From 635c3b680af64f055077a3775ee8df740eb0281c Mon Sep 17 00:00:00 2001
From: Cristian Le <cristian.le@mpsd.mpg.de>
Date: Mon, 4 Dec 2023 10:17:10 +0100
Subject: [PATCH 01/21] Remove concurrency

Only the workflows that trigger need the concurrency
---
 .github/workflows/step_build.yml                | 4 ----
 .github/workflows/step_pre-commit.yml           | 4 ----
 .github/workflows/step_static-analysis.yml      | 4 ----
 .github/workflows/step_test_unit_functional.yml | 4 ----
 .github/workflows/step_tests-conda.yml          | 4 ----
 .github/workflows/step_tests-pip.yml            | 4 ----
 .github/workflows/step_tests-ui.yml             | 4 ----
 7 files changed, 28 deletions(-)

diff --git a/.github/workflows/step_build.yml b/.github/workflows/step_build.yml
index d5cb47807..c8c2cc054 100644
--- a/.github/workflows/step_build.yml
+++ b/.github/workflows/step_build.yml
@@ -10,10 +10,6 @@ on:
         default: false
         description: Upload build artifacts
 
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}-build
-  cancel-in-progress: true
-
 jobs:
   build:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/step_pre-commit.yml b/.github/workflows/step_pre-commit.yml
index 11bb503e3..a05ef2640 100644
--- a/.github/workflows/step_pre-commit.yml
+++ b/.github/workflows/step_pre-commit.yml
@@ -4,10 +4,6 @@ run-name: Pre-commit
 on:
   workflow_call:
 
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}-pre-commit
-  cancel-in-progress: true
-
 jobs:
   pre-commit:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/step_static-analysis.yml b/.github/workflows/step_static-analysis.yml
index deee225de..40426640f 100644
--- a/.github/workflows/step_static-analysis.yml
+++ b/.github/workflows/step_static-analysis.yml
@@ -4,10 +4,6 @@ run-name: Run CodeQL analysis
 on:
   workflow_call:
 
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}-static-analysis
-  cancel-in-progress: true
-
 jobs:
   codeql:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/step_test_unit_functional.yml b/.github/workflows/step_test_unit_functional.yml
index 1bf3c9ce6..e7d36adfd 100644
--- a/.github/workflows/step_test_unit_functional.yml
+++ b/.github/workflows/step_test_unit_functional.yml
@@ -4,10 +4,6 @@ run-name: Run Unit/Functional/Integration and External tests using Pip
 on:
   workflow_call:
 
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}-test_classification
-  cancel-in-progress: true
-
 jobs:
   test-pip:
     continue-on-error: ${{ matrix.experimental || false }}
diff --git a/.github/workflows/step_tests-conda.yml b/.github/workflows/step_tests-conda.yml
index 1f00c1a2e..877bc0745 100644
--- a/.github/workflows/step_tests-conda.yml
+++ b/.github/workflows/step_tests-conda.yml
@@ -4,10 +4,6 @@ run-name: Run tests using Conda
 on:
   workflow_call:
 
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}-conda-test
-  cancel-in-progress: true
-
 jobs:
   test-conda:
     strategy:
diff --git a/.github/workflows/step_tests-pip.yml b/.github/workflows/step_tests-pip.yml
index d4622b70a..28e6d181d 100644
--- a/.github/workflows/step_tests-pip.yml
+++ b/.github/workflows/step_tests-pip.yml
@@ -4,10 +4,6 @@ run-name: Run tests using Pip
 on:
   workflow_call:
 
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}-pip-test
-  cancel-in-progress: true
-
 jobs:
   test-pip:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/step_tests-ui.yml b/.github/workflows/step_tests-ui.yml
index 2ba28b142..450e887ad 100644
--- a/.github/workflows/step_tests-ui.yml
+++ b/.github/workflows/step_tests-ui.yml
@@ -4,10 +4,6 @@ run-name: Run UI tests with Galata
 on:
   workflow_call:
 
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}-ui-test
-  cancel-in-progress: true
-
 jobs:
   test-ui:
     continue-on-error: false

From 1ed9ab25a5b29995f56033bd3ef43bd052bdcf0c Mon Sep 17 00:00:00 2001
From: Cristian Le <cristian.le@mpsd.mpg.de>
Date: Mon, 4 Dec 2023 11:07:24 +0100
Subject: [PATCH 02/21] Update action versions

---
 .github/workflows/comment-pr.yml                | 2 +-
 .github/workflows/publish.yml                   | 2 +-
 .github/workflows/step_build.yml                | 2 +-
 .github/workflows/step_pre-commit.yml           | 4 ++--
 .github/workflows/step_static-analysis.yml      | 2 +-
 .github/workflows/step_test_unit_functional.yml | 2 +-
 .github/workflows/step_tests-conda.yml          | 4 ++--
 .github/workflows/step_tests-pip.yml            | 2 +-
 .github/workflows/step_tests-ui.yml             | 2 +-
 9 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/.github/workflows/comment-pr.yml b/.github/workflows/comment-pr.yml
index db2cd9d54..267dcbb70 100644
--- a/.github/workflows/comment-pr.yml
+++ b/.github/workflows/comment-pr.yml
@@ -12,7 +12,7 @@ jobs:
     name: Comment PR
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Comment PR
         uses: thollander/actions-comment-pull-request@v2
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 012783294..edfb090e0 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -47,7 +47,7 @@ jobs:
 
     steps:
       - name: Checkout source
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Base Setup
         uses: jupyterlab/maintainer-tools/.github/actions/base-setup@v1
diff --git a/.github/workflows/step_build.yml b/.github/workflows/step_build.yml
index c8c2cc054..a2bfe26db 100644
--- a/.github/workflows/step_build.yml
+++ b/.github/workflows/step_build.yml
@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout source
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Base Setup
         uses: jupyterlab/maintainer-tools/.github/actions/base-setup@v1
diff --git a/.github/workflows/step_pre-commit.yml b/.github/workflows/step_pre-commit.yml
index a05ef2640..11794764c 100644
--- a/.github/workflows/step_pre-commit.yml
+++ b/.github/workflows/step_pre-commit.yml
@@ -9,7 +9,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout source
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Set up Python
         uses: actions/setup-python@v4
@@ -22,7 +22,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout source
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Base Setup
         uses: jupyterlab/maintainer-tools/.github/actions/base-setup@v1
diff --git a/.github/workflows/step_static-analysis.yml b/.github/workflows/step_static-analysis.yml
index 40426640f..9ab48ca3d 100644
--- a/.github/workflows/step_static-analysis.yml
+++ b/.github/workflows/step_static-analysis.yml
@@ -10,7 +10,7 @@ jobs:
     continue-on-error: true
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@v2
diff --git a/.github/workflows/step_test_unit_functional.yml b/.github/workflows/step_test_unit_functional.yml
index e7d36adfd..10ffdadc6 100644
--- a/.github/workflows/step_test_unit_functional.yml
+++ b/.github/workflows/step_test_unit_functional.yml
@@ -17,7 +17,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Base Setup
         uses: jupyterlab/maintainer-tools/.github/actions/base-setup@v1
diff --git a/.github/workflows/step_tests-conda.yml b/.github/workflows/step_tests-conda.yml
index 877bc0745..2743b0de3 100644
--- a/.github/workflows/step_tests-conda.yml
+++ b/.github/workflows/step_tests-conda.yml
@@ -17,7 +17,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Cache conda
         uses: actions/cache@v3
@@ -26,7 +26,7 @@ jobs:
           key: conda-${{ matrix.os }}-python-${{ matrix.python-version }}-${{ hashFiles('.ci/environment-ci.yml') }}
 
       - name: Setup Miniconda
-        uses: conda-incubator/setup-miniconda@v2
+        uses: conda-incubator/setup-miniconda@v3
         with:
           auto-update-conda: true
           auto-activate-base: false
diff --git a/.github/workflows/step_tests-pip.yml b/.github/workflows/step_tests-pip.yml
index 28e6d181d..1ba1ad173 100644
--- a/.github/workflows/step_tests-pip.yml
+++ b/.github/workflows/step_tests-pip.yml
@@ -27,7 +27,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Base Setup
         uses: jupyterlab/maintainer-tools/.github/actions/base-setup@v1
diff --git a/.github/workflows/step_tests-ui.yml b/.github/workflows/step_tests-ui.yml
index 450e887ad..ea438b098 100644
--- a/.github/workflows/step_tests-ui.yml
+++ b/.github/workflows/step_tests-ui.yml
@@ -11,7 +11,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Base Setup
         uses: jupyterlab/maintainer-tools/.github/actions/base-setup@v1

From 5e0bc6ffcc0b2dcf9960a3eba3c1c90e679f7499 Mon Sep 17 00:00:00 2001
From: Cristian Le <cristian.le@mpsd.mpg.de>
Date: Mon, 4 Dec 2023 11:17:37 +0100
Subject: [PATCH 03/21] Reorganize test dependencies

---
 .github/workflows/ci.yml      | 18 +++++++++---------
 .github/workflows/publish.yml | 16 ++++------------
 2 files changed, 13 insertions(+), 21 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ae67738ac..317b1d5da 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -10,9 +10,9 @@ on:
   push:
     paths-ignore:
       - "CHANGELOG.md"
-    branches: [main]
+    branches: [ main ]
   pull_request:
-    branches: [main]
+    branches: [ main ]
   schedule:
     - cron: "0 11 * * 4"
 
@@ -33,28 +33,28 @@ jobs:
   pre-commit:
     uses: ./.github/workflows/step_pre-commit.yml
 
-  codeql:
-    needs: [pre-commit]
+  static-analysis:
+    needs: [ pre-commit ]
     uses: ./.github/workflows/step_static-analysis.yml
 
   test-pip:
-    needs: [codeql]
+    needs: [ pre-commit ]
     uses: ./.github/workflows/step_tests-pip.yml
 
   test-unit-functional-integration:
-    needs: [codeql]
+    needs: [ test-pip ]
     uses: ./.github/workflows/step_test_unit_functional.yml
 
   test-conda:
-    needs: [codeql]
+    needs: [ test-pip ]
     uses: ./.github/workflows/step_tests-conda.yml
 
   test-ui:
-    needs: [codeql]
+    needs: [ test-pip ]
     uses: ./.github/workflows/step_tests-ui.yml
 
   build:
-    needs: [test-pip, test-conda, test-unit-functional-integration, test-ui]
+    needs: [ test-pip, test-conda, test-ui ]
     uses: ./.github/workflows/step_build.yml
     with:
       upload: ${{ inputs.upload-build-artifacts || false }}
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index edfb090e0..e5eea041e 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -10,28 +10,20 @@ jobs:
   pre-commit:
     uses: ./.github/workflows/step_pre-commit.yml
 
-  codeql:
-    needs: [ pre-commit ]
-    uses: ./.github/workflows/step_static-analysis.yml
-
   test-pip:
-    needs: [ codeql ]
+    needs: [ pre-commit ]
     uses: ./.github/workflows/step_tests-pip.yml
 
-  test-unit-functional-integration:
-    needs: [ codeql ]
-    uses: ./.github/workflows/step_test_unit_functional.yml
-
   test-conda:
-    needs: [ codeql ]
+    needs: [ test-pip ]
     uses: ./.github/workflows/step_tests-conda.yml
 
   test-ui:
-    needs: [ codeql ]
+    needs: [ test-pip ]
     uses: ./.github/workflows/step_tests-ui.yml
 
   build:
-    needs: [ test-pip, test-conda, test-unit-functional-integration, test-ui ]
+    needs: [ test-conda, test-ui ]
     uses: ./.github/workflows/step_build.yml
 
   publish:

From 773b9777b8c5e2d55f227f002a5cd57e3175d126 Mon Sep 17 00:00:00 2001
From: Cristian Le <cristian.le@mpsd.mpg.de>
Date: Mon, 4 Dec 2023 11:30:37 +0100
Subject: [PATCH 04/21] Harden the workflows

---
 .github/workflows/ci.yml                        | 7 +++----
 .github/workflows/publish.yml                   | 4 ++++
 .github/workflows/step_build.yml                | 3 +++
 .github/workflows/step_pre-commit.yml           | 3 +++
 .github/workflows/step_static-analysis.yml      | 4 ++++
 .github/workflows/step_test_unit_functional.yml | 3 +++
 .github/workflows/step_tests-conda.yml          | 3 +++
 .github/workflows/step_tests-pip.yml            | 3 +++
 .github/workflows/step_tests-ui.yml             | 3 +++
 9 files changed, 29 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 317b1d5da..421e8a1f9 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -20,10 +20,6 @@ permissions:
   # All nested workflows will inherit these permissions and so no need to declare
   # in each step file
   contents: read
-  # Cannot use it in codeql nested workflow without declaring it on
-  # top level workflow
-  # Ref: https://docs.github.com/en/actions/using-workflows/reusing-workflows#access-and-permissions
-  security-events: write
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -36,6 +32,9 @@ jobs:
   static-analysis:
     needs: [ pre-commit ]
     uses: ./.github/workflows/step_static-analysis.yml
+    permissions:
+      contents: read
+      security-events: write
 
   test-pip:
     needs: [ pre-commit ]
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index e5eea041e..0a6e8707b 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -6,6 +6,9 @@ on:
       - "v[0-9]+.[0-9]+.[0-9]+rc[0-9]+"
       - "v[0-9]+.[0-9]+.[0-9]+dev[0-9]+"
 
+permissions:
+  contents: read
+
 jobs:
   pre-commit:
     uses: ./.github/workflows/step_pre-commit.yml
@@ -35,6 +38,7 @@ jobs:
       url: https://pypi.org/p/jupytext
 
     permissions:
+      contents: read
       id-token: write
 
     steps:
diff --git a/.github/workflows/step_build.yml b/.github/workflows/step_build.yml
index a2bfe26db..3e58df029 100644
--- a/.github/workflows/step_build.yml
+++ b/.github/workflows/step_build.yml
@@ -10,6 +10,9 @@ on:
         default: false
         description: Upload build artifacts
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/step_pre-commit.yml b/.github/workflows/step_pre-commit.yml
index 11794764c..aae922967 100644
--- a/.github/workflows/step_pre-commit.yml
+++ b/.github/workflows/step_pre-commit.yml
@@ -4,6 +4,9 @@ run-name: Pre-commit
 on:
   workflow_call:
 
+permissions:
+  contents: read
+
 jobs:
   pre-commit:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/step_static-analysis.yml b/.github/workflows/step_static-analysis.yml
index 9ab48ca3d..14a0d8454 100644
--- a/.github/workflows/step_static-analysis.yml
+++ b/.github/workflows/step_static-analysis.yml
@@ -4,6 +4,10 @@ run-name: Run CodeQL analysis
 on:
   workflow_call:
 
+permissions:
+  contents: read
+  security-events: write
+
 jobs:
   codeql:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/step_test_unit_functional.yml b/.github/workflows/step_test_unit_functional.yml
index 10ffdadc6..429ad12ea 100644
--- a/.github/workflows/step_test_unit_functional.yml
+++ b/.github/workflows/step_test_unit_functional.yml
@@ -4,6 +4,9 @@ run-name: Run Unit/Functional/Integration and External tests using Pip
 on:
   workflow_call:
 
+permissions:
+  contents: read
+
 jobs:
   test-pip:
     continue-on-error: ${{ matrix.experimental || false }}
diff --git a/.github/workflows/step_tests-conda.yml b/.github/workflows/step_tests-conda.yml
index 2743b0de3..288bc3456 100644
--- a/.github/workflows/step_tests-conda.yml
+++ b/.github/workflows/step_tests-conda.yml
@@ -4,6 +4,9 @@ run-name: Run tests using Conda
 on:
   workflow_call:
 
+permissions:
+  contents: read
+
 jobs:
   test-conda:
     strategy:
diff --git a/.github/workflows/step_tests-pip.yml b/.github/workflows/step_tests-pip.yml
index 1ba1ad173..65f18ef6d 100644
--- a/.github/workflows/step_tests-pip.yml
+++ b/.github/workflows/step_tests-pip.yml
@@ -4,6 +4,9 @@ run-name: Run tests using Pip
 on:
   workflow_call:
 
+permissions:
+  contents: read
+
 jobs:
   test-pip:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/step_tests-ui.yml b/.github/workflows/step_tests-ui.yml
index ea438b098..c55995758 100644
--- a/.github/workflows/step_tests-ui.yml
+++ b/.github/workflows/step_tests-ui.yml
@@ -4,6 +4,9 @@ run-name: Run UI tests with Galata
 on:
   workflow_call:
 
+permissions:
+  contents: read
+
 jobs:
   test-ui:
     continue-on-error: false

From 1f1d580cc4f7f04bb993387429c20bdce23645df Mon Sep 17 00:00:00 2001
From: Cristian Le <cristian.le@mpsd.mpg.de>
Date: Mon, 4 Dec 2023 11:46:48 +0100
Subject: [PATCH 05/21] Update python-version defaults

Signed-off-by: Cristian Le <cristian.le@mpsd.mpg.de>
---
 .github/workflows/step_build.yml                | 2 ++
 .github/workflows/step_pre-commit.yml           | 2 ++
 .github/workflows/step_test_unit_functional.yml | 3 +--
 .github/workflows/step_tests-conda.yml          | 4 +---
 .github/workflows/step_tests-pip.yml            | 9 +++++----
 .github/workflows/step_tests-ui.yml             | 2 ++
 6 files changed, 13 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/step_build.yml b/.github/workflows/step_build.yml
index 3e58df029..e02342401 100644
--- a/.github/workflows/step_build.yml
+++ b/.github/workflows/step_build.yml
@@ -22,6 +22,8 @@ jobs:
 
       - name: Base Setup
         uses: jupyterlab/maintainer-tools/.github/actions/base-setup@v1
+        with:
+          python_version: "3.x"
 
       - name: Build package
         run: |
diff --git a/.github/workflows/step_pre-commit.yml b/.github/workflows/step_pre-commit.yml
index aae922967..f7d573739 100644
--- a/.github/workflows/step_pre-commit.yml
+++ b/.github/workflows/step_pre-commit.yml
@@ -29,6 +29,8 @@ jobs:
 
       - name: Base Setup
         uses: jupyterlab/maintainer-tools/.github/actions/base-setup@v1
+        with:
+          python_version: "3.x"
 
       # Current repo organization will not permit to set up pre-commit config for
       # TS lint related packages due to absence of package.json in the top level
diff --git a/.github/workflows/step_test_unit_functional.yml b/.github/workflows/step_test_unit_functional.yml
index 429ad12ea..97ecd3c4c 100644
--- a/.github/workflows/step_test_unit_functional.yml
+++ b/.github/workflows/step_test_unit_functional.yml
@@ -15,7 +15,6 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        python-version: [ "3.11" ]
         coverage: [unit, functional, integration, external]
 
     steps:
@@ -25,7 +24,7 @@ jobs:
       - name: Base Setup
         uses: jupyterlab/maintainer-tools/.github/actions/base-setup@v1
         with:
-          python_version: ${{ matrix.python-version }}
+          python_version: 3.x
 
       - name: Install from source
         run: HATCH_BUILD_HOOKS_ENABLE=false python -m pip install -e '.[test-cov,test-${{ matrix.coverage }}]' markdown-it-py~=3.0
diff --git a/.github/workflows/step_tests-conda.yml b/.github/workflows/step_tests-conda.yml
index 288bc3456..1742b9c2f 100644
--- a/.github/workflows/step_tests-conda.yml
+++ b/.github/workflows/step_tests-conda.yml
@@ -12,7 +12,6 @@ jobs:
     strategy:
       matrix:
         os: [ 'ubuntu-latest', 'macos-latest', 'windows-latest' ]
-        python-version: [ 3.11 ]
     runs-on: ${{ matrix.os }}
     defaults:
       run:
@@ -26,7 +25,7 @@ jobs:
         uses: actions/cache@v3
         with:
           path: ~/conda_pkgs_dir
-          key: conda-${{ matrix.os }}-python-${{ matrix.python-version }}-${{ hashFiles('.ci/environment-ci.yml') }}
+          key: conda-${{ matrix.os }}-${{ hashFiles('.ci/environment-ci.yml') }}
 
       - name: Setup Miniconda
         uses: conda-incubator/setup-miniconda@v3
@@ -34,7 +33,6 @@ jobs:
           auto-update-conda: true
           auto-activate-base: false
           activate-environment: jupytext-ci
-          python-version: ${{ matrix.python-version }}
           channels: defaults,conda-forge
           environment-file: .ci/environment-ci.yml
           use-only-tar-bz2: true
diff --git a/.github/workflows/step_tests-pip.yml b/.github/workflows/step_tests-pip.yml
index 65f18ef6d..d77188397 100644
--- a/.github/workflows/step_tests-pip.yml
+++ b/.github/workflows/step_tests-pip.yml
@@ -14,13 +14,13 @@ jobs:
     strategy:
       matrix:
         python-version: [ "3.8", "3.9", "3.10", "3.11", "3.12"]
-        markdown-it-py-version: ["~=3.0"]
-        pip-flags: [""]
         include:
+          # Test pre-release versions
           - python-version: "3.x"
-            pip-flags: "--pre --upgrade --upgrade-strategy eager"
+            dependency_type: "pre"
+          # Test minimum markdown-it-py supported (otherwise the most recent version is used)
           - python-version: "3.x"
-            markdown-it-py-version: "~=2.0"
+            markdown-it-py-version: "~=1.0"
           - python-version: "3.x"
             markdown-it-py-version: ""
           - python-version: "3.x"
@@ -36,6 +36,7 @@ jobs:
         uses: jupyterlab/maintainer-tools/.github/actions/base-setup@v1
         with:
           python_version: ${{ matrix.python-version }}
+          dependency_type: ${{ matrix.dependency_type }}
 
       - name: Install from source
         run: python -m pip install -e '.[test-cov,test-external]' jupyterlab ${{ matrix.markdown-it-py-version && format('markdown-it-py{0}', matrix.markdown-it-py-version) }} ${{ matrix.pip-flags }}
diff --git a/.github/workflows/step_tests-ui.yml b/.github/workflows/step_tests-ui.yml
index c55995758..abc48c276 100644
--- a/.github/workflows/step_tests-ui.yml
+++ b/.github/workflows/step_tests-ui.yml
@@ -18,6 +18,8 @@ jobs:
 
       - name: Base Setup
         uses: jupyterlab/maintainer-tools/.github/actions/base-setup@v1
+        with:
+          python_version: 3.x
 
       - name: Install from source
         run: python -m pip install -e '.[test-ui]'

From c3bba69ee3a1e2748c8d68b8bcf73c1ca2329dbb Mon Sep 17 00:00:00 2001
From: Cristian Le <cristian.le@mpsd.mpg.de>
Date: Mon, 4 Dec 2023 13:26:34 +0100
Subject: [PATCH 06/21] Remove explicit `markdown-it-py`

---
 .github/workflows/step_test_unit_functional.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/step_test_unit_functional.yml b/.github/workflows/step_test_unit_functional.yml
index 97ecd3c4c..ef0aabc43 100644
--- a/.github/workflows/step_test_unit_functional.yml
+++ b/.github/workflows/step_test_unit_functional.yml
@@ -27,7 +27,7 @@ jobs:
           python_version: 3.x
 
       - name: Install from source
-        run: HATCH_BUILD_HOOKS_ENABLE=false python -m pip install -e '.[test-cov,test-${{ matrix.coverage }}]' markdown-it-py~=3.0
+        run: HATCH_BUILD_HOOKS_ENABLE=false python -m pip install -e '.[test-cov,test-${{ matrix.coverage }}]'
 
       - name: Install a Jupyter Kernel
         run: python -m ipykernel install --name python_kernel --user

From afd68915b1ec7f661a3718ea773c732e582c519d Mon Sep 17 00:00:00 2001
From: Cristian Le <cristian.le@mpsd.mpg.de>
Date: Mon, 4 Dec 2023 13:31:21 +0100
Subject: [PATCH 07/21] Simplify release CI

---
 .github/workflows/publish.yml | 17 ++++++-----------
 1 file changed, 6 insertions(+), 11 deletions(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 0a6e8707b..819b50c90 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -28,6 +28,8 @@ jobs:
   build:
     needs: [ test-conda, test-ui ]
     uses: ./.github/workflows/step_build.yml
+    with:
+      upload: true
 
   publish:
     needs: [ build ]
@@ -42,16 +44,9 @@ jobs:
       id-token: write
 
     steps:
-      - name: Checkout source
-        uses: actions/checkout@v4
-
-      - name: Base Setup
-        uses: jupyterlab/maintainer-tools/.github/actions/base-setup@v1
-
-      - name: Build package
-        run: |
-          python -m pip install wheel build
-          python -m build
-
+      - uses: actions/download-artifact@v3
+        with:
+          name: dist
+          path: dist
       - name: Publish
         uses: pypa/gh-action-pypi-publish@release/v1

From 6db16ba0ddcf44da392fd7df3239d282bc3f8267 Mon Sep 17 00:00:00 2001
From: Cristian Le <cristian.le@mpsd.mpg.de>
Date: Mon, 4 Dec 2023 13:51:02 +0100
Subject: [PATCH 08/21] Improve CI display

---
 .github/workflows/ci.yml                                 | 4 ++--
 .github/workflows/step_build.yml                         | 2 +-
 .../{step_test_unit_functional.yml => step_coverage.yml} | 9 +++++----
 .github/workflows/step_pre-commit.yml                    | 2 +-
 .github/workflows/step_tests-conda.yml                   | 4 +++-
 .github/workflows/step_tests-pip.yml                     | 8 +++++++-
 6 files changed, 19 insertions(+), 10 deletions(-)
 rename .github/workflows/{step_test_unit_functional.yml => step_coverage.yml} (85%)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 421e8a1f9..8873ce4ab 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -40,9 +40,9 @@ jobs:
     needs: [ pre-commit ]
     uses: ./.github/workflows/step_tests-pip.yml
 
-  test-unit-functional-integration:
+  coverage:
     needs: [ test-pip ]
-    uses: ./.github/workflows/step_test_unit_functional.yml
+    uses: ./.github/workflows/step_coverage.yml
 
   test-conda:
     needs: [ test-pip ]
diff --git a/.github/workflows/step_build.yml b/.github/workflows/step_build.yml
index e02342401..fa7488ac3 100644
--- a/.github/workflows/step_build.yml
+++ b/.github/workflows/step_build.yml
@@ -1,5 +1,5 @@
 name: build
-run-name: Build test
+run-name: Build package
 
 on:
   workflow_call:
diff --git a/.github/workflows/step_test_unit_functional.yml b/.github/workflows/step_coverage.yml
similarity index 85%
rename from .github/workflows/step_test_unit_functional.yml
rename to .github/workflows/step_coverage.yml
index ef0aabc43..c97d6bc6e 100644
--- a/.github/workflows/step_test_unit_functional.yml
+++ b/.github/workflows/step_coverage.yml
@@ -1,5 +1,5 @@
-name: test-categories
-run-name: Run Unit/Functional/Integration and External tests using Pip
+name: coverage
+run-name: Check coverage
 
 on:
   workflow_call:
@@ -8,8 +8,9 @@ permissions:
   contents: read
 
 jobs:
-  test-pip:
-    continue-on-error: ${{ matrix.experimental || false }}
+  coverage:
+    name: >
+      ${{ matrix.coverage }}
     runs-on: ubuntu-latest
 
     strategy:
diff --git a/.github/workflows/step_pre-commit.yml b/.github/workflows/step_pre-commit.yml
index f7d573739..a154d2b86 100644
--- a/.github/workflows/step_pre-commit.yml
+++ b/.github/workflows/step_pre-commit.yml
@@ -1,5 +1,5 @@
 name: pre-commit
-run-name: Pre-commit
+run-name: Run pre-commit tests
 
 on:
   workflow_call:
diff --git a/.github/workflows/step_tests-conda.yml b/.github/workflows/step_tests-conda.yml
index 1742b9c2f..054997fff 100644
--- a/.github/workflows/step_tests-conda.yml
+++ b/.github/workflows/step_tests-conda.yml
@@ -1,5 +1,5 @@
 name: test-conda
-run-name: Run tests using Conda
+run-name: Run Conda tests for different OS
 
 on:
   workflow_call:
@@ -9,6 +9,8 @@ permissions:
 
 jobs:
   test-conda:
+    name: >
+      ${{ matrix.os }}
     strategy:
       matrix:
         os: [ 'ubuntu-latest', 'macos-latest', 'windows-latest' ]
diff --git a/.github/workflows/step_tests-pip.yml b/.github/workflows/step_tests-pip.yml
index d77188397..e05f87567 100644
--- a/.github/workflows/step_tests-pip.yml
+++ b/.github/workflows/step_tests-pip.yml
@@ -1,5 +1,5 @@
 name: test-pip
-run-name: Run tests using Pip
+run-name: Run main tests using Pip
 
 on:
   workflow_call:
@@ -9,6 +9,12 @@ permissions:
 
 jobs:
   test-pip:
+    name: >
+      🐍 ${{ matrix.python-version }}
+      ${{ matrix.dependency_type && format('({0})', matrix.dependency_type) }}
+      ${{ matrix.markdown-it-py-version && format('(markdown-it-py-version{0})', matrix.dependency_type) }}
+      ${{ matrix.quarto && '(Quarto)' }}
+      ${{ matrix.no_kernel && '(No kernel)' }}
     runs-on: ubuntu-latest
 
     strategy:

From 332fc1a6a7d9bc1dd3164d6c6001ee8ec4959ca4 Mon Sep 17 00:00:00 2001
From: Cristian Le <cristian.le@mpsd.mpg.de>
Date: Mon, 4 Dec 2023 13:51:55 +0100
Subject: [PATCH 09/21] Add pass action

Signed-off-by: Cristian Le <cristian.le@mpsd.mpg.de>
---
 .github/workflows/ci.yml | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 8873ce4ab..54837cd8c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -57,3 +57,13 @@ jobs:
     uses: ./.github/workflows/step_build.yml
     with:
       upload: ${{ inputs.upload-build-artifacts || false }}
+
+  pass:
+    name: Pass
+    needs: [ pre-commit, static-analysis, test-pip, coverage, test-conda, test-ui, build ]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: re-actors/alls-green@release/v1
+        with:
+          jobs: ${{ toJSON(needs) }}
+    if: always()

From 57176f7999b1196475991887eadb9d11ad0e67d9 Mon Sep 17 00:00:00 2001
From: Cristian Le <cristian.le@mpsd.mpg.de>
Date: Mon, 4 Dec 2023 14:09:23 +0100
Subject: [PATCH 10/21] Simplify step_build

---
 .github/workflows/step_build.yml | 25 +------------------------
 1 file changed, 1 insertion(+), 24 deletions(-)

diff --git a/.github/workflows/step_build.yml b/.github/workflows/step_build.yml
index fa7488ac3..4504eefbe 100644
--- a/.github/workflows/step_build.yml
+++ b/.github/workflows/step_build.yml
@@ -26,30 +26,7 @@ jobs:
           python_version: "3.x"
 
       - name: Build package
-        run: |
-          python -m pip install build wheel
-
-          # NOTE: These builds and verifications of the builds can be done more
-          # robustly with jupyter-releaser.
-          #
-          # Removed the check on size of package as we are distributing tests/ with
-          # sdist now and they are around 8MB. Seems like original check was to make
-          # sure we are not distributing node_modules and we are quite safe with that
-          # with hatch build system.
-          #
-          # Build jupytext package
-          python -m build
-
-          # Build lab extension(s)
-          npm pack --pack-destination dist jupyterlab/packages/*
-
-          # Check that the lab is there
-          if (($(tar -tf dist/*.tar.gz | grep jupyterlab/jupyterlab_jupytext/labextension/package.json$ | wc -l)==0)); then echo "Missing jupyterlab_jupytext" && exit 1; fi
-
-          # Install package and extension
-          python -m pip install dist/*.tar.gz
-
-          echo "Install went OK"
+        run: hatch build
 
       - name: Archive build artifacts
         uses: actions/upload-artifact@v3

From 514549713593e932b943adead361ff9295328af5 Mon Sep 17 00:00:00 2001
From: Cristian Le <cristian.le@mpsd.mpg.de>
Date: Mon, 4 Dec 2023 14:15:35 +0100
Subject: [PATCH 11/21] Remove the sdist.exclude

---
 pyproject.toml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/pyproject.toml b/pyproject.toml
index a89176d1e..ce2a272fb 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -122,7 +122,6 @@ path = "src/jupytext/version.py"
 # Following config is related to JupyterLab extension
 [tool.hatch.build.targets.sdist]
 artifacts = ["jupyterlab/jupyterlab_jupytext/labextension"]
-exclude = ["demo", "**/.yarn", "**/node_modules"]
 
 [tool.hatch.build.targets.wheel]
 packages = ["src/jupytext", "src/jupytext_config", "jupyterlab/jupyterlab_jupytext"]

From bea7f2cd6237566b46b9ba591352308c1fb18b74 Mon Sep 17 00:00:00 2001
From: Cristian Le <cristian.le@mpsd.mpg.de>
Date: Mon, 4 Dec 2023 14:18:09 +0100
Subject: [PATCH 12/21] Remove jupyterlab upper-bound

---
 pyproject.toml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pyproject.toml b/pyproject.toml
index ce2a272fb..da5d6a7b6 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -139,7 +139,7 @@ enable-by-default = true
 # Runtime dependency for this build hook
 # We need jupyterlab as build time depdendency to get jlpm (wrapper around yarn)
 dependencies = [
-    "hatch-jupyter-builder>=0.5", "jupyterlab>=4,<5"
+    "hatch-jupyter-builder>=0.5", "jupyterlab>=4"
 ]
 # We use npm_builder to build the jupyterlab extension
 build-function = "hatch_jupyter_builder.npm_builder"

From 4927d5ff9f9acf6879c71383838deaad1103b9bd Mon Sep 17 00:00:00 2001
From: Cristian Le <cristian.le@mpsd.mpg.de>
Date: Mon, 4 Dec 2023 14:21:35 +0100
Subject: [PATCH 13/21] Add missing `.git_archival.txt`

See https://setuptools-scm.readthedocs.io/en/latest/usage/#git-archives
---
 .git_archival.txt | 4 ++++
 .gitattributes    | 1 +
 2 files changed, 5 insertions(+)
 create mode 100644 .git_archival.txt

diff --git a/.git_archival.txt b/.git_archival.txt
new file mode 100644
index 000000000..8fb235d70
--- /dev/null
+++ b/.git_archival.txt
@@ -0,0 +1,4 @@
+node: $Format:%H$
+node-date: $Format:%cI$
+describe-name: $Format:%(describe:tags=true,match=*[0-9]*)$
+ref-names: $Format:%D$
diff --git a/.gitattributes b/.gitattributes
index 897b242c2..965a20f29 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -1 +1,2 @@
 World\ population.ipynb linguist-documentation
+.git_archival.txt  export-subst

From a2f8106a64c05a4fd1fd494b16a50ca814699d7c Mon Sep 17 00:00:00 2001
From: Cristian Le <cristian.le@mpsd.mpg.de>
Date: Mon, 4 Dec 2023 15:16:55 +0100
Subject: [PATCH 14/21] Configure `fail-fast` option

Signed-off-by: Cristian Le <cristian.le@mpsd.mpg.de>
---
 .github/workflows/step_tests-conda.yml | 1 +
 .github/workflows/step_tests-pip.yml   | 1 +
 2 files changed, 2 insertions(+)

diff --git a/.github/workflows/step_tests-conda.yml b/.github/workflows/step_tests-conda.yml
index 054997fff..b7a137bfe 100644
--- a/.github/workflows/step_tests-conda.yml
+++ b/.github/workflows/step_tests-conda.yml
@@ -12,6 +12,7 @@ jobs:
     name: >
       ${{ matrix.os }}
     strategy:
+      fail-fast: false
       matrix:
         os: [ 'ubuntu-latest', 'macos-latest', 'windows-latest' ]
     runs-on: ${{ matrix.os }}
diff --git a/.github/workflows/step_tests-pip.yml b/.github/workflows/step_tests-pip.yml
index e05f87567..32e43ec2b 100644
--- a/.github/workflows/step_tests-pip.yml
+++ b/.github/workflows/step_tests-pip.yml
@@ -18,6 +18,7 @@ jobs:
     runs-on: ubuntu-latest
 
     strategy:
+      fail-fast: false
       matrix:
         python-version: [ "3.8", "3.9", "3.10", "3.11", "3.12"]
         include:

From e5dcfa677995a69387156ef994bbabb67732367c Mon Sep 17 00:00:00 2001
From: Cristian Le <cristian.le@mpsd.mpg.de>
Date: Mon, 4 Dec 2023 15:18:26 +0100
Subject: [PATCH 15/21] Bump minimum `markdown-it-py`

Signed-off-by: Cristian Le <cristian.le@mpsd.mpg.de>
---
 .github/workflows/step_tests-pip.yml | 2 +-
 pyproject.toml                       | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/step_tests-pip.yml b/.github/workflows/step_tests-pip.yml
index 32e43ec2b..2f12a98a1 100644
--- a/.github/workflows/step_tests-pip.yml
+++ b/.github/workflows/step_tests-pip.yml
@@ -27,7 +27,7 @@ jobs:
             dependency_type: "pre"
           # Test minimum markdown-it-py supported (otherwise the most recent version is used)
           - python-version: "3.x"
-            markdown-it-py-version: "~=1.0"
+            markdown-it-py-version: "~=2.0"
           - python-version: "3.x"
             markdown-it-py-version: ""
           - python-version: "3.x"
diff --git a/pyproject.toml b/pyproject.toml
index da5d6a7b6..cd03fd054 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -33,7 +33,7 @@ classifiers = [
 dependencies = [
     "nbformat",
     "mdit_py_plugins",
-    "markdown-it-py>=1.0.0",
+    "markdown-it-py>=2.0",
     "packaging",
     "pyyaml",
     "toml",

From b43b625a2cb470c00b8faa2417cd83703b55b9dc Mon Sep 17 00:00:00 2001
From: Cristian Le <cristian.le@mpsd.mpg.de>
Date: Mon, 4 Dec 2023 15:43:09 +0100
Subject: [PATCH 16/21] fix `markdown-it-py-version` CI

Signed-off-by: Cristian Le <cristian.le@mpsd.mpg.de>
---
 .github/workflows/step_tests-pip.yml | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/step_tests-pip.yml b/.github/workflows/step_tests-pip.yml
index 2f12a98a1..595db72cd 100644
--- a/.github/workflows/step_tests-pip.yml
+++ b/.github/workflows/step_tests-pip.yml
@@ -12,7 +12,7 @@ jobs:
     name: >
       🐍 ${{ matrix.python-version }}
       ${{ matrix.dependency_type && format('({0})', matrix.dependency_type) }}
-      ${{ matrix.markdown-it-py-version && format('(markdown-it-py-version{0})', matrix.dependency_type) }}
+      ${{ matrix.markdown-it-py && format('(markdown-it-py {0})', matrix.markdown-it-py) }}
       ${{ matrix.quarto && '(Quarto)' }}
       ${{ matrix.no_kernel && '(No kernel)' }}
     runs-on: ubuntu-latest
@@ -27,9 +27,9 @@ jobs:
             dependency_type: "pre"
           # Test minimum markdown-it-py supported (otherwise the most recent version is used)
           - python-version: "3.x"
-            markdown-it-py-version: "~=2.0"
+            markdown-it-py: "~=2.0"
           - python-version: "3.x"
-            markdown-it-py-version: ""
+            markdown-it-py: false
           - python-version: "3.x"
             no_kernel: true
           - python-version: "3.x"
@@ -46,16 +46,19 @@ jobs:
           dependency_type: ${{ matrix.dependency_type }}
 
       - name: Install from source
-        run: python -m pip install -e '.[test-cov,test-external]' jupyterlab ${{ matrix.markdown-it-py-version && format('markdown-it-py{0}', matrix.markdown-it-py-version) }} ${{ matrix.pip-flags }}
+        run: >
+          python -m pip install
+          -e '.[test-cov,test-external]'
+          jupyterlab
+          ${{ matrix.markdown-it-py && format('markdown-it-py{0}', matrix.markdown-it-py) || '' }}
 
       - name: Install a Jupyter Kernel
         if: ${{ !matrix.no_kernel }}
         run: python -m ipykernel install --name python_kernel --user
-
       - name: Uninstall markdown-it-py
         # Markdown-it-py is a dependency of Jupytext,
         # but Jupytext should still work if it is not installed
-        if: ${{ matrix.markdown-it-py-version == '' }}
+        if: ${{ matrix.markdown-it-py == 'false' }}
         run: python -m pip uninstall markdown-it-py --yes
 
       - name: Install Quarto

From dc3b9fd0fc8c98d91ef4806c5993a9bfc66fde42 Mon Sep 17 00:00:00 2001
From: Cristian Le <cristian.le@mpsd.mpg.de>
Date: Mon, 4 Dec 2023 15:24:34 +0100
Subject: [PATCH 17/21] Package name convention

Signed-off-by: Cristian Le <cristian.le@mpsd.mpg.de>
---
 pyproject.toml | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pyproject.toml b/pyproject.toml
index cd03fd054..1411e61bf 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -32,7 +32,7 @@ classifiers = [
 ]
 dependencies = [
     "nbformat",
-    "mdit_py_plugins",
+    "mdit-py-plugins",
     "markdown-it-py>=2.0",
     "packaging",
     "pyyaml",
@@ -86,7 +86,7 @@ test-cov = [
 # Galata test env
 # Install a non python kernel to ensure extension is working as expected
 test-ui = [
-    "calysto_bash",
+    "calysto-bash",
 ]
 dev = [
     "jupytext[test-cov,test-external]",
@@ -94,9 +94,9 @@ dev = [
 # Documentation dependencies
 docs = [
     "sphinx",
-    "sphinx_copybutton",
-    "sphinx_rtd_theme",
-    "myst_parser",
+    "sphinx-copybutton",
+    "sphinx-rtd-theme",
+    "myst-parser",
 ]
 
 [project.scripts]

From 0ecd51f84bff8f9dde2e7d8e7488e149ed550a7b Mon Sep 17 00:00:00 2001
From: Cristian Le <cristian.le@mpsd.mpg.de>
Date: Mon, 4 Dec 2023 15:14:19 +0100
Subject: [PATCH 18/21] Configure release CD

Signed-off-by: Cristian Le <cristian.le@mpsd.mpg.de>
---
 .github/workflows/publish.yml    | 52 ------------------
 .github/workflows/release.yml    | 92 ++++++++++++++++++++++++++++++++
 .github/workflows/step_build.yml |  5 ++
 3 files changed, 97 insertions(+), 52 deletions(-)
 delete mode 100644 .github/workflows/publish.yml
 create mode 100644 .github/workflows/release.yml

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
deleted file mode 100644
index 819b50c90..000000000
--- a/.github/workflows/publish.yml
+++ /dev/null
@@ -1,52 +0,0 @@
-name: Publish
-on:
-  push:
-    tags:
-      - "v[0-9]+.[0-9]+.[0-9]+"
-      - "v[0-9]+.[0-9]+.[0-9]+rc[0-9]+"
-      - "v[0-9]+.[0-9]+.[0-9]+dev[0-9]+"
-
-permissions:
-  contents: read
-
-jobs:
-  pre-commit:
-    uses: ./.github/workflows/step_pre-commit.yml
-
-  test-pip:
-    needs: [ pre-commit ]
-    uses: ./.github/workflows/step_tests-pip.yml
-
-  test-conda:
-    needs: [ test-pip ]
-    uses: ./.github/workflows/step_tests-conda.yml
-
-  test-ui:
-    needs: [ test-pip ]
-    uses: ./.github/workflows/step_tests-ui.yml
-
-  build:
-    needs: [ test-conda, test-ui ]
-    uses: ./.github/workflows/step_build.yml
-    with:
-      upload: true
-
-  publish:
-    needs: [ build ]
-    runs-on: ubuntu-latest
-
-    environment:
-      name: pypi
-      url: https://pypi.org/p/jupytext
-
-    permissions:
-      contents: read
-      id-token: write
-
-    steps:
-      - uses: actions/download-artifact@v3
-        with:
-          name: dist
-          path: dist
-      - name: Publish
-        uses: pypa/gh-action-pypi-publish@release/v1
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 000000000..b315ea6dd
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,92 @@
+name: Release
+on:
+  push:
+    tags:
+      - "v[0-9]+.[0-9]+.[0-9]+"
+      - "v[0-9]+.[0-9]+.[0-9]+rc[0-9]+"
+      - "v[0-9]+.[0-9]+.[0-9]+dev[0-9]+"
+  workflow_dispatch:
+    inputs:
+      skip-tests:
+        type: boolean
+        description: Skip
+        default: false
+      ref:
+        type: string
+        description: Tag to release
+        required: true
+
+permissions:
+  contents: read
+
+jobs:
+  pre-commit:
+    uses: ./.github/workflows/step_pre-commit.yml
+    if: "! inputs.skip-tests"
+
+  test-pip:
+    needs: [ pre-commit ]
+    uses: ./.github/workflows/step_tests-pip.yml
+    if: "! inputs.skip-tests"
+
+  test-conda:
+    needs: [ test-pip ]
+    uses: ./.github/workflows/step_tests-conda.yml
+    if: "! inputs.skip-tests"
+
+  test-ui:
+    needs: [ test-pip ]
+    uses: ./.github/workflows/step_tests-ui.yml
+    if: "! inputs.skip-tests"
+
+  test-status:
+    needs: [ pre-commit, test-pip, test-conda, test-ui ]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: re-actors/alls-green@release/v1
+        with:
+          allowed-skips: pre-commit, test-pip, test-conda, test-ui
+          jobs: ${{ toJSON(needs) }}
+    if: always()
+
+  build:
+    needs: [ test-status ]
+    uses: ./.github/workflows/step_build.yml
+    with:
+      upload: true
+      ref: ${{ inputs.ref }}
+
+  publish:
+    needs: [ build ]
+    runs-on: ubuntu-latest
+
+    environment:
+      name: pypi
+      url: https://pypi.org/p/jupytext
+
+    permissions:
+      contents: read
+      id-token: write
+
+    steps:
+      - uses: actions/download-artifact@v3
+        with:
+          name: dist
+          path: dist
+      - name: Publish
+        uses: pypa/gh-action-pypi-publish@release/v1
+
+  release:
+    needs: [ publish ]
+    name: Create release
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.ref }}
+      - uses: softprops/action-gh-release@v1
+        with:
+          name: Jupytext ${{ inputs.ref || github.ref_name }}
+          draft: true
+          prerelease: ${{ contains(inputs.ref || github.ref, 'rc') }}
+          generate_release_notes: true
diff --git a/.github/workflows/step_build.yml b/.github/workflows/step_build.yml
index 4504eefbe..8ee9106eb 100644
--- a/.github/workflows/step_build.yml
+++ b/.github/workflows/step_build.yml
@@ -9,6 +9,9 @@ on:
         required: false
         default: false
         description: Upload build artifacts
+      ref:
+        type: string
+        description: Tag to build
 
 permissions:
   contents: read
@@ -19,6 +22,8 @@ jobs:
     steps:
       - name: Checkout source
         uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.ref }}
 
       - name: Base Setup
         uses: jupyterlab/maintainer-tools/.github/actions/base-setup@v1

From 269d225103eeb2bb551efa12c2070271b28ac581 Mon Sep 17 00:00:00 2001
From: Cristian Le <cristian.le@mpsd.mpg.de>
Date: Tue, 5 Dec 2023 12:11:14 +0100
Subject: [PATCH 19/21] Run pytest in parallel

Signed-off-by: Cristian Le <cristian.le@mpsd.mpg.de>
---
 .github/workflows/step_coverage.yml    | 2 +-
 .github/workflows/step_tests-conda.yml | 2 +-
 .github/workflows/step_tests-pip.yml   | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/step_coverage.yml b/.github/workflows/step_coverage.yml
index c97d6bc6e..4dc0b4ba3 100644
--- a/.github/workflows/step_coverage.yml
+++ b/.github/workflows/step_coverage.yml
@@ -34,7 +34,7 @@ jobs:
         run: python -m ipykernel install --name python_kernel --user
 
       - name: Run the tests
-        run: pytest tests/${{ matrix.coverage }} --cov
+        run: pytest tests/${{ matrix.coverage }} --cov -n logical
 
       - name: Upload the coverage
         uses: codecov/codecov-action@v3
diff --git a/.github/workflows/step_tests-conda.yml b/.github/workflows/step_tests-conda.yml
index b7a137bfe..a7b987fb2 100644
--- a/.github/workflows/step_tests-conda.yml
+++ b/.github/workflows/step_tests-conda.yml
@@ -59,7 +59,7 @@ jobs:
       - name: Test with pytest
         # We use an explicit coverage file otherwise the
         # codecov action below does not find it
-        run: pytest --cov . --cov-report xml:coverage.xml
+        run: pytest -n logical --cov . --cov-report xml:coverage.xml
 
       - name: Upload coverage
         uses: codecov/codecov-action@v3
diff --git a/.github/workflows/step_tests-pip.yml b/.github/workflows/step_tests-pip.yml
index 595db72cd..b38b705ae 100644
--- a/.github/workflows/step_tests-pip.yml
+++ b/.github/workflows/step_tests-pip.yml
@@ -79,7 +79,7 @@ jobs:
           python -m jupyterlab.browser_check
 
       - name: Test with pytest
-        run: pytest --cov
+        run: pytest --cov -n logical
 
       - name: Upload coverage
         uses: codecov/codecov-action@v3

From 113d2c2814ca940e8862a814eb0fa511f84e565d Mon Sep 17 00:00:00 2001
From: Cristian Le <cristian.le@mpsd.mpg.de>
Date: Mon, 4 Dec 2023 16:45:31 +0100
Subject: [PATCH 20/21] Reconfigure codecov

Signed-off-by: Cristian Le <cristian.le@mpsd.mpg.de>
---
 .github/codecov.yml                    | 5 +----
 .github/workflows/step_coverage.yml    | 2 +-
 .github/workflows/step_tests-conda.yml | 5 +----
 .github/workflows/step_tests-pip.yml   | 2 +-
 pyproject.toml                         | 3 ---
 5 files changed, 4 insertions(+), 13 deletions(-)

diff --git a/.github/codecov.yml b/.github/codecov.yml
index 9dc3686b0..897013a1c 100644
--- a/.github/codecov.yml
+++ b/.github/codecov.yml
@@ -1,9 +1,6 @@
 codecov:
   notify:
-    after_n_builds: 16
-
-comment:
-  after_n_builds: 16
+    wait_for_ci: true
 
 coverage:
   status:
diff --git a/.github/workflows/step_coverage.yml b/.github/workflows/step_coverage.yml
index 4dc0b4ba3..8220545d6 100644
--- a/.github/workflows/step_coverage.yml
+++ b/.github/workflows/step_coverage.yml
@@ -34,7 +34,7 @@ jobs:
         run: python -m ipykernel install --name python_kernel --user
 
       - name: Run the tests
-        run: pytest tests/${{ matrix.coverage }} --cov -n logical
+        run: pytest tests/${{ matrix.coverage }} -n logical --cov --cov-report=xml
 
       - name: Upload the coverage
         uses: codecov/codecov-action@v3
diff --git a/.github/workflows/step_tests-conda.yml b/.github/workflows/step_tests-conda.yml
index a7b987fb2..4ccd01e43 100644
--- a/.github/workflows/step_tests-conda.yml
+++ b/.github/workflows/step_tests-conda.yml
@@ -57,13 +57,10 @@ jobs:
           python -m jupyterlab.browser_check
 
       - name: Test with pytest
-        # We use an explicit coverage file otherwise the
-        # codecov action below does not find it
-        run: pytest -n logical --cov . --cov-report xml:coverage.xml
+        run: pytest -n logical --cov --cov-report=xml
 
       - name: Upload coverage
         uses: codecov/codecov-action@v3
         with:
           fail_ci_if_error: true
           verbose: true
-          files: coverage.xml
diff --git a/.github/workflows/step_tests-pip.yml b/.github/workflows/step_tests-pip.yml
index b38b705ae..600e388e3 100644
--- a/.github/workflows/step_tests-pip.yml
+++ b/.github/workflows/step_tests-pip.yml
@@ -79,7 +79,7 @@ jobs:
           python -m jupyterlab.browser_check
 
       - name: Test with pytest
-        run: pytest --cov -n logical
+        run: pytest -n logical --cov --cov-report=xml
 
       - name: Upload coverage
         uses: codecov/codecov-action@v3
diff --git a/pyproject.toml b/pyproject.toml
index 1411e61bf..ddd60caf2 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -266,6 +266,3 @@ omit = [
     "tests/*",
     "src/jupytext/version.py",
 ]
-
-[tool.coverage.xml]
-output = "coverage.xml"

From 1870d1956410e7ad8efc163a38ab0261b13ef3a2 Mon Sep 17 00:00:00 2001
From: Cristian Le <cristian.le@mpsd.mpg.de>
Date: Thu, 7 Dec 2023 14:08:53 +0100
Subject: [PATCH 21/21] Conditionally upload code coverage

Signed-off-by: Cristian Le <cristian.le@mpsd.mpg.de>
---
 .github/workflows/ci.yml               | 6 ++++++
 .github/workflows/release.yml          | 4 ++++
 .github/workflows/step_tests-conda.yml | 6 ++++++
 .github/workflows/step_tests-pip.yml   | 6 ++++++
 4 files changed, 22 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 54837cd8c..07c7fd6f2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -39,14 +39,19 @@ jobs:
   test-pip:
     needs: [ pre-commit ]
     uses: ./.github/workflows/step_tests-pip.yml
+    with:
+      coverage: ${{ github.event_name != 'schedule' }}
 
   coverage:
     needs: [ test-pip ]
     uses: ./.github/workflows/step_coverage.yml
+    if: github.event_name != 'schedule'
 
   test-conda:
     needs: [ test-pip ]
     uses: ./.github/workflows/step_tests-conda.yml
+    with:
+      coverage: ${{ github.event_name != 'schedule' }}
 
   test-ui:
     needs: [ test-pip ]
@@ -66,4 +71,5 @@ jobs:
       - uses: re-actors/alls-green@release/v1
         with:
           jobs: ${{ toJSON(needs) }}
+          allowed-skips: coverage
     if: always()
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index b315ea6dd..81ffc0e35 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -27,11 +27,15 @@ jobs:
   test-pip:
     needs: [ pre-commit ]
     uses: ./.github/workflows/step_tests-pip.yml
+    with:
+      coverage: false
     if: "! inputs.skip-tests"
 
   test-conda:
     needs: [ test-pip ]
     uses: ./.github/workflows/step_tests-conda.yml
+    with:
+      coverage: false
     if: "! inputs.skip-tests"
 
   test-ui:
diff --git a/.github/workflows/step_tests-conda.yml b/.github/workflows/step_tests-conda.yml
index 4ccd01e43..f27f2b5ad 100644
--- a/.github/workflows/step_tests-conda.yml
+++ b/.github/workflows/step_tests-conda.yml
@@ -3,6 +3,11 @@ run-name: Run Conda tests for different OS
 
 on:
   workflow_call:
+    inputs:
+      coverage:
+        type: boolean
+        description: Upload coverage to CodeCov
+        default: true
 
 permissions:
   contents: read
@@ -64,3 +69,4 @@ jobs:
         with:
           fail_ci_if_error: true
           verbose: true
+        if: inputs.coverage
diff --git a/.github/workflows/step_tests-pip.yml b/.github/workflows/step_tests-pip.yml
index 600e388e3..eb3ccb523 100644
--- a/.github/workflows/step_tests-pip.yml
+++ b/.github/workflows/step_tests-pip.yml
@@ -3,6 +3,11 @@ run-name: Run main tests using Pip
 
 on:
   workflow_call:
+    inputs:
+      coverage:
+        type: boolean
+        description: Upload coverage to CodeCov
+        default: true
 
 permissions:
   contents: read
@@ -86,3 +91,4 @@ jobs:
         with:
           fail_ci_if_error: true
           verbose: true
+        if: inputs.coverage