linux: py39-parallel
+        - linux: py310-parallel
+        - linux: py311-parallel
+          pytest-results-summary: true
+        - macos: py311-parallel
+          pytest-results-summary: true
+        - linux: py311-cov-parallel
+          coverage: codecov
+          pytest-results-summary: true
+        - linux: py312-parallel

.github/workflows/tests_scheduled.yml

@@ -0,0 +1,24 @@
+# this workflow uses Tox to configure and run reproducible test environments (defined in `tox.ini`)
+name: tests_scheduled
+
+# events that trigger this workflow to run
+on:
+  schedule:
+    # run at 9am UTC on Mondays
+    - cron: '0 9 * * 1'
+
+# only allow one instance of this workflow to run per commit or ref; cancel in-progress ones
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+# these jobs use the OpenAstronomy reusable Tox workflow, which runs Tox envs
+jobs:
+  # run check toxenvs
+  check:
+    uses: OpenAstronomy/github-actions-workflows/.github/workflows/tox.yml@v1
+    with:
+      default_python: "3.12"
+      envs: |
+        # Testing links in the documentation is a good example of something to run on a schedule to catch links that stop working for some reason.
+        - linux: check-docs-links

tox.ini

@@ -1,93 +1,81 @@
 [tox]
-envlist =
-    py{37,38,39}-test{,-oldestdeps,-devdeps}{,-cov}
-    linkcheck
-    codestyle
-    securityaudit
-    pep517
-requires =
-    setuptools >= 30.3.0
-    pip >= 19.3.1
-isolated_build = true
+env_list =
+    check-{style,security,docs-links}
+    py3{9,10,11}{,-oldestdeps,-devdeps}{,-cov}-parallel
+    build-docs
 
-[testenv]
-# Suppress display of matplotlib plots generated during docs build, if any
-setenv =
-    MPLBACKEND=agg
-    devdeps: PIP_EXTRA_INDEX_URL = https://pypi.anaconda.org/astropy/simple https://pypi.anaconda.org/scientific-python-nightly-wheels/simple
+[testenv:check-style]
+description = check code style
+skip_install = true
+deps =
+    ruff
+commands =
+    ruff . {posargs}
 
-# Pass through the following environment variables which may be needed for the CI
-passenv = HOME WINDIR LC_ALL LC_CTYPE CC CI
+[testenv:check-security]
+description = run bandit to check security compliance
+skip_install = true
+deps =
+    bandit>=1.7
+commands =
+    bandit -r packagename -c bandit.yaml
 
-# Run the tests in a temporary directory to make sure that we don't import
-# this package from the source tree
-changedir = .tmp/{envname}
+[testenv:check-docs-links]
+description = check the links in the HTML docs
+change_dir = docs
+extras = 
+    docs
+commands =
+    sphinx-build -W -b linkcheck . _build/html
 
-# tox environments are constructed with so-called 'factors' (or terms)
-# separated by hyphens, e.g. test-devdeps-cov. Lines below starting with factor:
-# will only take effect if that factor is included in the environment name. To
-# see a list of example environments that can be run, along with a description,
-# run:
-#
-#     tox -l -v
-#
+[testenv]
 description =
     run tests
-    oldestdeps: with the oldest supported version of key dependencies
-    devdeps: with the latest developer version of key dependencies
-    cov: and test coverage
-
-# The following provides some specific pinnings for key packages
+    devdeps: with the latest developer version of third-party dependencies
+    oldestdeps: with the oldest supported versions of required dependencies
+    pyargs: with `--pyargs` on installed package
+    warnings: treating warnings as errors
+    cov: with coverage
+    parallel: using parallel processing
+# Pass through the following environment variables which may be needed for the CI
+pass_env =
+    TOXENV
+    CI
+    CODECOV_*
+    HOME
+    CRDS_*
+set_env =
+    devdeps: PIP_EXTRA_INDEX_URL = https://pypi.anaconda.org/astropy/simple https://pypi.anaconda.org/scientific-python-nightly-wheels/simple
+extras =
+    test
 deps =
-
-    cov: coverage
-    cov: pytest-cov
-
-    oldestdeps: numpy==1.17.*
-    oldestdeps: astropy==4.0.3
-
+    xdist: pytest-xdist
+    oldestdeps: minimum_dependencies
+package =
+    # necessary so that C extensions are available for import; see https://github.com/spacetelescope/jwst/issues/7386#issuecomment-1344371482
+    !pyargs: editable
+    pyargs: wheel
+commands_pre =
+    oldestdeps: minimum_dependencies packagename --filename requirements-min.txt
+    oldestdeps: pip install -r requirements-min.txt
     devdeps: numpy>=0.0.dev0
     devdeps: astropy>=0.0.dev0
-
-# The following indicates which extras_require from setup.cfg will be installed
-extras =
-    test
-
-commands =
     pip freeze
-    !cov: pytest --pyargs packagename {toxinidir}/docs {posargs}
-    cov: pytest --pyargs packagename {toxinidir}/docs --cov packagename --cov-config={toxinidir}/setup.cfg {posargs}
-    cov: coverage xml -o {toxinidir}/coverage.xml
-
-[testenv:linkcheck]
-changedir = docs
-description = check the links in the HTML docs
-extras = docs
 commands =
-    pip freeze
-    sphinx-build -W -b linkcheck . _build/html
-
-[testenv:codestyle]
-skip_install = true
-changedir = .
-description = check code style with flake8
-deps = flake8
-commands = flake8 packagename --count
-
-[testenv:securityaudit]
-skip_install = true
-changedir = .
-description = security audit with bandit
-deps = bandit
-commands = bandit -r packagename -c .bandit.yaml
+    pytest \
+    cov: --cov . --cov-report xml --cov-report term-missing \
+    warnings: -W error \
+    xdist: -n auto \
+    pyargs: {toxinidir}/docs --pyargs jwst \
+    {posargs}
 
-[testenv:pep517]
-skip_install = true
-changedir = .
-description = PEP 517
-deps =
-    build
-    twine
+[testenv:build-docs]
+description = invoke sphinx-build to build the HTML docs
+set_env =
+    # Suppress display of matplotlib plots generated during docs build, if any
+    MPLBACKEND=agg
+extras = 
+    docs
 commands =
-    python -m build --sdist .
-    twine check dist/*
+    sphinx-build -W docs docs/_build
+