👷 Add trusted publishing and other CI improvements

.github/dependabot.yml

@@ -0,0 +1,10 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+    groups:
+      github-actions:
+        patterns:
+          - "*"

.github/workflows/CD.yml

@@ -1,19 +1,18 @@
-# This workflows will upload a Python Package using Twine when a release is created
-# For more information see: https://help.github.com/en/actions/language-and-framework-guides/using-python-with-github-actions#publishing-to-package-registries
-
 name: CD
 
 on:
   release:
-    types: [released, prereleased]
+    types: [prereleased, released]
 
 jobs:
   deploy:
-
     runs-on: ubuntu-latest
+    permissions:
+      contents: write  # softprops/action-gh-release
+      id-token: write  # pypa/gh-action-pypi-publish
 
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v4
       with:
         fetch-depth: 0
 
@@ -24,15 +23,20 @@ jobs:
 
     - name: Install dependencies
       run: |
-        pip install -U pip setuptools wheel twine build
+        pip install -U pip setuptools wheel build
 
-    - name: Build and publish
-      env:
-        TWINE_USERNAME: ${{ secrets.PYPI_USERNAME }}
-        TWINE_PASSWORD: ${{ secrets.PYPI_PASSWORD }}
+    - name: Build package distributions
       run: |
         python -m build
-        twine upload dist/*
+
+    - name: Upload package distributions as release assets
+      uses: softprops/[email protected]
+      with:
+        files: dist/*
+
+    # https://github.com/pypa/gh-action-pypi-publish#trusted-publishing
+    - name: Publish package distributions to PyPI
+      uses: pypa/[email protected]
 
     - uses: apexskier/github-release-commenter@v1
       with:

.github/workflows/CI.yml

@@ -1,11 +1,8 @@
-# This workflow will install Python dependencies, run tests and lint with a variety of Python versions
-# For more information see: https://help.github.com/actions/language-and-framework-guides/using-python-with-github-actions
-
 name: CI
 on:
   pull_request:
   push:
-    branches: master
+    branches: [master]
 
 jobs:
   autocancel:

.pre-commit-config.yaml

@@ -9,7 +9,7 @@ repos:
     additional_dependencies: ['gibberish-detector']
 
 - repo: https://github.com/astral-sh/ruff-pre-commit
-  rev: v0.1.4
+  rev: v0.1.6
   hooks:
   - id: ruff
     args: [--fix, --exit-non-zero-on-fix]
@@ -56,3 +56,9 @@ repos:
   - id: check-xml
   - id: check-yaml
   - id: debug-statements
+
+- repo: https://github.com/python-jsonschema/check-jsonschema
+  rev: 0.27.1
+  hooks:
+  - id: check-dependabot
+  - id: check-github-workflows

pyproject.toml

@@ -49,12 +49,22 @@ filterwarnings = ["ignore::DeprecationWarning"]
 
 [tool.ruff]
 select = ["ALL"]
-ignore = ["D407", "E501", "ANN", "TRY003", "D203", "D213", "FIX002"] # ignores: D407 (we have google style docstrings), E501 (we have black), ANN (we have mypy), TRY003 (there is EM102), D203 (there is D211), D213 (there is D212), FIX002 (we have TD002,TD003)
-target-version = "py38"
+ignore = [
+  "D107", # we have pydoclint with class docstring
+  "D407", # we have google style docstrings
+  "E501", # we have black
+  "ANN", # we have mypy
+  "TRY003", # there is EM102
+  "D203", # there is D211
+  "D213", # there is D212
+  "FIX002" # there is TD002,TD003
+]
 
 [tool.ruff.extend-per-file-ignores]
 "__init__.py" = ["E401", "E402"]
-"**/tests/**/*.py" = ["S101", "D100", "D104"]
+"**/tests/**/*.py" = [
+  "S101" # assert is fine in tests
+]
 
 [tool.ruff.isort]
 known-first-party = ["tests"]