Dev script updates and check vs new dependencies

.github/workflows/build.yml

@@ -6,7 +6,7 @@ permissions:
 
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
-  UV_VERSION: "0.11.16"
+  UV_VERSION: "0.11.21"
   UV_PROJECT_ENVIRONMENT: venv
 
 concurrency:

.github/workflows/codeql.yml

@@ -6,7 +6,7 @@ permissions:
 
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
-  UV_VERSION: "0.11.16"
+  UV_VERSION: "0.11.21"
   UV_PROJECT_ENVIRONMENT: venv
 
 concurrency:

.github/workflows/deploy.yml

@@ -5,7 +5,7 @@ permissions:
 
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
-  UV_VERSION: "0.11.16"
+  UV_VERSION: "0.11.21"
   UV_PROJECT_ENVIRONMENT: venv
 
 concurrency:

.github/workflows/docs.yml

@@ -5,7 +5,7 @@ permissions:
 
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
-  UV_VERSION: "0.11.16"
+  UV_VERSION: "0.11.21"
   UV_PROJECT_ENVIRONMENT: venv
 
 concurrency:

.github/workflows/supply-chain.yml

@@ -6,7 +6,7 @@ permissions:
 
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
-  UV_VERSION: "0.11.16"
+  UV_VERSION: "0.11.21"
   UV_PROJECT_ENVIRONMENT: venv
   PIP_AUDIT_VERSION: "2.10.0"
 

.github/workflows/test.yml

@@ -6,7 +6,7 @@ permissions:
 
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
-  UV_VERSION: "0.11.16"
+  UV_VERSION: "0.11.21"
   UV_PROJECT_ENVIRONMENT: venv
 
 concurrency:

.github/workflows/zizmor.yml

@@ -6,7 +6,7 @@ permissions:
 
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
-  UV_VERSION: "0.11.16"
+  UV_VERSION: "0.11.21"
   ZIZMOR_VERSION: "1.25.2"
 
 concurrency:
@@ -39,13 +39,21 @@ jobs:
         with:
           version: ${{ env.UV_VERSION }}
 
-      - name: Run zizmor
+      - name: Run zizmor audit
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          ZIZMOR_VERSION: ${{ env.ZIZMOR_VERSION }}
+        run: uvx zizmor==${ZIZMOR_VERSION} --strict-collection --pedantic .
+
+      - name: Generate zizmor SARIF report
+        if: always()
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           ZIZMOR_VERSION: ${{ env.ZIZMOR_VERSION }}
         run: uvx zizmor==${ZIZMOR_VERSION} --strict-collection --pedantic --format=sarif . > results.sarif
 
       - name: Upload SARIF file
+        if: always()
         uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
         with:
           sarif_file: results.sarif

.pre-commit-config.yaml

@@ -8,7 +8,7 @@ repos:
       - id: uv-lock
         args: [ --check ]
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.15.17
+    rev: v0.15.18
     hooks:
       - id: ruff-check
         args: [ --fix, --exit-non-zero-on-fix ]
@@ -63,8 +63,13 @@ repos:
         exclude: ^docs/build/|^docs/_build/|docs/source/api/generated/
       - id: fix-byte-order-marker
         exclude: ^docs/build/|^docs/_build/|docs/source/api/generated/
-  - repo: https://github.com/woodruffw/zizmor-pre-commit
-    rev: v1.25.2
+  - repo: local
     hooks:
       - id: zizmor
-        args: [--strict-collection, --pedantic]
+        name: zizmor
+        entry: scripts/run-zizmor.sh
+        language: system
+        require_serial: true
+        pass_filenames: false
+        files: (\.github/(workflows/.*|dependabot\.ya?ml|zizmor\.yml))|(action\.ya?ml)$
+        args: [--strict-collection, --pedantic, .]

Makefile

@@ -1,5 +1,8 @@
 .ONESHELL:
 
+UV_VERSION ?= 0.11.21
+PIP_AUDIT_VERSION ?= 2.10.0
+
 .PHONY: all install update test lint audit clean builddocs servedocs cleandocs
 
 all: install
@@ -8,7 +11,7 @@ install:
 	python -m venv ./venv
 	venv/bin/python --version
 	venv/bin/python -m pip install --upgrade pip
-	venv/bin/pip install uv
+	venv/bin/pip install uv==$(UV_VERSION)
 	@. venv/bin/activate && \
 	uv lock && \
 	uv sync --active --locked --extra dev --extra docs && \
@@ -17,7 +20,7 @@ install:
 update:
 	@. venv/bin/activate && \
 	python -m pip install --upgrade pip && \
-	pip install --upgrade uv && \
+	pip install --upgrade uv==$(UV_VERSION) && \
 	uv lock --upgrade && \
 	uv sync --active --locked --extra dev --extra docs
 
@@ -33,7 +36,7 @@ audit:
 	@. venv/bin/activate && \
 	uv lock --check && \
 	uv export --locked --extra dev --no-emit-project -o requirements-audit.txt && \
-	uvx pip-audit -r requirements-audit.txt && \
+	uvx pip-audit==$(PIP_AUDIT_VERSION) -r requirements-audit.txt && \
 	rm -f requirements-audit.txt
 
 clean:

make.ps1

@@ -14,6 +14,9 @@ param (
 
 $ErrorActionPreference = 'Stop'
 
+$UV_VERSION = "0.11.21"
+$PIP_AUDIT_VERSION = "2.10.0"
+
 # Ensure we run from repo root
 Push-Location (Split-Path -Parent $MyInvocation.MyCommand.Definition)
 
@@ -82,7 +85,7 @@ switch ($task) {
 
         # install tooling & deps
         python -m pip install --upgrade pip
-        python -m pip install uv
+        python -m pip install "uv==$UV_VERSION"
         uv lock
         uv sync --active --locked --extra dev --extra docs
         pre-commit install
@@ -92,7 +95,7 @@ switch ($task) {
         . .\venv\Scripts\Activate.ps1
         Ensure-PythonPath
         python -m pip install --upgrade pip
-        pip install --upgrade uv
+        pip install --upgrade "uv==$UV_VERSION"
         uv lock --upgrade
         uv sync --active --locked --extra dev --extra docs
     }
@@ -102,7 +105,7 @@ switch ($task) {
         Ensure-PythonPath
         uv lock --check
         uv export --locked --extra dev --no-emit-project -o requirements-audit.txt
-        uvx pip-audit -r requirements-audit.txt
+        uvx "pip-audit==$PIP_AUDIT_VERSION" -r requirements-audit.txt
         Remove-Item -Force requirements-audit.txt
     }
 

pyproject.toml

@@ -69,7 +69,7 @@ dev = [
     "pytest>=9.1.0",
     "pytest-cov>=7.1.0",
     "pytest-xdist>=3.8.0",
-    "ruff==0.15.17",
+    "ruff==0.15.18",
     "types-openpyxl>=3.1.2",
     "scipy-stubs>=1.14.1.0",
     "types-python-dateutil>=2.8.2",

scripts/run-zizmor.sh

@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+readonly ZIZMOR_VERSION=1.25.2
+
+if [[ -z "${GH_TOKEN:-}" && -z "${GITHUB_TOKEN:-}" ]]; then
+  if command -v gh >/dev/null 2>&1 && gh auth status >/dev/null 2>&1; then
+    export GH_TOKEN="$(gh auth token)"
+  fi
+fi
+
+if [[ -z "${GH_TOKEN:-}" && -z "${GITHUB_TOKEN:-}" ]]; then
+  echo "zizmor: no GitHub token available; running offline audits only" >&2
+fi
+
+exec uvx "zizmor==${ZIZMOR_VERSION}" --no-progress "$@"