Improved Github actions

[petermcd]

Improvements and guards for GitHub actions.

Summary by Sourcery

Harden GitHub Actions with broader validation, safer permissions, dependency review, and gated package publishing.

New Features:

• Add dependency review checks for pull requests targeting the main branch.
• Enable the shared validation workflow to run on a schedule and as a reusable workflow.
• Add a consolidated required-check status job and package lint dependencies.

Bug Fixes:

• Prevent CodeQL and zizmor SARIF uploads from failing on fork and Dependabot pull requests.
• Ensure publishing only runs after validation and successfully built distributions are available.

Enhancements:

• Expand CI validation across supported Python versions with locked dependencies and dedicated lint and audit jobs.
• Harden workflow permissions, concurrency handling, and artifact-based package publishing.
• Switch Dependabot configuration from pip to uv dependency management.

Build:

• Bump the package version to 1.3.5 and update the uv lockfile.

[sourcery-ai]

Reviewer's Guide

This PR hardens GitHub Actions by switching dependency management and validation to uv, adding dependency and security guards for restricted pull requests, expanding reusable test/lint/audit coverage, and restructuring publishing into checked, version-validated artifact build and least-privilege release stages.

Sequence diagram for checked release publishing

sequenceDiagram
    participant Release as Release
    participant Build as Build job
    participant UV as uv checks
    participant Artifact as dist artifact
    participant PyPI as PyPI
    Release->>Build: start build
    Build->>UV: run reusable checks
    UV-->>Build: checks result
    alt checks succeeded
        Build->>Build: Verify release tag matches package version
        Build->>Artifact: Upload distributions
        Artifact->>PyPI: Download distributions
        PyPI->>PyPI: Publish package distributions to PyPI
    else checks failed or tag mismatches
        Build-->>Release: stop publishing
    end

Loading

Flow diagram for expanded uv validation

flowchart TD
    Trigger[Push, pull request, schedule, or workflow call] --> Tests[pytest matrix: Python 3.12 to 3.14]
    Trigger --> Lint[Locked lint group: Ruff, Ty, Troml]
    Trigger --> Audit[uv audit]
    Tests --> Aggregate[all-checks]
    Lint --> Aggregate
    Audit --> Aggregate
    Aggregate -->|all jobs succeeded| Valid[Validation passes]
    Aggregate -->|any job fails or is cancelled| Invalid[Validation fails]

Loading

File-Level Changes

Change	Details	Files
Align dependency automation with uv and expand dependency/security checks.	Switch Dependabot’s ecosystem and grouping from pip to uv. Add a dependency-review workflow for main-branch pull requests, failing on moderate-or-higher severity. Guard CodeQL and zizmor SARIF uploads for fork and Dependabot pull requests. Pin third-party actions and minimize workflow permissions.	.github/dependabot.yml .github/workflows/codeql-analysis.yml .github/workflows/dependency-review.yml .github/workflows/zizmor.yml
Make the test workflow reusable, scheduled, and explicit about aggregate status.	Add workflow-call and weekly scheduled triggers. Test supported Python versions with non-failing-fast matrix execution and locked dependencies. Run linting and auditing in dedicated jobs using the uv lint dependency group. Add an always-run all-checks job that fails when any required job is unsuccessful. Adjust concurrency to avoid collisions with calling workflows.	.github/workflows/uv.yml pyproject.toml uv.lock
Separate release validation, artifact construction, and PyPI publication.	Run reusable checks before building and restrict the checks workflow to the canonical repository. Validate release tags against the package version. Build distributions once, pass them through an artifact, then publish from a separate environment with only OIDC write permission.	.github/workflows/publish.yml pyproject.toml
Bump the package version for the release.	Update the project version from 1.3.4 to 1.3.5 and refresh the lockfile accordingly.	pyproject.toml uv.lock

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[sourcery-ai]

Hey - I've found 1 issue

Prompt for AI Agents

Please address the comments from this code review:

## Individual Comments

### Comment 1
<location path=".github/workflows/publish.yml" line_range="43" />
<code_context>
       - name: Publish package distributions to PyPI
         uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
-        with:
-          skip-existing: true
</code_context>
<issue_to_address>
**issue (bug_risk):** A rerun of a release after any distribution has already been uploaded to PyPI fails because `skip-existing: true` was removed and the publisher now treats already-uploaded files as errors. This prevents recovery from partial or transient publishing failures and also makes successful workflow reruns fail.

**Triggers:** When a release publish is retried after one or more distributions already exist on PyPI.

**Suggested fix:** Restore `skip-existing: true` on the PyPI publish action, or explicitly handle already-existing distributions before publishing.
</issue_to_address>

Sourcery assessment

Needs a human reviewer. 1 finding to address first, and the reworked release workflow builds and publishes distributions to PyPI using an OIDC token, so a faulty build or release-gating decision could distribute an incorrect package that reverting the workflow cannot fully retract from consumers. The new dependency-review and lint tooling also changes the repository’s CI and supply-chain controls.

Blocking findings: .github/workflows/publish.yml:43

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

[Copilot]

Copilot review overview

🟡 Changes recommended

Critical publishing bypass and missing dependency-review permissions remain unresolved.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 1

Open (1)

• Prevent manual dispatch from publishing unvalidated refs · New

What changed in this PR

Hardens GitHub Actions CI/CD, dependency checks, security scanning, and guarded PyPI publishing while updating package dependencies and version 1.3.5.

Changes:

• Expands reusable validation, linting, auditing, and required-check reporting.
• Restricts workflow permissions and guards security-report uploads.
• Adds dependency review and updates Dependabot to use uv.
• Separates package building from publishing with release-version validation.

File	Summary	Findings
uv.lock	Locks updated package and lint dependencies.	None
pyproject.toml	Bumps version and adds lint dependencies.	None
.github/​workflows/​zizmor.yml	Guards security-report uploads.	None
.github/​workflows/​uv.yml	Expands CI validation and reusable workflow support.	None
.github/​workflows/​publish.yml	Separates builds from publishing and validates versions.	Critical issue (2 votes): manual dispatch can bypass release-tag validation.
.github/​workflows/​dependency-review.yml	Adds dependency vulnerability checks.	Moderate issue (1 vote): missing pull-requests: read permission may prevent review API access.
.github/​workflows/​codeql-analysis.yml	Guards security uploads for restricted pull requests.	None
.github/​dependabot.yml	Switches dependency updates to uv.	None

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.