build: bump editorconfig-checker, ruff, and pyright action defaults

[kyle-sexton]

Absorbs the three tool-version drifts flagged by the weekly drift check — each re-verified as still the latest stable upstream at PR time:

• editorconfig-checker 3.7.0 → 3.8.0 (binary-install lane). The paired sha256: default is recomputed from the v3.8.0 ec-linux-amd64.tar.gz release asset (downloaded and hashed locally: 613bd88f34165a334adcb6b7e92a123c9de0eada65846d31af63613b779ff3be) and verified against upstream's published checksums.txt for the release — the two match.
• ruff 0.15.19 → 0.15.20 (uvx lane, no checksum).
• pyright 1.1.410 → 1.1.411 (uvx lane, no checksum).

Consumers pick the new defaults up when they re-pin.

Closes #45

🤖 Generated with Claude Code

https://claude.ai/code/session_017K9RRMdUKD7HLExmHwMXAe

---

Note

Low Risk
CI-only default version bumps with no application or auth logic changes; editorconfig SHA256 stays aligned with the pinned binary release.

Overview
Bumps default tool versions in three composite GitHub Actions so consumers get current releases when they rely on action defaults (or re-pin).

editorconfig default version moves 3.7.0 → 3.8.0, with the paired sha256 default updated for the ec-linux-amd64.tar.gz asset. ruff default 0.15.19 → 0.15.20; pyright default 1.1.410 → 1.1.411. No changes to install/run steps—only input defaults.

^{Reviewed by Cursor Bugbot for commit 4839ba9. Bugbot is set up for automated code reviews on this repo. Configure here.}

[claude]

Claude finished @kyle-sexton's task in 1m 8s —— View job

---

PR Review

• Gather context and read changed files
• Review version bumps and SHA checksum
• Verify alignment with CLAUDE.md guidelines
• Post findings

---

Summary

Three minimal, mechanical bumps across three action defaults. The changes are correct, follow the project's established patterns, and raise no concerns.

---

editorconfig-checker 3.7.0 → 3.8.0

action.yml L33–L39

• Both SHA256 values are correctly formatted (64 hex characters). The new hash (613bd88f…) is updated atomically with the version, matching the in-file requirement: "Change together with version".
• The PR body claims the new hash was cross-verified against upstream's checksums.txt for v3.8.0. That's the correct verification procedure for this binary-install lane.

ruff 0.15.19 → 0.15.20 and pyright 1.1.410 → 1.1.411

ruff/action.yml L20 · pyright/action.yml L27

• Both are uvx lanes — version is embedded directly in the uvx "tool@${VERSION}" invocation, so no checksum is required or expected. Version-only changes are correct here.
• Both are patch-level bumps; risk is low.

CLAUDE.md alignment

• No uses: SHA pins were touched. The existing pins (astral-sh/setup-uv@fac544c…) remain in place and unchanged — only the version: input defaults were updated, which is exactly what CLAUDE.md describes as the operator's job for tool-version drift absorption.
• This PR follows the documented workflow precisely: the tool-version-drift-check advisory flagged the drift; the operator recomputed the sha256: for the binary-install lane and bumped all three defaults together.

Verdict

No issues found. All changes are correct, minimal, and consistent with the project's pinning and drift-absorption conventions. ✓

[cursor]

Risk: low. Cursor Bugbot passed with no findings. Approved — routine tool version default bumps with matching checksum update. No reviewers assigned.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}