Prepare release v0.9.1

.flake8

@@ -5,3 +5,5 @@
 [flake8]
 max-complexity = 15
 max-line-length = 120
+per-file-ignores =
+    src/hermes/commands/marketplace.py:E231

.github/ISSUE_TEMPLATE/add-plugin-to-marketplace.yml

@@ -13,7 +13,7 @@ body:
       value: |
         Thank you for building a plugin for Hermes and sharing it with the community!
 
-        The [Hermes plugin marketplace](https://hermes.software-metadata.pub#plugins) is a curated list of plugins on our website that allows you to share plugins that you developed, and others to find them.
+        The [Hermes plugin marketplace](https://hermes.software-metadata.pub/marketplace) is a curated list of plugins on our website that allows you to share plugins that you developed, and others to find them.
 
         Via this issue template, you can send us the required information to add your plugin to the marketplace. Alternatively, you may file a pull request, adding the plugin to [`plugins.json`](https://github.com/softwarepub/hermes/tree/develop/docs/source/plugins.json) yourself.
 

.github/workflows/release.yml

@@ -24,7 +24,7 @@ jobs:
     - name: Set up Python
       uses: actions/setup-python@v5
       with:
-        python-version: "3.10"
+        python-version: "3.12"
     - name: Install pypa/build
       run: >-
         python3 -m

.github/workflows/tests.yml

@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        python-version: ["3.10"]  # Ignore Python < 3.10, they are unsupported
+        python-version: ["3.12"]  # Ignore Python < 3.11, they are unsupported
 
     steps:
       - uses: actions/checkout@v4
@@ -26,11 +26,9 @@ jobs:
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip poetry
-          poetry install
+          poetry install --with dev
       - name: Lint with flake8
         run: |
-          # stop the build if there are Python syntax errors or undefined names
-          poetry run flake8 ./test/ ./src/ --count --select=E9,F63,F7,F82 --show-source --statistics
           # Stop build on errors
           poetry run flake8 ./test/ ./src/ --count --statistics
       - name: Test with pytest

.readthedocs.yaml

@@ -7,12 +7,17 @@ version: 2
 build:
   os: ubuntu-20.04
   tools:
-    python: "3.10"
+    python: "3.12"
   jobs:
+    post_create_environment:
+      # Install poetry
+      # https://python-poetry.org/docs/#installing-manually
+      - pip install "poetry>=2.1.3,<3.0.0"
     post_install:
-      - pip install "poetry>=1.2.0,<1.3.0"
-      - poetry config virtualenvs.create false
-      - poetry install --with docs
+        # Install dependencies with 'docs' dependency group
+        # https://python-poetry.org/docs/managing-dependencies/#dependency-groups
+        # VIRTUAL_ENV needs to be set manually for now, see #11150
+        - VIRTUAL_ENV=$READTHEDOCS_VIRTUALENV_PATH poetry install --with docs
 
 # Build documentation in the docs/source directory with Sphinx
 sphinx:

CHANGELOG.md

@@ -0,0 +1,60 @@
+<!--
+SPDX-FileCopyrightText: 2025 German Aerospace Center (DLR)
+
+SPDX-License-Identifier: CC0-1.0
+-->
+
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project tries to adhere to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [0.9.1] - 2026-01-12
+
+### Added
+
+- Added ADR for `init` plugin (#324)
+
+### Fixed
+
+- Broken HERMES DOI in marketplace plugin metadata (#326)
+- hermes init fails with cryptic error message in non-git directory (#308)
+- Make --initial deposits work on Rodare (#348)
+- Fix GitHub link in docs (#319)
+- `hermes init` cancellation should remove created files (#328)
+- `pyproject.toml` compliance with PEP 621 (#347)
+- Improve marketplace visibility (#426)
+
+### Changed
+
+- Update poetry to more recent version. (#347)
+
+### Security
+
+- Patch raw logging of '-O' values that could have included arbitrary secrets. (https://github.com/softwarepub/hermes/security/advisories/GHSA-jm5j-jfrm-hm23)
+
+## [0.9.0] - 2025-02-26
+
+### Added
+
+- Added the hermes init subcommand
+
+### Fixed
+
+- Fixes multiple bugs
+
+### Changed
+
+- Refactored plugin system further
+
+## [0.8.1] - 2024-08-13
+
+### Added
+
+- Integrated pyproject.toml plugin into the publication process
+
+### Changed
+
+- Improved logging output for better error dissemination

CITATION.cff

@@ -14,7 +14,7 @@ title: hermes
 message: >-
   If you use this software, please cite it using the
   metadata from this file.
-version: 0.9.0
+version: 0.9.1
 license: "Apache-2.0"
 abstract: "Tool to automate software publication. Not stable yet."
 type: software

GOVERNANCE.md

@@ -80,5 +80,5 @@ If no successor is named,
 the Steering Group seeks a successor.
 One member of the Steering Group steps in as interim maintainer until a successor is found.
 
-In addition, all contributors with write access to repositories and regular activities should be added as "authors" to project and build system metadata in alphabetical order.
-They may also qualify for scholarly authorship, which is managed in citation metadata as necessary and may be ordered by other criteria.
+Authorship is defined by the [steering group](#hermes-steering-group) and declared in
+[`CITATION.cff`](https://github.com/softwarepub/hermes/blob/main/CITATION.cff).

docs/adr/0002-use-a-common-data-model.md

@@ -20,7 +20,7 @@ We need a data model that's
 to exchange data between modules.
 
 The chosen option determines the serialization of the data model, too.
-See also [ADR 11](./0011-record-provenance-of-metadata.md) about provenance records in the data model.
+See also [ADR 11](./0011-record-provenance-of-metadata) about provenance records in the data model.
 
 ## Considered Options
 

docs/adr/0003-define-interfaces-for-inter-module-data-exchange.md

@@ -14,7 +14,7 @@ SPDX-License-Identifier: CC-BY-SA-4.0
 This depends on the data model (ADR 0002).
 Do we have to expose different parts of the data model structure at different points in the workflow?
 
-Superseded: decisions in [ADR 2](./0002-use-a-common-data-model.md) (use JSON-LD) and [ADR 11](./0011-record-provenance-of-metadata.md)  (create a unified data model of metadata and provenance) will result in a context [DAO](https://en.wikipedia.org/wiki/Data_access_object) from beginning till end of a run.
+Superseded: decisions in [ADR 2](./0002-use-a-common-data-model) (use JSON-LD) and [ADR 11](./0011-record-provenance-of-metadata)  (create a unified data model of metadata and provenance) will result in a context [DAO](https://en.wikipedia.org/wiki/Data_access_object) from beginning till end of a run.
 
 ## Decision Drivers
 

docs/adr/0013-plugin-init.md

@@ -0,0 +1,45 @@
+<!--
+SPDX-FileCopyrightText: 2022 German Aerospace Center (DLR), Forschungszentrum Jülich, Helmholtz-Zentrum Dresden-Rossendorf
+
+SPDX-License-Identifier: CC-BY-SA-4.0
+-->
+# Installing plugins from the marketplace using hermes init
+
+* Status: accepted
+* Deciders: nheeb
+* Date: 2025-03-04
+
+## Context and Problem Statement
+
+For a smooth user experience common plugins (those which are on the marketplace) should be installable via `hermes init`. That however means we need to decide on a way for the plugins to ask question during that same init process.
+
+## Considered Options
+
+* **Full install**: Plugins are installed locally during `hermes init`, can hook into the init process, and ask questions themselves to adjust the `hermes.toml` or similar.
+* **No install**: Plugins are only added to the CI pipeline as `pip install ...` lines. Additional questions for the init process could be added in the marketplace input mask along with a property name under which the answer is stored in the `hermes.toml`.
+* **Partial install**: Plugins are only added to the CI pipeline as `pip install ...` lines. Additional questions for the init process are handled in a "detached" script that is downloaded, executed locally, and then deleted again (this script may only have dependencies of Hermes).
+
+## Decision Outcome
+
+Chosen option: "**Partial install**", because it is a good trade-off between giving plugins more controll over their init process and not being too invasive with local installs.
+
+## Pros and Cons of the Options
+
+### Full install
+- (+) Plugins have a lot of control over how they design their own init process.
+- (+) The plugin can be used locally on the device directly if the user intends to do so.
+- (-) The plugin might be installed unnecessarily, as locally only the init part may be executed.
+- (-) The plugin may introduce many dependencies that the user doesn’t necessarily need.
+- (-) There could be environment complications (e.g., if Hermes was installed with `pipx`).
+
+### No install
+- (+) Nothing is installed locally via `hermes init`.
+- (+) Overall, slightly less effort for the init command and plugin developers.
+- (-) The marketplace would need input masks for an arbitrary number of such questions.
+- (-) Plugins have little control over how they design their own init process.
+- (-) Plugins intended for local use must be installed manually.
+
+### Partial install
+- (+) Nothing is installed locally via `hermes init`.
+- (+) Plugins have relatively high control over how they design their own init process.
+- (-) Plugins intended for local use must be installed manually.

docs/adr/0014-standardized-provenance-recording.md

@@ -0,0 +1,62 @@
+<!--
+SPDX-FileCopyrightText: 2025 German Aerospace Center (DLR), Forschungszentrum Jülich, Helmholtz-Zentrum Dresden-Rossendorf
+
+SPDX-License-Identifier: CC-BY-SA-4.0
+-->
+# Standardized provenance recording
+
+* Status: proposed
+* Deciders: sdruskat, skernchen, notactuallyfinn
+* Date: 2025-10-17
+
+Technical story: 
+* https://github.com/softwarepub/hermes/pull/442
+* https://github.com/softwarepub/hermes/issues/363
+
+## Context and Problem Statement
+
+To consolidate traceability of the metadata, and resolution based on metadata sources in case of duplicates, etc., we need to record the provenance of metadata values in a __standardized__ way.
+To achieve this, we use the [PROV-O ontology](https://www.w3.org/TR/prov-o/) serialized as [JSON-LD](https://www.w3.org/TR/json-ld/). Additionally, HERMES should make it possible to record as much of the provenance as possible *centrally*, i.e., as part of the core codebase. This is to keep plugin developers from having to supply their own provenance solutions.
+
+To do this, we need to specify what provenance information is recorded and how it can be implemented in HERMES to make it easy to use.
+
+## Considered Options
+
+* Provide HERMES API-methods that also document themselves
+
+## Decision Outcome
+
+Chosen option:
+
+## Pros and Cons of the Options
+
+### Provide HERMES API-methods that also document themselves
+
+Provide API-methods for loading, writing, making web requests, etc. that document themselves.<br>
+Those methods take also the function that should be used for the task at hand and just define a framework in which we implement the provenance-data recording.<br>
+Like so:
+```python
+class HermesPlugin():
+    def load(func, path: str, *args, **kwargs):
+        # TODO: handle and record byte formats properly
+        with open(path) as fi:
+            data = func(fi, *args, **kwargs)
+        prov.record("load", path, func.__name__, data) # also module of func
+        return data
+
+    def write(func, path: str, data, *args, **kwargs):
+        # TODO: handle and record byte formats properly
+        with open(path) as fi:
+            func(fi, data, *args, **kwargs)
+        prov.record("write", path, func.__name__, data) # also module of func
+```
+
+* Good, because allows for recording of provenance information of the plugins
+* Good, because it isn't making plugin development harder
+* Bad, because API methods may not cover all I/O functionality python provides
+* Bad, because it doesn't cover merging, mapping, etc.  
+
+All provenance information should be recorded in the following format where addtional properties of agents, activites and entities are values of suitable vocabularies (from Schema.org, CodeMeta and potentially other schemas):
+
+![](./hermes-prov-diagram/hermes-prov.svg)<br>
+source: [hermes-prov.drawio](./hermes-prov-diagram/hermes-prov.drawio)