[19.0][IMP] copier update

.github/workflows/check-version-bump.yml

@@ -0,0 +1,29 @@
+name: Check module version bump
+
+on:
+  pull_request:
+    branches:
+      - "19.0*"
+
+jobs:
+  check-version-bump:
+    runs-on: ubuntu-latest
+    name: Check module version bump
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          # HEAD is the PR merge commit, HEAD^1 the tip of the base branch
+          fetch-depth: 2
+          persist-credentials: false
+      - name: Configure git authentication
+        # Header instead of URL credentials, see test.yml
+        env:
+          TOKEN: ${{ secrets.PRIVATE_TOKEN }}
+        run: |
+          git config --global http.https://github.com/.extraheader "AUTHORIZATION: basic $(printf 'x-access-token:%s' "$TOKEN" | base64 -w0)"
+      - name: Add Noviat CI Tools to PATH
+        run: |
+          git clone https://github.com/Noviat-CI/noviat-ci-tools.git /opt/noviat-ci-tools
+          echo "/opt/noviat-ci-tools" >> $GITHUB_PATH
+      - name: Check module version bump
+        run: check_module_version_bump

.github/workflows/pre-commit.yml

@@ -8,19 +8,23 @@ on:
     branches:
       - "19.0"
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   pre-commit:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.11"
           cache: 'pip'
           cache-dependency-path: '.pre-commit-config.yaml'
       - name: Get python version
         run: echo "PY=$(python -VV | sha256sum | cut -d' ' -f1)" >> $GITHUB_ENV
-      - uses: actions/cache@v4
+      - uses: actions/cache@v6
         with:
           path: ~/.cache/pre-commit
           key: pre-commit|${{ env.PY }}|${{ hashFiles('.pre-commit-config.yaml') }}

.github/workflows/test.yml

@@ -8,12 +8,16 @@ on:
     branches:
       - "19.0"
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   unreleased-deps:
     runs-on: ubuntu-latest
     name: Detect unreleased dependencies
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - run: |
           for reqfile in requirements.txt test-requirements.txt ; do
               if [ -f ${reqfile} ] ; then
@@ -50,7 +54,7 @@ jobs:
             makepot: "true"
     services:
       postgres:
-        image: postgres:12.0
+        image: postgres:13
         env:
           POSTGRES_USER: odoo
           POSTGRES_PASSWORD: odoo
@@ -61,9 +65,14 @@ jobs:
       INSTALL_ADDONS_DIR: "/tmp/addons-merged"
       ADDITIONAL_ADDONS_DIR: "/tmp/additional-addons"
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
+      - name: Configure git authentication
+        env:
+          TOKEN: ${{ secrets.PRIVATE_TOKEN }}
+        run: |
+          git config --global http.https://github.com/.extraheader "AUTHORIZATION: basic $(printf 'x-access-token:%s' "$TOKEN" | base64 -w0)"
       - name: Set pip constraints (pyOpenSSL / cryptography)
         run: |
           cat > /tmp/constraints.txt <<'EOF'
@@ -77,15 +86,13 @@ jobs:
         run: python -m pip install git+https://github.com/odoo/upgrade-util@master
       - name: Add Noviat CI Tools to PATH
         run: |
-          git clone https://${{ secrets.PRIVATE_TOKEN }}@github.com/Noviat-CI/noviat-ci-tools.git /opt/noviat-ci-tools
+          git clone https://github.com/Noviat-CI/noviat-ci-tools.git /opt/noviat-ci-tools
           echo "/opt/noviat-ci-tools" >> $GITHUB_PATH
       - name: Clone Odoo Enterprise
         if: ${{ matrix.odoo_enterprise == 1 }}
         run : |
-          git clone https://${{ secrets.PRIVATE_TOKEN }}@github.com/odoo/enterprise.git --depth 1 -b 19.0 /opt/enterprise
+          git clone https://github.com/odoo/enterprise.git --depth 1 -b 19.0 /opt/enterprise
       - name: Clone Noviat Dependencies
-        env:
-          PRIVATE_TOKEN: ${{ secrets.PRIVATE_TOKEN }}
         run: clone_oca_dependencies_by_noviat
       - name: Create addons path
         run: |
@@ -109,21 +116,30 @@ jobs:
         run: |
           echo "server_wide_modules = web,module_change_auto_install" >> ${ODOO_RC}
           echo "ODOO_MODULES_AUTO_INSTALL_DISABLED=${{ matrix.EXCLUDE_MODULES }}" >> $GITHUB_ENV
-      - name: Inject GitHub token for Noviat orgs in test-requirements.txt
-        run: |
-          sed -i -E "s#https://github.com/(Noviat-(Projects|Generic|ARP|Internal))#https://${{ secrets.PRIVATE_TOKEN }}@github.com/\1#g" test-requirements.txt
       - name: Install addons and dependencies
         run: |
           (ADDONS_PATH=${ADDONS_PATH} ADDONS_DIR=${INSTALL_ADDONS_DIR} oca_install_addons)
+      - name: Install external dependencies of core addons (not in Odoo requirements.txt)
+        run: |
+          (ADDONS_DIR=${INSTALL_ADDONS_DIR} noviat_install_odoo_external_dependencies)
       - name: Initialize test db
         run: oca_init_test_database
       - name: Run tests
         run: oca_run_tests
       - name: Generate coverage files
+        id: coverage
         run: |
+          # oca_run_tests exits early without coverage data when there is no
+          # addon to test (e.g. a freshly scaffolded version branch).
+          if [ -z "$(oca_list_addons_to_test)" ]; then
+            echo "No addon to test, skipping coverage report."
+            exit 0
+          fi
           coverage report -m
           coverage xml -o coverage.xml
+          echo "report=true" >> "$GITHUB_OUTPUT"
       - name: Code Coverage Summary Report
+        if: steps.coverage.outputs.report == 'true'
         uses: irongut/CodeCoverageSummary@v1.3.0
         with:
           filename: 'coverage.xml'
@@ -132,7 +148,8 @@ jobs:
           output: 'both'
           hide_complexity: true
       - name: Write to Job Summary
+        if: steps.coverage.outputs.report == 'true'
         run: cat code-coverage-results.md >> $GITHUB_STEP_SUMMARY
       - name: Update .pot files
-        run: noviat_export_and_push_pot https://x-access-token:${{ secrets.PRIVATE_TOKEN }}@github.com/${{ github.repository }}
+        run: noviat_export_and_push_pot https://github.com/${{ github.repository }}
         if: ${{ matrix.makepot == 'true' && github.event_name == 'push' }}

.github/workflows/update-addons-table.yml

@@ -14,11 +14,11 @@ jobs:
   gen-addons-table:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
           fetch-depth: 0
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.11"
       - name: Install pre-commit
@@ -28,14 +28,15 @@ jobs:
         continue-on-error: true
       - name: Commit & push if changed
         env:
-          PUSH_URL: https://x-access-token:${{ secrets.PRIVATE_TOKEN }}@github.com/${{ github.repository }}.git
+          TOKEN: ${{ secrets.PRIVATE_TOKEN }}
         run: |
           if ! git diff --quiet; then
             git config user.name  "noviat-ci-bot"
             git config user.email "bot+ci@noviat.com"
             git add -A
             git commit -m "update addons table"
-            git remote set-url origin "$PUSH_URL"
+            # Header instead of URL credentials, see test.yml
+            git config http.https://github.com/.extraheader "AUTHORIZATION: basic $(printf 'x-access-token:%s' "$TOKEN" | base64 -w0)"
             git config --global --add safe.directory "$GITHUB_WORKSPACE"
             git push origin HEAD:19.0
           fi