pgq · markokr · Jun 13, 2026 · Jun 12, 2026 · Jun 12, 2026 · Jun 12, 2026
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
@@ -0,0 +1,15 @@
+#
+# https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-options-reference
+#
+
+version: 2
+
+updates:
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+    cooldown:
+      default-days: 7
+
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -3,17 +3,11 @@
 # https://github.com/actions
 # https://cibuildwheel.readthedocs.io/en/stable/options/
 #
-# uses: https://github.com/actions/checkout @v4
-# uses: https://github.com/actions/setup-python @v4
-# uses: https://github.com/actions/download-artifact @v3
-# uses: https://github.com/actions/upload-artifact @v3
-# uses: https://github.com/pypa/cibuildwheel @v2.16
 
 name: CI
 
 on:
   pull_request: {}
-  push: {}
 
 jobs:
 
@@ -23,17 +17,16 @@ jobs:
     strategy:
       matrix:
         test:
-          - {PY: "3.10", TOXENV: "lint"}
+          - {PY: "3.14", TOXENV: "lint"}
     steps:
       - name: "Checkout"
-        uses: actions/checkout@v4
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: "Setup Python ${{matrix.test.PY}}"
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: ${{matrix.test.PY}}
-
-      - run: python3 -m pip install -r etc/requirements.build.txt --disable-pip-version-check
+          pip-install: -r etc/requirements.build.txt
 
       - name: "Test"
         env:
@@ -46,35 +39,24 @@ jobs:
     strategy:
       matrix:
         test:
-          - {os: "ubuntu-latest", osname: "Linux", PY: "3.7", TOXENV: "py37", arch: "x64"}
-          - {os: "ubuntu-latest", osname: "Linux", PY: "3.8", TOXENV: "py38", arch: "x64"}
-          - {os: "ubuntu-latest", osname: "Linux", PY: "3.9", TOXENV: "py39", arch: "x64"}
           - {os: "ubuntu-latest", osname: "Linux", PY: "3.10", TOXENV: "py310", arch: "x64"}
-          - {os: "ubuntu-latest", osname: "Linux", PY: "3.11", TOXENV: "py311", arch: "x64"}
-          - {os: "ubuntu-latest", osname: "Linux", PY: "3.12", TOXENV: "py312", arch: "x64"}
-          - {os: "macos-latest", osname: "MacOS", PY: "3.10", TOXENV: "py310", arch: "x64"}
-          - {os: "macos-latest", osname: "MacOS", PY: "3.11", TOXENV: "py311", arch: "x64"}
-          #- {os: "macos-latest", osname: "MacOS", PY: "3.12", TOXENV: "py312", arch: "x64"}
-          - {os: "windows-latest", osname: "Windows", PY: "3.7", TOXENV: "py37", arch: "x86"}
-          - {os: "windows-latest", osname: "Windows", PY: "3.8", TOXENV: "py38", arch: "x64"}
-          - {os: "windows-latest", osname: "Windows", PY: "3.10", TOXENV: "py310", arch: "x86"}
-          - {os: "windows-latest", osname: "Windows", PY: "3.11", TOXENV: "py311", arch: "x64"}
-          #- {os: "windows-latest", osname: "Windows", PY: "3.12", TOXENV: "py312", arch: "x64"}
-          - {os: "ubuntu-latest", osname: "Linux", PY: "pypy3.8", TOXENV: "pypy38", arch: "x64"}
-          - {os: "ubuntu-latest", osname: "Linux", PY: "pypy3.9", TOXENV: "pypy39", arch: "x64"}
-          - {os: "ubuntu-latest", osname: "Linux", PY: "pypy3.10", TOXENV: "pypy310", arch: "x64"}
+          - {os: "ubuntu-latest", osname: "Linux", PY: "3.13", TOXENV: "py313", arch: "x64"}
+          - {os: "ubuntu-latest", osname: "Linux", PY: "3.14", TOXENV: "py314", arch: "x64"}
+          - {os: "macos-latest", osname: "MacOS", PY: "3.12", TOXENV: "py312", arch: "x64"}
+          - {os: "macos-latest", osname: "MacOS", PY: "3.14", TOXENV: "py314", arch: "arm64"}
+          - {os: "windows-latest", osname: "Windows", PY: "3.13", TOXENV: "py313", arch: "x64"}
+          - {os: "windows-latest", osname: "Windows", PY: "3.14", TOXENV: "py314", arch: "x64"}
+          #- {os: "ubuntu-latest", osname: "Linux", PY: "pypy3.11", TOXENV: "pypy311", arch: "x64"}
     steps:
-      - name: "Checkout"
-        uses: actions/checkout@v4
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: "Setup Python ${{matrix.test.PY}}"
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: ${{matrix.test.PY}}
           architecture: ${{matrix.test.arch}}
           allow-prereleases: true
-
-      - run: python3 -m pip install -r etc/requirements.build.txt --disable-pip-version-check
+          pip-install: -r etc/requirements.build.txt
 
       - name: "Build"
         run: python setup.py build
@@ -90,23 +72,18 @@ jobs:
     strategy:
       matrix:
         test:
-          - {PY: "3.7", PG: "11", TOXENV: "py37"}
-          - {PY: "3.8", PG: "12", TOXENV: "py38"}
-          - {PY: "3.9", PG: "13", TOXENV: "py39"}
-          - {PY: "3.10", PG: "14", TOXENV: "py310"}
-          - {PY: "3.11", PG: "15", TOXENV: "py311"}
+          - {PY: "3.10", PG: "16", TOXENV: "py310"}
+          - {PY: "3.14", PG: "18", TOXENV: "py314"}
           #- {PY: "pypy3.9", PG: "15", TOXENV: "pypy39"}
           #- {PY: "pypy3.10", PG: "15", TOXENV: "pypy310"}
     steps:
-      - name: "Checkout"
-        uses: actions/checkout@v4
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: "Setup Python ${{matrix.test.PY}}"
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: ${{matrix.test.PY}}
-
-      - run: python3 -m pip install -r etc/requirements.build.txt --disable-pip-version-check
+          pip-install: -r etc/requirements.build.txt
 
       - name: "InstallDB"
         run: |
@@ -162,27 +139,20 @@ jobs:
     strategy:
       matrix:
         sys:
-          - {os: "ubuntu-latest", name: "Linux", archs: "auto", qemu: false}
-          - {os: "ubuntu-latest", name: "Linux", archs: "aarch64", qemu: true}
-          - {os: "macos-latest", name: "MacOS", archs: "x86_64 arm64 universal2", qemu: false}
-          - {os: "windows-latest", name: "Windows", archs: "auto", qemu: false}
+          - {os: "ubuntu-latest", name: "Linux", archs: "auto"}
+          - {os: "ubuntu-24.04-arm", name: "Linux", archs: "aarch64"}
+          - {os: "macos-15-intel", name: "MacOS", archs: "x86_64 universal2"}
+          - {os: "macos-latest", name: "MacOS", archs: "auto"}
+          - {os: "windows-latest", name: "Windows", archs: "auto"}
     steps:
-      - uses: actions/checkout@v4
-      - name: "Set up QEMU"
-        if: ${{matrix.sys.qemu}}
-        uses: docker/setup-qemu-action@v2
-        with:
-          platforms: all
-      - uses: pypa/cibuildwheel@v2.16
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: pypa/cibuildwheel@8d2b08b68458a16aeb24b64e68a09ab1c8e82084 # v3.4.1
         env:
           CIBW_ARCHS: "${{matrix.sys.archs}}"
-          # cp38: cp37-macos does not support universal2/arm64
-          CIBW_BUILD: "cp38-* pp*-manylinux_x86_64"
-          CIBW_SKIP: "pp37-*"
       - name: "Check"
         shell: bash
         run: |
           ls -l wheelhouse
-      - uses: actions/upload-artifact@v3
-        with: {name: "dist", path: "wheelhouse"}
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with: {name: "wheel-${{matrix.sys.os}}", path: "wheelhouse"}
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -13,57 +13,62 @@ jobs:
     name: "Build source package"
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v4
-        with: {python-version: "3.11"}
-      - run: python3 -m pip install -r etc/requirements.build.txt --disable-pip-version-check
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version: "3.14"
+          pip-install: -r etc/requirements.build.txt
       - run: python3 setup.py sdist
-      - uses: actions/upload-artifact@v3
-        with: {name: "dist", path: "dist"}
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with: {name: "sdist", path: "dist"}
 
   cibuildwheel:
     name: "Wheels: ${{matrix.sys.name}} [${{matrix.sys.archs}}]"
     runs-on: ${{matrix.sys.os}}
     strategy:
       matrix:
         sys:
-          - {os: "ubuntu-latest", name: "Linux", archs: "auto", qemu: false}
-          - {os: "ubuntu-latest", name: "Linux", archs: "aarch64", qemu: true}
-          - {os: "macos-latest", name: "MacOS", archs: "x86_64 arm64 universal2", qemu: false}
-          - {os: "windows-latest", name: "Windows", archs: "auto", qemu: false}
+          - {os: "ubuntu-latest", name: "Linux", archs: "auto"}
+          - {os: "ubuntu-24.04-arm", name: "Linux", archs: "aarch64"}
+          - {os: "macos-15-intel", name: "MacOS", archs: "x86_64 universal2"}
+          - {os: "macos-latest", name: "MacOS", archs: "auto"}
+          - {os: "windows-latest", name: "Windows", archs: "auto"}
     steps:
-      - uses: actions/checkout@v4
-      - name: "Set up QEMU"
-        if: ${{matrix.sys.qemu}}
-        uses: docker/setup-qemu-action@v2
-        with:
-          platforms: all
-      - uses: pypa/cibuildwheel@v2.16
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: pypa/cibuildwheel@8d2b08b68458a16aeb24b64e68a09ab1c8e82084 # v3.4.1
         env:
           CIBW_ARCHS: "${{matrix.sys.archs}}"
-          # cp38: cp37-macos does not support universal2/arm64
-          CIBW_BUILD: "cp38-* pp*-manylinux_x86_64"
-          CIBW_SKIP: "pp37-*"
       - name: "Check"
         shell: bash
         run: |
           ls -l wheelhouse
-      - uses: actions/upload-artifact@v3
-        with: {name: "dist", path: "wheelhouse"}
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with: {name: "wheel-${{matrix.sys.os}}", path: "wheelhouse"}
 
-  publish:
-    name: "Publish"
+  dist:
+    name: "Collect files"
     runs-on: ubuntu-latest
     needs: [sdist, cibuildwheel]
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v4
-        with: {python-version: "3.11"}
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with: { path: "dist", merge-multiple: true }
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with: {name: "dist", path: "dist"}
 
-      - run: python3 -m pip install -r etc/requirements.build.txt --disable-pip-version-check
+  publish-github:
+    name: "Publish to Github"
+    runs-on: ubuntu-latest
+    needs: [dist]
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version: "3.14"
+          pip-install: -r etc/requirements.build.txt
 
-      - name: "Get files"
-        uses: actions/download-artifact@v3
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with: {name: "dist", path: "dist"}
 
       - name: "Install pandoc"
@@ -73,6 +78,7 @@ jobs:
 
       - name: "Prepare"
         run: |
+          ls -l dist
           PACKAGE=$(python3 setup.py --name)
           VERSION=$(python3 setup.py --version)
           TGZ="${PACKAGE}-${VERSION}.tar.gz"
@@ -87,7 +93,7 @@ jobs:
           esac
 
           test "${{github.ref}}" = "refs/tags/v${VERSION}" || { echo "ERR: tag mismatch"; exit 1; }
-          test -f "dist/${TGZ}" || { echo "ERR: sdist failed"; exit 1; }
+          test -f "dist/${TGZ}" || { echo "ERR: sdist failed [dist/${TGZ}]"; ls -l dist; exit 1; }
           echo "PACKAGE=${PACKAGE}" >> $GITHUB_ENV
           echo "VERSION=${VERSION}" >> $GITHUB_ENV
           echo "TGZ=${TGZ}" >> $GITHUB_ENV
@@ -106,20 +112,33 @@ jobs:
           ghf="--notes-file=./tmp/note.md"
           if test "${DRAFT}" = "true"; then ghf="${ghf} --draft"; fi
           if test "${PRERELEASE}" = "true"; then ghf="${ghf} --prerelease"; fi
-          gh release create "v${VERSION}" "dist/${TGZ}" --title="${title}" ${ghf}
+          #gh release create "v${VERSION}" --title="${title}" ${ghf} dist/*
+          gh release create "v${VERSION}" --title="${title}" ${ghf} dist/${TGZ}
 
-      - name: "Upload to PYPI"
-        id: pypi_upload
-        env:
-          PYPI_TOKEN: ${{secrets.PYPI_TOKEN}}
-          PYPI_TEST_TOKEN: ${{secrets.PYPI_TEST_TOKEN}}
-        run: |
-          ls -l dist
-          if test "${DRAFT}" = "false"; then
-            python -m twine upload -u __token__ -p ${PYPI_TOKEN} \
-              --repository pypi --disable-progress-bar dist/*
-          else
-            python -m twine upload -u __token__ -p ${PYPI_TEST_TOKEN} \
-              --repository testpypi --disable-progress-bar dist/*
-          fi
+  publish-pypi:
+    if: ${{ !contains(github.ref_name, '.dev') }}
+    name: "Publish to PyPi"
+    runs-on: ubuntu-latest
+    needs: [dist]
+    permissions:
+      id-token: write
+    environment: pypi
+    steps:
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with: { name: "dist", path: "dist" }
+      - uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
+
+  publish-testpypi:
+    if: ${{ contains(github.ref_name, '.dev') }}
+    name: "Publish to TestPyPi"
+    runs-on: ubuntu-latest
+    needs: [dist]
+    permissions:
+      id-token: write
+    environment: testpypi
+    steps:
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with: { name: "dist", path: "dist" }
+      - uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
+        with: { repository-url: "https://test.pypi.org/legacy/" }
 
diff --git a/MANIFEST.in b/MANIFEST.in
@@ -1,6 +1,6 @@
 include skytools/py.typed
 include modules/*.[ch]
 include tests/*.py tests/*.ini
-include tox.ini .coveragerc .pylintrc
+include tox.ini .coveragerc
 include MANIFEST.in
 include README.rst NEWS.rst
diff --git a/Makefile b/Makefile
@@ -1,6 +1,7 @@
 
-VERSION = $(shell python3 setup.py --version)
-RXVERSION = $(shell python3 setup.py --version | sed 's/\./[.]/g')
+#VERSION = $(shell python3 setup.py --version)
+VERSION = $(shell sed -n -e '/^package_version/s/.* = "\(.*\)"/\1/p' skytools/installer_config.py)
+RXVERSION = $(shell echo "$(VERSION)" | sed 's/\./[.]/g')
 TAG = v$(VERSION)
 NEWS = NEWS.rst
 
@@ -46,3 +47,12 @@ shownote:
 showuses:
 	grep uses: .github/workflows/*.yml
 
+test-setup:
+	@set -e; \
+	for py in py310 py312 py314; do \
+	  for st in 77 78 79 80 81 82; do \
+	    env="$${py}-setuptools$${st}"; \
+	    echo "##### $${env} #####"; \
+	    tox -e $${py}-setuptools$${st}; \
+	  done; \
+	done
diff --git a/etc/requirements.build.txt b/etc/requirements.build.txt
@@ -1,4 +1,3 @@
-setuptools>=67
-wheel>=0.41
-twine==4.0.2
-tox==4.8.0
+setuptools>=77
+twine==6.0.1
+tox==4.55.0