Merging upstream version 1.4.0.

Signed-off-by: Daniel Baumann <daniel@debian.org>

.github/release.md

@@ -14,11 +14,12 @@ Also, [Github CLI](https://cli.github.com/) can be helpful and is recommended
 
 In a branch specific for this, use the `bumpver` tool.
 It is configured to update:
-* pyproject.toml
-* docs/contribution.md
-* docs/requirements-and-installation.md
+- pyproject.toml
+- docs/contribution.md
+- docs/requirements-and-installation.md
 
 For instance to bump a patch version:
+
 ```
 bumpver update --patch
 ```
@@ -54,35 +55,41 @@ This is to be executed at the top of the repo
    ```bash
    git switch -c rel/vx.x.x
    ```
+
 3. [Optional] Clean dist if required
 4. Build the package locally
 
    ```bash
    python -m build
    ```
+
 5. Check the package with `twine` (replace with your vesion)
 
     ```bash
     twine check dist/*
     ```
+
 6. Upload the package to test.pypi
 
     ```bash
     twine upload -r testpypi dist/anta-x.x.x.*
     ```
+
 7. Verify the package by installing it in a local venv and checking it installs
    and run correctly (run the tests)
 
    ```bash
    # In a brand new venv
-   pip install -i https://test.pypi.org/simple/ --extra-index-url https://pypi.org/simple --no-cache anta
+   pip install -i https://test.pypi.org/simple/ --extra-index-url https://pypi.org/simple --no-cache anta[cli]
    ```
+
 8. Push to anta repository and create a Pull Request
 
     ```bash
     git push origin HEAD
     gh pr create --title 'bump: ANTA vx.x.x'
     ```
+
 9. Merge PR after review and wait for [workflow](https://github.com/aristanetworks/anta/actions/workflows/release.yml) to be executed.
 
    ```bash
@@ -100,4 +107,5 @@ This is to be executed at the top of the repo
 
     ```bash
     anta --version
-    ```
+    ```
+

.github/workflows/code-testing.yml

@@ -1,5 +1,5 @@
 ---
-name: Linting and Testing Anta
+name: Linting and Testing ANTA
 on:
   push:
     branches:
@@ -59,24 +59,10 @@ jobs:
           pip install .
       - name: install dev requirements
         run: pip install .[dev]
-  # @gmuloc: commenting this out for now
-  #missing-documentation:
-  #  name: "Warning documentation is missing"
-  #  runs-on: ubuntu-latest
-  #  needs: [file-changes]
-  #  if: needs.file-changes.outputs.cli == 'true' && needs.file-changes.outputs.docs == 'false'
-  #  steps:
-  #    - name: Documentation is missing
-  #      uses: GrantBirki/comment@v2.0.10
-  #      with:
-  #        body: |
-  #          Please consider that documentation is missing under `docs/` folder.
-  #          You should update documentation to reflect your change, or maybe not :)
   lint-python:
     name: Check the code style
     runs-on: ubuntu-latest
     needs: file-changes
-    if: needs.file-changes.outputs.code == 'true'
     steps:
       - uses: actions/checkout@v4
       - name: Setup Python
@@ -91,7 +77,6 @@ jobs:
     name: Check typing
     runs-on: ubuntu-latest
     needs: file-changes
-    if: needs.file-changes.outputs.code == 'true'
     steps:
       - uses: actions/checkout@v4
       - name: Setup Python
@@ -119,10 +104,20 @@ jobs:
         run: pip install tox tox-gh-actions
       - name: "Run pytest via tox for ${{ matrix.python }}"
         run: tox
+      - name: Upload coverage from pytest
+        # Coverage only runs as part of 3.11.
+        if: |
+          matrix.python == '3.11'
+        uses: actions/upload-artifact@v4
+        with:
+          name: pytest-coverage
+          include-hidden-files: true
+          path: .coverage.xml
   test-python-windows:
     name: Pytest on 3.12 for windows
     runs-on: windows-2022
     needs: [lint-python, type-python]
+    if: needs.file-changes.outputs.code == 'true'
     env:
       # Required to prevent asyncssh to fail.
       USERNAME: WindowsUser
@@ -154,6 +149,7 @@ jobs:
     name: Benchmark ANTA for Python 3.12
     runs-on: ubuntu-latest
     needs: [test-python]
+    if: needs.file-changes.outputs.code == 'true'
     steps:
       - uses: actions/checkout@v4
       - name: Setup Python

.github/workflows/secret-scanner.yml

@@ -1,15 +0,0 @@
-# Secret-scanner workflow from Arista Networks.
-on:
-  pull_request:
-    types: [synchronize]
-  push:
-    branches:
-      - main
-name: Secret Scanner (go/secret-scanner)
-jobs:
-  scan_secret:
-    name: Scan incoming changes
-    runs-on: ubuntu-latest
-    steps: 
-      - name: Run scanner
-        uses: aristanetworks/secret-scanner-service-public@main

.github/workflows/sonar.yml

@@ -1,15 +1,9 @@
 ---
 name: Analysis with Sonarlint and publish to SonarCloud
 on:
-  push:
-    branches:
-      - main
-  # Need to do this to be able to have coverage on PR across forks.
-  pull_request_target:
-
-# TODO this can be made better by running only coverage, it happens that today
-# in tox gh-actions we have configured 3.11 to run the report side in
-# pyproject.toml
+  workflow_run:
+    workflows: ["Linting and Testing ANTA"]
+    types: [completed]
 
 jobs:
   sonarcloud:
@@ -19,26 +13,50 @@ jobs:
     steps:
       - uses: actions/checkout@v4
         with:
-          ref: ${{ github.event.pull_request.head.sha }}
+          ref: ${{ github.event.workflow_run.head_sha }}
           fetch-depth: 0 # Shallow clones should be disabled for a better relevancy of analysis
-      - name: Setup Python
-        uses: actions/setup-python@v5
+      - name: Download coverage from unit tests
+        continue-on-error: true
+        uses: actions/download-artifact@v4
         with:
-          python-version: 3.11
-      - name: Install dependencies
-        run: pip install tox tox-gh-actions
-      - name: "Run pytest via tox for ${{ matrix.python }}"
-        run: tox
-      - name: SonarCloud Scan
-        uses: SonarSource/sonarqube-scan-action@v5.0.0
+          name: pytest-coverage
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          run-id: ${{ github.event.workflow_run.id }}
+          merge-multiple: true
+
+      - name: Get PR context
+        # Source: https://github.com/orgs/community/discussions/25220#discussioncomment-11316244
+        id: pr-context
+        if: github.event.workflow_run.event == 'pull_request'
+        env:
+          # Token required for GH CLI:
+          GH_TOKEN: ${{ github.token }}
+          # Best practice for scripts is to reference via ENV at runtime. Avoid using the expression syntax in the script content directly:
+          PR_TARGET_REPO: ${{ github.repository }}
+          # If the PR is from a fork, prefix it with `<owner-login>:`, otherwise only the PR branch name is relevant:
+          PR_BRANCH: |-
+            ${{
+              (github.event.workflow_run.head_repository.owner.login != github.event.workflow_run.repository.owner.login)
+                && format('{0}:{1}', github.event.workflow_run.head_repository.owner.login, github.event.workflow_run.head_branch)
+                || github.event.workflow_run.head_branch
+            }}
+        # Query the PR number by repo + branch, then assign to step output:
+        run: |
+          gh pr view --repo "${PR_TARGET_REPO}" "${PR_BRANCH}" \
+             --json 'number,baseRefName' --jq '"number=\(.number)\nbase_ref=\(.baseRefName)"' \
+             >> "${GITHUB_OUTPUT}"
+          echo "pr_branch=${PR_BRANCH}" >> "${GITHUB_OUTPUT}"
+
+      - name: SonarQube Scan
+        uses: SonarSource/sonarqube-scan-action@v5.2.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
         with:
           # Using ACTION_STEP_DEBUG to trigger verbose when debugging in Github Action
           args: >
-            -Dsonar.scm.revision=${{ github.event.pull_request.head.sha }}
-            -Dsonar.pullrequest.key=${{ github.event.number }}
-            -Dsonar.pullrequest.branch=${{ github.event.pull_request.head.ref }}
-            -Dsonar.pullrequest.base=${{ github.event.pull_request.base.ref }}
+            -Dsonar.scm.revision=${{ github.event.workflow_run.head_sha }}
+            -Dsonar.pullrequest.key=${{ steps.pr-context.outputs.number }}
+            -Dsonar.pullrequest.branch=${{ steps.pr-context.outputs.pr_branch }}
+            -Dsonar.pullrequest.base=${{ steps.pr-context.outputs.base_ref }}
             -Dsonar.verbose=${{ secrets.ACTIONS_STEP_DEBUG }}