Centralize project configuration and streamline releases

.github/workflows/pythonpackage.yml

@@ -1,56 +1,55 @@
-# This workflow will install Python dependencies, run tests and lint with a variety of Python versions
-# For more information see: https://help.github.com/actions/language-and-framework-guides/using-python-with-github-actions
-
 name: Tests
 
 on:
   push:
-    tags:
-      - "*"
     branches:
       - main
+    tags:
+      - "*"
   pull_request:
   workflow_dispatch:
   schedule:
     - cron: "0 0 1 * *"
 
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ${{ matrix.os }}
+    permissions:
+      contents: read
+      id-token: write # OIDC auth to codecov
     strategy:
       fail-fast: false
       matrix:
-        python-version: [
-            "3.10",
-            "3.11",
-            "3.12",
-            "3.13",
-        ]
+        python-version: ["3.10", "3.11", "3.12", "3.13"]
         os: [ubuntu-latest, macOS-latest, windows-latest]
     steps:
-    - name: Checkout
-      uses: actions/checkout@v4
-      with:
-        fetch-depth: 100
-        persist-credentials: false
-    - name: Fetch git tags
-      run: git fetch origin 'refs/tags/*:refs/tags/*'
-    - name: Set up Python ${{ matrix.python-version }}
-      uses: actions/setup-python@v5
-      with:
-        python-version: ${{ matrix.python-version }}
-    - name: Build Wheel and Install
-      run: pip install -e .
-    - name: Test Report Generation with No Dependencies
-      run: python -c "import scooby;scooby.doo();"
-    - name: Install testing requirements
-      run: pip install -r requirements_test.txt
-    - name: Test Entire API
-      run: make apitest
-    - name: Doctests
-      run: make doctest
-    - uses: codecov/codecov-action@v4
-      with:
-        token: ${{ secrets.CODECOV_TOKEN }}
-        files: coverage.xml
-        verbose: true
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+          fetch-tags: true
+          persist-credentials: false
+      - name: Install uv
+        uses: astral-sh/setup-uv@v8.1.0
+        with:
+          enable-cache: false
+      - name: Set up Python ${{ matrix.python-version }}
+        run: uv python install ${{ matrix.python-version }}
+      - name: Smoke test with no dependencies
+        run: |
+          uv run --no-project --isolated --python ${{ matrix.python-version }} --with . python -c "import scooby; scooby.doo()"
+      - name: Sync test dependencies
+        run: uv sync --group test --python ${{ matrix.python-version }}
+      - name: Run tests
+        run: uv run --python ${{ matrix.python-version }} pytest -v --cov scooby --cov-report xml
+      - name: Run doctests
+        run: uv run --python ${{ matrix.python-version }} pytest -v --doctest-modules scooby
+      - name: Upload coverage to Codecov
+        uses: codecov/codecov-action@v6
+        with:
+          use_oidc: true
+          files: coverage.xml
+          verbose: true

.github/workflows/release.yml

@@ -1,38 +1,83 @@
-name: Package Release
+name: Build
+
 on:
-  push:
-    tags: "*"
   release:
-    types: [released]
+    types: [published]
+  push:
+    branches:
+      - main
+    tags:
+      - "*"
+  pull_request:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
 jobs:
-  publish:
+  package:
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     steps:
-      - name: Checkout
-        uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
-          fetch-depth: 100
+          fetch-depth: 0
+          fetch-tags: true
           persist-credentials: false
-      - name: Fetch git tags
-        run: git fetch origin 'refs/tags/*:refs/tags/*'
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
-          python-version: "3.10"
-      - name: Install dependencies
+          python-version: "3.13"
+      - name: Install build tooling
         run: |
           python -m pip install --upgrade pip
-          pip install setuptools setuptools_scm wheel twine
-      - name: Build and Install Wheel
+          pip install --upgrade build setuptools_scm twine
+      - name: Show resolved version
         run: |
-          python setup.py bdist_wheel
-          pip install dist/scooby*.whl
-      - name: Test Report Generation with No Dependencies
-        run: python -c "import scooby;scooby.Report();"
-      - name: Build and Publish to PyPI
-        env:
-          TWINE_USERNAME: __token__
-          TWINE_PASSWORD: ${{ secrets.PYPI_API_TOKEN }}
+          echo "git describe: $(git describe --tags --always --dirty)"
+          echo "setuptools_scm: $(python -m setuptools_scm)"
+      - name: Build package
+        run: python -m build
+      - name: Verify wheel version matches tag
+        if: startsWith(github.ref, 'refs/tags/')
         run: |
-          python setup.py sdist
-          twine upload --skip-existing dist/scooby*
+          set -euo pipefail
+          tag="${GITHUB_REF_NAME#v}"
+          wheel_version="$(python -m setuptools_scm)"
+          echo "tag (normalized): $tag"
+          echo "wheel version:    $wheel_version"
+          if [ "$tag" != "$wheel_version" ]; then
+            echo "::error::Wheel version '$wheel_version' does not match tag '$tag'"
+            exit 1
+          fi
+      - name: Check package
+        run: twine check --strict dist/*
+      - name: Smoke test wheel
+        run: |
+          pip install dist/scooby*.whl
+          python -c "import scooby; scooby.Report()"
+      - uses: actions/upload-artifact@v7
+        with:
+          name: dist
+          path: dist
+
+  pypi:
+    needs: package
+    runs-on: ubuntu-latest
+    # Publish when either a GitHub Release is published or a tag is pushed.
+    if: |
+      github.event_name == 'release' ||
+      (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/'))
+    environment:
+      name: pypi
+      url: https://pypi.org/p/scooby
+    permissions:
+      id-token: write # OIDC for trusted publishing
+    steps:
+      - uses: actions/download-artifact@v8
+        with:
+          name: dist
+          path: dist
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1

.github/zizmor.yml

@@ -0,0 +1,5 @@
+rules:
+  unpinned-uses:
+    config:
+      policies:
+        "*": ref-pin

.gitignore

@@ -1,37 +1,49 @@
-# Compiled source #
-###################
+# Compiled source
 *.pyc
 *.pyd
 *.so
 *.o
+__pycache__/
 
-# Pip generated folders #
-#########################
+# Setuptools_scm version file
+scooby/_version.py
+
+# Build / dist artifacts
 *.egg-info/
 build/
 dist/
-scooby/version.py
-
-# Mac
-.DS_Store
 
-# testing coverage and cache
+# Testing / coverage
 .pytest_cache/
-tests/.coverage
-tests/htmlcov/
-tests/dummy_module/
+.coverage
+coverage.xml
+htmlcov/
+*,cover
 
-# windows
-test.bat
+# Tooling caches
+.ruff_cache/
+.mypy_cache/
+.tox/
 
-# Jupyter notebook cache
+# Virtual environments
+.venv/
+venv/
+
+# uv
+uv.lock
+
+# Jupyter
 **/.ipynb_checkpoints
 
-# Code coverage results
-htmlcov
-.coverage
-coverage.xml
-*,cover
+# Editors / OS
+.vscode/
+.idea/
+.DS_Store
+*~
+*.swp
 
-.tox
-venv
+# Project-local test detritus
+tests/.coverage
+tests/htmlcov/
+tests/dummy_module/
+test.bat

.pre-commit-config.yaml

@@ -1,34 +1,65 @@
+# Integration with pre-commit.ci
+ci:
+  autoupdate_commit_msg: "chore: update pre-commit hooks"
+  autofix_commit_msg: "style: pre-commit fixes"
+  autofix_prs: true
+  autoupdate_schedule: monthly
+
 repos:
-- repo: https://github.com/astral-sh/ruff-pre-commit
-  rev: v0.15.11
-  hooks:
-    - id: ruff-check
-      args: [--fix, --show-fixes]
-    - id: ruff-format
+  - repo: https://github.com/astral-sh/ruff-pre-commit
+    rev: v0.15.11
+    hooks:
+      - id: ruff-check
+        args: [--fix, --show-fixes]
+      - id: ruff-format
 
--   repo: https://github.com/codespell-project/codespell
+  - repo: https://github.com/codespell-project/codespell
     rev: v2.4.2
     hooks:
-    -   id: codespell
-        args: ["doc examples examples_flask pyvista tests", "*.py *.rst *.md"]
+      - id: codespell
+        additional_dependencies: ["tomli"]
 
--   repo: https://github.com/pycqa/pydocstyle
-    rev: 6.3.0
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v6.0.0
     hooks:
-    -   id: pydocstyle
-        additional_dependencies: [toml==0.10.2]
-        files: ^scooby/
+      - id: check-added-large-files
+      - id: check-case-conflict
+      - id: check-docstring-first
+      - id: check-merge-conflict
+      - id: check-toml
+      - id: check-yaml
+      - id: debug-statements
+      - id: end-of-file-fixer
+      - id: mixed-line-ending
+      - id: requirements-txt-fixer
+      - id: trailing-whitespace
 
-# - repo: https://github.com/pre-commit/mirrors-mypy
-#   rev: v1.18.2
-#   hooks:
-#     - id: mypy
-#       files: ^scooby/
+  - repo: https://github.com/rbubley/mirrors-prettier
+    rev: v3.8.3
+    hooks:
+      - id: prettier
+        types_or: [yaml, markdown, json]
 
--   repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v6.0.0
+  - repo: https://github.com/python-jsonschema/check-jsonschema
+    rev: 0.37.1
+    hooks:
+      - id: check-github-workflows
+
+  - repo: https://github.com/zizmorcore/zizmor-pre-commit
+    rev: v1.24.1
+    hooks:
+      - id: zizmor
+
+  - repo: https://github.com/ComPWA/taplo-pre-commit
+    rev: v0.9.3
     hooks:
-    -   id: check-merge-conflict
-    -   id: debug-statements
-  # - id: no-commit-to-branch
-  #   args: [--branch, main]
+      - id: taplo-format
+        args:
+          [
+            --option,
+            "reorder_arrays=true",
+            --option,
+            "reorder_keys=true",
+            --option,
+            "align_comments=false",
+          ]