Background Prep for v0.10.0 work

.env.example

@@ -0,0 +1,25 @@
+POSTGRES_USER=username
+POSTGRES_PASSWORD=password
+POSTGRES_DB=postgis
+
+PGUSER=username
+PGPASSWORD=password
+PGDATABASE=postgis
+PGHOST=localhost
+PGPORT=5439
+
+DOCKER_BUILDKIT=1
+BUILDKIT_INLINE_CACHE=1
+
+# Host-script defaults.
+PGSTAC_BUILD_POLICY=always
+PGSTAC_FAST=0
+PGSTAC_WATCH=0
+PGSTAC_STRICT=1
+
+# Migration helper defaults.
+# PGSTAC_VERSION=0.9.11
+# PGSTAC_FROM_VERSION=0.9.10
+# PGSTAC_TO_VERSION=0.9.11
+# PGSTAC_OVERWRITE=0
+# PGSTAC_DEBUG=0

.github/dependabot.yml

@@ -5,11 +5,50 @@ updates:
     schedule:
       interval: "weekly"
       day: "monday"
+    open-pull-requests-limit: 5
     groups:
-      minor-and-patch:
+      actions-all:
         applies-to: version-updates
         patterns:
           - "*"
-        update-types:
-          - "minor"
-          - "patch"
+
+  - package-ecosystem: "docker"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 5
+    groups:
+      docker-base-images:
+        applies-to: version-updates
+        patterns:
+          - "*"
+
+  - package-ecosystem: "pip"
+    directory: "/src/pypgstac"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 5
+    groups:
+      python-dev-tooling:
+        applies-to: version-updates
+        patterns:
+          - "ruff"
+          - "ty"
+          - "pre-commit"
+          - "types-*"
+      python-runtime:
+        applies-to: version-updates
+        patterns:
+          - "cachetools"
+          - "fire"
+          - "hydraters"
+          - "orjson"
+          - "plpygis"
+          - "pydantic"
+          - "python-dateutil"
+          - "smart-open"
+          - "tenacity"
+          - "version-parser"
+          - "psycopg*"

.github/instructions/scripts.instructions.md

@@ -7,5 +7,6 @@ applyTo: "scripts/**"
 See CLAUDE.md "Development Workflow" for usage. All scripts require the Docker compose environment.
 
 - `runinpypgstac` is the foundation — most scripts delegate to it
+- `scripts/container-scripts/` contains the in-container script payload copied into the pypgstac image; keep host wrappers in `scripts/`
 - `stageversion` modifies version files AND generates migrations — see CLAUDE.md "Migration Process"
 - DO NOT run `stageversion` without understanding its side effects

.github/workflows/continuous-integration.yml

@@ -5,6 +5,9 @@ on:
     branches:
       - main
   pull_request:
+  workflow_dispatch:
+  schedule:
+    - cron: '23 4 * * 0'
 
 env:
   REGISTRY: ghcr.io
@@ -18,14 +21,14 @@ jobs:
     permissions:
       pull-requests: read
     outputs:
-      pgdocker: ${{ steps.check.outputs.pgtag }}
+      pgtagprefix: ${{ steps.check.outputs.pgtagprefix }}
       buildpgdocker: ${{ steps.check.outputs.buildpg }}
       pyrustdocker: ${{ steps.check.outputs.pytag }}
       buildpyrustdocker: ${{ steps.check.outputs.buildpy }}
 
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: dorny/paths-filter@4512585405083f25c027a35db413c2b3b9006d50 # v2
+      - uses: dorny/paths-filter@6852f92c20ea7fd3b0c25de3b5112db3a98da050 # v3
         id: filter
         with:
           filters: |
@@ -37,19 +40,32 @@ jobs:
         run: |
           buildpg=false;
           ref=$(echo ${GITHUB_HEAD_REF:-${GITHUB_REF#refs/heads/}} | tr / _);
-          [[ "${{ steps.filter.outputs.pgstac }}" == "true" ]] && buildpg=true || ref=main;
-          echo "pgtag=${{ env.REGISTRY }}/${GITHUB_REPOSITORY_OWNER}/pgstac-postgres:$ref" >>$GITHUB_OUTPUT;
+          pgref=$ref;
+          [[ "${{ steps.filter.outputs.pgstac }}" == "true" ]] && buildpg=true || pgref=main;
+          if [[ "${{ github.event_name }}" == "schedule" || "${{ github.event_name }}" == "workflow_dispatch" ]]; then
+            buildpg=true;
+            pgref=main;
+          fi
+          echo "pgtagprefix=${{ env.REGISTRY }}/${GITHUB_REPOSITORY_OWNER}/pgstac-postgres:$pgref" >>$GITHUB_OUTPUT;
           echo "buildpg=$buildpg" >>$GITHUB_OUTPUT;
           buildpy=false;
-          [[ "${{ steps.filter.outputs.pypgstac }}" == "true" ]] && buildpy=true || ref=main;
-          echo "pytag=${{ env.REGISTRY }}/${GITHUB_REPOSITORY_OWNER}/pgstac-pyrust:$ref" >>$GITHUB_OUTPUT;
+          pyref=$ref;
+          [[ "${{ steps.filter.outputs.pypgstac }}" == "true" ]] && buildpy=true || pyref=main;
+          if [[ "${{ github.event_name }}" == "schedule" || "${{ github.event_name }}" == "workflow_dispatch" ]]; then
+            buildpy=true;
+            pyref=main;
+          fi
+          echo "pytag=${{ env.REGISTRY }}/${GITHUB_REPOSITORY_OWNER}/pgstac-pyrust:$pyref" >>$GITHUB_OUTPUT;
           echo "buildpy=$buildpy" >>$GITHUB_OUTPUT;
 
   # This builds a base postgres image that has everything installed to be able to run pgstac. This image does not have pgstac itself installed.
   buildpg:
     name: Build and push base postgres image
     runs-on: ubuntu-latest
     needs: [changes]
+    strategy:
+      matrix:
+        pg_major: [16, 17, 18]
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
@@ -60,14 +76,16 @@ jobs:
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
       - name: Build and Push Base Postgres
-        if: ${{ needs.changes.outputs.buildpgdocker == 'true' }}
-        uses: docker/build-push-action@0a97817b6ade9f46837855d676c4cca3a2471fc9 # v4
+        if: ${{ needs.changes.outputs.buildpgdocker == 'true' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' }}
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
         with:
           platforms: linux/amd64,linux/arm64
           context: .
           target: pgstacbase
           file: docker/pgstac/Dockerfile
-          tags: ${{ needs.changes.outputs.pgdocker }}
+          build-args: |
+            PG_MAJOR=${{ matrix.pg_major }}
+          tags: ${{ needs.changes.outputs.pgtagprefix }}-pg${{ matrix.pg_major }}
           push: true
           cache-from: type=gha
           cache-to: type=gha, mode=max
@@ -86,8 +104,8 @@ jobs:
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
       - name: Build and Push Base pyrust
-        if: ${{ needs.changes.outputs.buildpyrustdocker == 'true' }}
-        uses: docker/build-push-action@0a97817b6ade9f46837855d676c4cca3a2471fc9 # v4
+        if: ${{ needs.changes.outputs.buildpyrustdocker == 'true' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' }}
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
         with:
           platforms: linux/amd64,linux/arm64
           context: .
@@ -104,6 +122,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
+        pg_major: [16, 17, 18]
         flags:
           - ""
           - "--resolution lowest-direct"
@@ -115,30 +134,38 @@ jobs:
         PGHOST: postgres
         PGDATABASE: postgres
         PGUSER: postgres
+        UV_CACHE_DIR: /tmp/.uv-cache
     services:
       postgres:
         env:
           POSTGRES_PASSWORD: postgres
-        image: ${{ needs.changes.outputs.pgdocker }}
+        image: ${{ needs.changes.outputs.pgtagprefix }}-pg${{ matrix.pg_major }}
         options: >-
           --health-cmd pg_isready
           --health-interval 10s
           --health-timeout 5s
           --health-retries 5
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - name: Ensure PostgreSQL 17 client tools
+      - name: Ensure PostgreSQL client tools
         run: |
           apt-get update
-          apt-get install -y --no-install-recommends postgresql-client-17
+          pg_client_pkg="postgresql-client-${{ matrix.pg_major }}"
+          if apt-cache show "$pg_client_pkg" >/dev/null 2>&1; then
+            apt-get install -y --no-install-recommends "$pg_client_pkg"
+          else
+            apt-get install -y --no-install-recommends postgresql-client
+          fi
       - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
       - name: Install pypgstac
         working-directory: /__w/pgstac/pgstac/src/pypgstac
-        run: uv pip install ${{ matrix.flags }} .[dev,test,psycopg]
-        env:
-          UV_SYSTEM_PYTHON: 1
-      - name: Run tests
-        working-directory: /__w/pgstac/pgstac/docker/pypgstac/bin
         run: |
-          export PATH=/opt/docker/pypgstac/bin:$PATH
-          ./test
+          export UV_CACHE_DIR=/tmp/.uv-cache
+          export XDG_CACHE_HOME=/tmp/.cache
+          mkdir -p "$UV_CACHE_DIR" "$XDG_CACHE_HOME"
+          uv --cache-dir "$UV_CACHE_DIR" venv /tmp/ci-venv
+          uv --cache-dir "$UV_CACHE_DIR" pip install --python /tmp/ci-venv/bin/python ${{ matrix.flags }} .[dev,test,psycopg]
+          echo "/tmp/ci-venv/bin" >> "$GITHUB_PATH"
+      - name: Run tests
+        working-directory: /__w/pgstac/pgstac
+        run: scripts/container-scripts/test

.github/workflows/release.yml

@@ -42,11 +42,11 @@ jobs:
 
       - name: Extract metadata (tags, labels) for Docker
         id: meta
-        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # 98669ae865ea3cffbcbaa878cf57c20bbf1c6c38
+        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-postgres
       - name: Build and Push Base Postgres
-        uses: docker/build-push-action@0a97817b6ade9f46837855d676c4cca3a2471fc9 # v4
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
         with:
           platforms: linux/amd64,linux/arm64
           context: .
@@ -79,11 +79,11 @@ jobs:
 
       - name: Extract metadata (tags, labels) for Docker
         id: meta
-        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # 98669ae865ea3cffbcbaa878cf57c20bbf1c6c38
+        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
       - name: Build and Push Base Postgres
-        uses: docker/build-push-action@0a97817b6ade9f46837855d676c4cca3a2471fc9 # v4
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
         with:
           platforms: linux/amd64,linux/arm64
           context: .
@@ -115,11 +115,11 @@ jobs:
 
       - name: Extract metadata (tags, labels) for Docker
         id: meta
-        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # 98669ae865ea3cffbcbaa878cf57c20bbf1c6c38
+        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-pyrust
       - name: Build and Push Base Postgres
-        uses: docker/build-push-action@0a97817b6ade9f46837855d676c4cca3a2471fc9 # v4
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
         with:
           platforms: linux/amd64,linux/arm64
           context: .
@@ -151,11 +151,11 @@ jobs:
 
       - name: Extract metadata (tags, labels) for Docker
         id: meta
-        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # 98669ae865ea3cffbcbaa878cf57c20bbf1c6c38
+        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-pypgstac
       - name: Build and Push Base Postgres
-        uses: docker/build-push-action@0a97817b6ade9f46837855d676c4cca3a2471fc9 # v4
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
         with:
           platforms: linux/amd64,linux/arm64
           context: .
@@ -167,6 +167,40 @@ jobs:
           cache-from: type=gha
           cache-to: type=gha, mode=max
 
+  buildpypgstacruntime:
+    name: Build and push pypgstac runtime image
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3
+        with:
+          image: tonistiigi/binfmt:qemu-v7.0.0-28
+      - uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+      - name: Log in to the Container registry
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract metadata (tags, labels) for Docker
+        id: meta
+        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-pypgstac-runtime
+      - name: Build and Push pypgstac runtime
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
+        with:
+          platforms: linux/amd64,linux/arm64
+          context: .
+          target: pypgstac-runtime
+          file: docker/pypgstac/Dockerfile
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          push: true
+          cache-from: type=gha
+          cache-to: type=gha, mode=max
+
   releasetopypi:
     name: Release
     runs-on: ubuntu-latest

.gitignore

@@ -12,4 +12,7 @@ src/pypgstac/python/pypgstac/*.so
 .vscode
 .ipynb_checkpoints
 .venv
-.pytest_cache
+.pytest_cache
+.plans/
+.env
+src/pgstacrust/target/

.pre-commit-config.yaml

@@ -2,7 +2,7 @@
 # See https://pre-commit.com/hooks.html for more hooks
 repos:
 -   repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v4.4.0
+    rev: v5.0.0
     hooks:
     -   id: trailing-whitespace
     -   id: check-yaml
@@ -17,17 +17,6 @@ repos:
     -   id: check-executables-have-shebangs
     -   id: check-symlinks
 
-
--   repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: 'v0.8.2'
-    hooks:
-    -   id: ruff
-        files: src/pypgstac\/.*\.py$
-        args: [--fix, --exit-non-zero-on-fix]
-    -   id: ruff-format
-        files: src/pypgstac\/.*\.py$
-
-
 -   repo: local
     hooks:
     -   id: dockerbuild
@@ -55,7 +44,7 @@ repos:
         pass_filenames: false
         verbose: true
         fail_fast: true
-        always_run: true
+        files: ^(src/pypgstac/(src/pypgstac|tests)/.*\.py|src/pypgstac/pyproject\.toml)$
     -   id: pypgstac
         name: pypgstac
         entry: scripts/test