Update probability distributions guide

.github/workflows/devcontainer-docker-image.yml

@@ -23,10 +23,10 @@ jobs:
 
     steps:
     - name: Checkout source
-      uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
 
     - name: Setup Docker buildx
-      uses: docker/setup-buildx-action@v3.4.0
+      uses: docker/setup-buildx-action@v3.7.1
 
     - name: Prepare metadata
       id: meta

.github/workflows/docker-image.yml

@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
 
       - name: Login to Docker Hub
         uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567

.github/workflows/mypy.yml

@@ -5,53 +5,27 @@ on:
   push:
     branches: [main]
 
+defaults:
+  run:
+    shell: bash -leo pipefail {0}
 jobs:
   mypy:
     runs-on: ubuntu-latest
-    defaults:
-      run:
-        shell: bash -l {0}
     steps:
-      - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938
-      - name: Cache conda
-        uses: actions/cache@v4
-        env:
-          # Increase this value to reset cache if environment-test.yml has not changed
-          CACHE_NUMBER: 0
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - uses: mamba-org/setup-micromamba@v2
         with:
-          path: ~/conda_pkgs_dir
-          key: ${{ runner.os }}-py39-conda-${{ env.CACHE_NUMBER }}-${{
-            hashFiles('conda-envs/environment-test.yml') }}
-      - name: Cache multiple paths
-        uses: actions/cache@v4
-        env:
-          # Increase this value to reset cache if requirements.txt has not changed
-          CACHE_NUMBER: 0
-        with:
-          path: |
-            ~/.cache/pip
-            $RUNNER_TOOL_CACHE/Python/*
-            ~\AppData\Local\pip\Cache
-          key: ${{ runner.os }}-build-${{ matrix.python-version }}-${{ env.CACHE_NUMBER }}-${{
-            hashFiles('requirements.txt') }}
-      - uses: conda-incubator/setup-miniconda@v2
-        with:
-          miniforge-variant: Mambaforge
-          miniforge-version: latest
-          mamba-version: "*"
-          activate-environment: pymc-test
-          channel-priority: strict
           environment-file: conda-envs/environment-test.yml
-          python-version: "3.10"  # Run pre-commit on oldest supported Python version
-          use-mamba: true
-          use-only-tar-bz2: false # IMPORTANT: This may break caching of conda packages! See https://github.com/conda-incubator/setup-miniconda/issues/267
+          create-args: >-
+            python=3.10
+          environment-name: pymc-test
+          init-shell: bash
+          cache-environment: true
       - name: Install-pymc and mypy dependencies
         run: |
-          conda activate pymc-test
           pip install -e .
           pip install --pre -U polyagamma
           python --version
       - name: Run mypy
         run: |
-          conda activate pymc-test
           python ./scripts/run_mypy.py --verbose

.github/workflows/pr-auto-label.yml

@@ -0,0 +1,19 @@
+name: "Pull Request Labeler"
+on:
+- pull_request_target
+
+jobs:
+  sync:
+    permissions:
+      contents: read
+      pull-requests: write
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v2
+    - name: Sync labels with closing issues
+      uses: wd60622/[email protected]
+      with:
+        exclude: "help wanted,needs info,beginner friendly"
+      env:
+        GH_TOKEN: ${{ github.token }}

.github/workflows/release.yml

@@ -1,55 +1,49 @@
 name: release-pipeline
 
 on:
+  push:
+    branches:
+      - main
   release:
     types:
-      - created
+      - published
 
 jobs:
-  release-job:
+  build-package:
     runs-on: ubuntu-latest
-    env:
-      PYPI_TOKEN: ${{ secrets.PYPI_TOKEN_PYMC }}
+    permissions:
+      # write attestations and id-token are necessary for attest-build-provenance-github
+      attestations: write
+      id-token: write
     steps:
-    - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938
-    - name: Set up Python
-      uses: actions/setup-python@v5
-      with:
-        python-version: 3.7
-    # TODO: ideally, this pipeline should run parallelized tests in upstream jobs..
-    #- name: Install test tooling
-    #  run: |
-    #    pip install pytest pytest-cov nose nose-parameterized
-    #    pip install -r requirements.txt
-    #- name: Run tests
-    #  run: |
-    #    pytest --cov=./pymc --cov-report term-missing pymc/
-    - name: Install release tooling
-      run: |
-        pip install build twine
-    - name: Build package
-      run: |
-        python -m build
-    - name: Check version number match
-      run: |
-        echo "GITHUB_REF: ${GITHUB_REF}"
-        # The GITHUB_REF should be something like "refs/tags/v1.2.3"
-        # Make sure the package version is the same as the tag
-        grep -Rq "^Version: ${GITHUB_REF:11}$" pymc.egg-info/PKG-INFO
-    - name: Publish to PyPI
-      run: |
-        twine check dist/*
-        twine upload --repository pypi --username __token__ --password ${PYPI_TOKEN} dist/*
-  test-install-job:
-    needs: release-job
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - uses: hynek/build-and-inspect-python-package@14c7e53f5d033cfa99f7af916fa59a6f7f356394  # v2.11.0
+        with:
+          # Prove that the packages were built in the context of this workflow.
+          attest-build-provenance-github: true
+
+  publish-package:
+    # Don't publish from forks
+    if: github.repository_owner == 'pymc-devs' && github.event_name == 'release' && github.event.action == 'published'
+    # Use the `release` GitHub environment to protect the Trusted Publishing (OIDC)
+    # workflow by requiring signoff from a maintainer.
+    environment: release
+    needs: build-package
     runs-on: ubuntu-latest
+    permissions:
+      # write id-token is necessary for trusted publishing (OIDC)
+      id-token: write
     steps:
-    - name: Set up Python
-      uses: actions/setup-python@v5
-      with:
-        python-version: 3.7
-    - name: Give PyPI a chance to update the index
-      run: sleep 240
-    - name: Install from PyPI
-      run: |
-        pip install pymc==${GITHUB_REF:11}
+      - name: Download Distribution Artifacts
+        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16  # v4.1.8
+        with:
+          # The build-and-inspect-python-package action invokes upload-artifact.
+          # These are the correct arguments from that action.
+          name: Packages
+          path: dist
+      - name: Publish Package to PyPI
+        uses: pypa/gh-action-pypi-publish@67339c736fd9354cd4f8cb0b744f2b82a74b5c70  # v1.12.3
+        # Implicitly attests that the packages were uploaded in the context of this workflow.