Project updates

.github/workflows/ci.yml

@@ -1,47 +1,81 @@
 ---
 name: CI
 
+permissions:
+  contents: read
+
 on:
   push:
-    branches: ["master"]
+    branches: ["main"]
   pull_request:
-    branches: ["master"]
+    branches: ["main"]
   workflow_dispatch:
 
+env:
+  FORCE_COLOR: "1"
+  UV_PYTHON_DOWNLOADS: "false"
+  UV_NO_SYNC: "true"
+
 jobs:
+  pre-commit:
+    name: "pre-commit"
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: "actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10" # v6.0.3
+        with:
+          persist-credentials: false
+      - uses: "j178/prek-action@bdca6f102f98e2b4c7029491a53dfd366469e33d" # v2.0.4
+
   tests:
     name: "Python ${{ matrix.python-version }}"
     runs-on: "ubuntu-latest"
 
     strategy:
       fail-fast: false
       matrix:
-        python-version: ["3.9", "3.10", "3.11", "3.12", "3.13"]
+        python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]
 
     steps:
-      - uses: "actions/checkout@v5"
-      - uses: "astral-sh/setup-uv@v6"
+      - uses: "actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10" # v6.0.3
         with:
-          enable-cache: true
-      - uses: "actions/setup-python@v6"
+          persist-credentials: false
+      - uses: "actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405" # v6.2.0
         with:
           python-version: "${{ matrix.python-version }}"
+          allow-prereleases: true
+      - uses: "astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39" # v8.2.0
+        with:
+          enable-cache: true
       - name: "Install dependencies"
         run: |
-          set -xe
           python -VV
-          rustc --version
           python -m site
           uv --version
-          uv sync --no-install-project --no-dev --group nox --group coverage
+          uv sync --only-group nox --only-group coverage
       - name: "Run nox targets for ${{ matrix.python-version }}"
         run: "uv run nox --python ${{ matrix.python-version }}"
       - name: "Convert coverage"
         run: |
           uv run coverage combine
           uv run coverage xml
       - name: "Upload coverage to Codecov"
-        uses: codecov/codecov-action@v5
+        uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1
         with:
           fail_ci_if_error: true
           token: ${{ secrets.CODECOV_TOKEN }}
+
+  required:
+    name: "all required checks passed"
+    runs-on: "ubuntu-latest"
+    if: always()
+
+    needs:
+      - pre-commit
+      - tests
+
+    steps:
+      - name: Decide whether the needed jobs succeeded or failed
+        uses: re-actors/alls-green@05ac9388f0aebcb5727afa17fcccfecd6f8ec5fe # v1.2.2
+        with:
+          jobs: ${{ toJSON(needs) }}

.github/workflows/python-publish.yml

@@ -5,22 +5,28 @@ on:
     tags:
       - "*"
 
+permissions:
+  contents: read
+
 jobs:
   deploy:
     runs-on: ubuntu-latest
+    environment: publish
     permissions:
       id-token: write
+      attestations: write
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
+      - uses: "astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39" # v8.2.0
+        with:
+          enable-cache: false
       - name: Set up Python
-        uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: "3.x"
-      - name: Install dependencies
-        run: |
-          python -m pip install --upgrade pip
-          pip install setuptools wheel build
       - name: Build
-        run: "python -m build"
+        run: "uv build"
       - name: Publish
-        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0
+        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0

.pre-commit-config.yaml

@@ -1,6 +1,6 @@
 repos:
   - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v5.0.0
+    rev: v6.0.0
     hooks:
       - id: check-toml
       - id: check-yaml
@@ -10,29 +10,21 @@ repos:
       - id: trailing-whitespace
         args: [--markdown-linebreak-ext=md]
   - repo: https://github.com/rbubley/mirrors-prettier
-    rev: v3.5.3
+    rev: v3.8.3
     hooks:
       - id: prettier
   - repo: https://github.com/pycqa/doc8
-    rev: v1.1.2
+    rev: v2.0.0
     hooks:
       - id: doc8
         exclude: README\.rst
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.11.7 # also update pyproject.toml
+    rev: v0.15.16 # also update pyproject.toml
     hooks:
-      - id: ruff
+      - id: ruff-check
         args: [--fix]
       - id: ruff-format
   - repo: https://github.com/astral-sh/uv-pre-commit
-    rev: 0.6.17
+    rev: 0.11.19
     hooks:
       - id: uv-lock
-      - id: uv-export
-        args:
-          - --frozen
-          - --no-dev
-          - --group=docs
-          - --no-emit-project
-          - --no-annotate
-          - --output-file=docs/requirements.txt

.readthedocs.yaml

@@ -1,15 +1,16 @@
 version: 2
 
 build:
-  os: ubuntu-22.04
+  os: ubuntu-26.04
   tools:
     python: "3.13"
 
 python:
   install:
-    - method: pip
-      path: .
-    - requirements: docs/requirements.txt
+    - method: uv
+      command: sync
+      groups:
+        - docs
 
 sphinx:
   configuration: docs/conf.py