Release 3.4.3a2

.github/workflows/build_tests.yml

@@ -1,42 +1,16 @@
 name: Run Build Tests
 on:
   push:
-    branches:
-      - master
+    branches: [master]
   pull_request:
-    branches:
-      - dev
-    paths:
-      - 'requirements/**'
-      - 'setup.py'
+    branches: [dev]
   workflow_dispatch:
 
 jobs:
   build_tests:
-    strategy:
-      max-parallel: 2
-      matrix:
-        python-version: ["3.10", "3.11"]
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Setup Python
-        uses: actions/setup-python@v5
-        with:
-          python-version: ${{ matrix.python-version }}
-      - name: Install Build Tools
-        run: |
-          python -m pip install build wheel uv
-      - name: Install System Dependencies
-        run: |
-          sudo apt-get update
-          sudo apt install python3-dev swig libssl-dev libfann-dev portaudio19-dev libpulse-dev python3-fann2
-      - name: Build Source Packages
-        run: |
-          python setup.py sdist
-      - name: Build Distribution Packages
-        run: |
-          python setup.py bdist_wheel
-      - name: Install package
-        run: |
-          uv pip install --system .[mycroft,lgpl,plugins,skills-essential,skills-extra,skills-audio,skills-gui,skills-internet,skills-media,skills-desktop,skills-en,skills-ca,skills-pt]
+    uses: OpenVoiceOS/gh-automations/.github/workflows/build-tests.yml@dev
+    secrets: inherit
+    with:
+      system_deps: 'swig libssl-dev portaudio19-dev libpulse-dev'
+      install_extras: 'mycroft,plugins,skills-essential,test'
+      test_path: 'test/unittests'

.github/workflows/channel_compat.yml

@@ -0,0 +1,58 @@
+name: Channel Compat
+
+# Run the unit tests against the package versions an OVOS distro release
+# channel pins, instead of against current dev siblings.
+#
+# The distro publishes one constraints file per channel, fetched live by the
+# reusable workflow and uploaded as an artifact. As of writing, `stable` pins
+# ovos-workshop 3.4.x / ovos-bus-client 1.3.x / ovos-padatious 1.4.x and
+# `testing` pins ovos-workshop 7.0.x — both far below dev. A change can be green
+# on dev and still break every device on the fleet; this job is the gate for
+# that.
+#
+# This is the third layer of the compat program:
+#
+#   boundary pins  where did the behavior change? (test/backcompat in
+#                  ovos-core and ovos-test-harness)
+#   channels       what does the fleet run today? (this file)
+#   dev edge       where is the stack going? (build_tests.yml, ovoscope.yml)
+#
+# soft_fail is TRUE for now. A channel is behind dev by construction, so
+# the first runs are expected to fail a pile of tests — that is the finding, not
+# a broken job. TURN soft_fail OFF once the baseline is established, the same
+# way ovos-test-harness did it: check in a per-channel known-gap file, strict-
+# xfail exactly those node ids, and let anything else be red.
+# See https://github.com/OpenVoiceOS/ovos-test-harness (test/channel_gaps/).
+
+on:
+  pull_request:
+    branches: [dev]
+  push:
+    branches: [dev]
+  schedule:
+    # The channels move on the distro's schedule, not on this repo's.
+    - cron: "0 6 * * 1"
+  workflow_dispatch:
+
+jobs:
+  channel-compat:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - channel: stable
+            url: https://raw.githubusercontent.com/OpenVoiceOS/OpenVoiceOS/main/constraints-stable.txt
+          - channel: testing
+            url: https://raw.githubusercontent.com/OpenVoiceOS/OpenVoiceOS/main/constraints-testing.txt
+    name: ${{ matrix.channel }}
+    uses: OpenVoiceOS/gh-automations/.github/workflows/channel-compat.yml@dev
+    secrets: inherit
+    with:
+      channel_url: ${{ matrix.url }}
+      channel_name: ${{ matrix.channel }}
+      # GitHub rejects `continue-on-error` on a job that calls a reusable
+      # workflow, so the advisory mode is an input instead.
+      soft_fail: true
+      test_path: 'test/unittests'
+      system_deps: 'swig libssl-dev portaudio19-dev libpulse-dev libfann-dev'
+      install_extras: 'mycroft,plugins,skills-essential,lgpl,test'

.github/workflows/coverage.yml

@@ -1,36 +1,20 @@
-# .github/workflows/coverage.yml
-name: Post coverage comment
+name: Coverage Report
 
 on:
-  workflow_run:
-    workflows: ["Run Tests"]
-    types:
-      - completed
+  push:
+    branches: [dev]
+  pull_request:
+    branches: [dev]
+  workflow_dispatch:
 
 jobs:
-  test:
-    name: Run tests & display coverage
-    runs-on: ubuntu-latest
-    if: github.event.workflow_run.event == 'pull_request' && github.event.workflow_run.conclusion == 'success'
-    permissions:
-      # Gives the action the necessary permissions for publishing new
-      # comments in pull requests.
-      pull-requests: write
-      # Gives the action the necessary permissions for editing existing
-      # comments (to avoid publishing multiple comments in the same PR)
-      contents: write
-      # Gives the action the necessary permissions for looking up the
-      # workflow that launched this workflow, and download the related
-      # artifact that contains the comment to be published
-      actions: read
-    steps:
-      # DO NOT run actions/checkout here, for security reasons
-      # For details, refer to https://securitylab.github.com/research/github-actions-preventing-pwn-requests/
-      - name: Post comment
-        uses: py-cov-action/python-coverage-comment-action@v3
-        with:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          GITHUB_PR_RUN_ID: ${{ github.event.workflow_run.id }}
-          # Update those if you changed the default values:
-          # COMMENT_ARTIFACT_NAME: python-coverage-comment-action
-          # COMMENT_FILENAME: python-coverage-comment-action.txt
+  coverage:
+    uses: OpenVoiceOS/gh-automations/.github/workflows/coverage.yml@dev
+    secrets: inherit
+    with:
+      system_deps: 'python3-dev swig libssl-dev portaudio19-dev libpulse-dev'
+      install_extras: '.[mycroft,plugins,skills-essential,test]'
+      test_path: 'test/unittests'
+      coverage_source: 'ovos_core'
+      deploy_pages: true
+      gh_pages_branch: 'gh-pages'

.github/workflows/docs_check.yml

@@ -0,0 +1,13 @@
+name: Docs Check
+
+on:
+  pull_request:
+    branches: [dev]
+  workflow_dispatch:
+
+jobs:
+  docs_check:
+    uses: OpenVoiceOS/gh-automations/.github/workflows/docs-check.yml@dev
+    secrets: inherit
+    with:
+      pr_comment: true

.github/workflows/license_tests.yml

@@ -10,35 +10,8 @@ on:
 
 jobs:
   license_tests:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Setup Python
-        uses: actions/setup-python@v5
-        with:
-          python-version: '3.11'
-      - name: Install Build Tools
-        run: |
-          python -m pip install build wheel uv
-      - name: Install System Dependencies
-        run: |
-          sudo apt-get update
-          sudo apt install python3-dev swig libssl-dev libfann-dev portaudio19-dev libpulse-dev
-      - name: Install core repo
-        run: |
-          uv pip install --system .[mycroft,lgpl,skills-essential]
-      - name: Get explicit and transitive dependencies
-        run: |
-          uv pip freeze > requirements-all.txt
-      - name: Check python
-        id: license_check_report
-        uses: pilosus/action-pip-license-checker@v0.5.0
-        with:
-          requirements: 'requirements-all.txt'
-          fail: 'Copyleft,Other,Error'
-          fails-only: true
-          exclude: '^(precise-runner|fann2|ovos-adapt-parser|ovos-padatious|tqdm|bs4|sonopy|caldav|recurring-ical-events|x-wr-timezone|zeroconf|mutagen|attrs).*'
-          exclude-license: '^(Mozilla).*$'
-      - name: Print report
-        if: ${{ always() }}
-        run: echo "${{ steps.license_check_report.outputs.report }}"
+    uses: OpenVoiceOS/gh-automations/.github/workflows/license-check.yml@dev
+    with:
+      install_extras: '[mycroft,plugins,skills-essential]'
+      system_deps: 'portaudio19-dev libpulse-dev'
+      exclude_packages: '^(precise-runner|ovos-adapt-parser|tqdm|bs4|sonopy|caldav|recurring-ical-events|x-wr-timezone|zeroconf|mutagen|attrs|phoonnx).*'

.github/workflows/locale_check.yml

@@ -0,0 +1,14 @@
+name: Locale Build Check
+
+on:
+  pull_request:
+    branches: [dev]
+  workflow_dispatch:
+
+jobs:
+  locale_check:
+    uses: OpenVoiceOS/gh-automations/.github/workflows/locale-check.yml@dev
+    secrets: inherit
+    with:
+      locale_path: 'ovos_core/intent_services/locale'
+      pr_comment: true

.github/workflows/opm_check.yml

@@ -0,0 +1,17 @@
+name: OPM Plugin Check
+on:
+  push:
+    branches: [master]
+  pull_request:
+    branches: [dev]
+  workflow_dispatch:
+
+jobs:
+  opm_check:
+    uses: OpenVoiceOS/gh-automations/.github/workflows/opm-check.yml@dev
+    secrets: inherit
+    with:
+      system_deps: 'swig libssl-dev portaudio19-dev libpulse-dev'
+      install_extras: 'mycroft,plugins,skills-essential,test'
+      python_version: '3.11'
+      plugin_type: 'pipeline'

.github/workflows/ovoscope.yml

@@ -0,0 +1,25 @@
+name: Ovoscope End-to-End Tests
+
+on:
+  push:
+    branches: [dev]
+  pull_request:
+    branches: [dev]
+  workflow_dispatch:
+
+jobs:
+  ovoscope:
+    uses: OpenVoiceOS/gh-automations/.github/workflows/ovoscope.yml@dev
+    secrets: inherit
+    with:
+      runner: "ubuntu-latest"
+      python_version: "3.11"
+      system_deps: "python3-dev swig libssl-dev portaudio19-dev libpulse-dev"
+      install_extras: "test"
+      test_path: "test/end2end/"
+      require_adapt: true
+      require_padatious: true
+      bus_coverage: true
+      bus_coverage_include: ""
+      bus_coverage_exclude: "^Thread-|^intents$|^skills$|^__core__$"
+      pr_comment: true

.github/workflows/pipaudit.yml

@@ -1,38 +1,22 @@
 name: Run PipAudit
+
 on:
   push:
     branches:
       - master
       - dev
+  pull_request:
+    branches:
+      - dev
   workflow_dispatch:
 
 jobs:
-  build_tests:
-    strategy:
-      max-parallel: 2
-      matrix:
-        python-version: ["3.10", "3.11"]
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Setup Python
-        uses: actions/setup-python@v5
-        with:
-          python-version: ${{ matrix.python-version }}
-      - name: Install Build Tools
-        run: |
-          python -m pip install build wheel uv
-      - name: Install System Dependencies
-        run: |
-          sudo apt-get update
-          sudo apt install python3-dev swig libssl-dev
-      - name: Install package
-        run: |
-          uv pip install --system .[skills-essential]
-      - uses: pypa/gh-action-pip-audit@v1.0.0
-        with:
-          # Ignore setuptools vulnerability we can't do much about
-          # Ignore numpy vulnerability affecting latest version for Py3.7
-          ignore-vulns: |
-            GHSA-r9hx-vwmv-q579
-            GHSA-fpfv-jqm9-f5jm
+  pip_audit:
+    uses: OpenVoiceOS/gh-automations/.github/workflows/pip-audit.yml@dev
+    secrets: inherit
+    with:
+      system_deps: 'swig libssl-dev'
+      install_extras: '[skills-essential]'
+      ignore_vulns: |
+        GHSA-r9hx-vwmv-q579
+        GHSA-fpfv-jqm9-f5jm