[smarlhens]

Summary

#	Commit	What
1	43c44c5	astral-sh/setup-uv v10.0.0 → v10.3.3
2	3677e74	Add actionlint & zizmor workflows (same setup as my other repos), .github/actionlint.yaml for the ubuntu-26.04 label, actionlint pre-commit hook; permissions: {} at workflow level + least-privilege job permissions, persist-credentials: false on every checkout
3	5bf9128	Pin every workflow action to a commit sha (# vX.Y.Z comment, Renovate keeps digests updated)
4	6400221	ty v0.0.71 → v0.0.95 & uv 0.12.3 → 0.13.6 (Dockerfile, uv_build, required-version); promote the 18 ty rules added since the strict profile was written (v0.0.35) to error
5	6e1a15a	Python 3.14.7 → 3.15.2, requires-python >=3.15, ruff target-version = "py315"
6	dad3b1a	ruff v0.16.3 → v0.17.3, mypy v2.3.0 → v2.4.1, pytest 9.1.1 → 9.2.0, oxfmt v0.63.0 → v0.74.0
7	916f6db	uv lock --upgrade (coverage, iniconfig, pluggy, pygments)
8	07c0046	zizmor: skip SARIF upload on fork PRs (read-only token), findings are printed instead

Notes

• ty & uv in one commit: ty-pre-commit pins its own uv (v0.0.71 → uv==0.12.3), so bumping required-version to >=0.13.6 alone breaks the ty hook; v0.0.95 ships uv==0.13.6.
• uv 0.13: breaking changes (3.15 default Python, constraints-file hash/editable handling, Windows ARM64) don't affect this repo; uv_build config unchanged.
• ruff 0.17 drops the DTZ rules from its defaults; they were never in extend-select, so not re-added.
• zizmor: 0 findings after the hardening & pinning (zizmor --offline .github/workflows/); actionlint clean.
• Docker image build not verified locally (registry/DNS blocked on my machine); relying on the build-image job.

Test plan

• pre-commit run --all-files on every commit
• actionlint & zizmor clean
• uv build on 3.15.2
• CI green (lint-and-test, build, build-image, codeql, actionlint, zizmor)

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.