Overhaul pre-commit and CI infrastructure

.claude/commands/check-unit-tests-redundancy.md

@@ -95,4 +95,4 @@ Before finalizing:
 - [ ] Redundancy report has been generated
 - [ ] No useful tests were accidentally removed
 - [ ] Remaining tests still provide comprehensive coverage
-- [ ] `__init__.py` files are updated if needed
+- [ ] `__init__.py` files are updated if needed

.claude/commands/commit.md

@@ -63,4 +63,4 @@ Generate a commit message for the current staged changes, then create the commit
 - Never use `--no-verify` or skip pre-commit hooks.
 - If the pre-commit hook fails, fix the issue and create a NEW commit (do not amend).
 - Never push unless the user explicitly asks.
-- If there are no changes to commit, inform the user and stop.
+- If there are no changes to commit, inform the user and stop.

.claude/commands/debug-unit-tests-and-fixtures.md

@@ -131,4 +131,4 @@ Before considering debugging complete:
 - [ ] All potential bugs have been flagged to user
 - [ ] Changes are documented with reasoning
 - [ ] Edge cases discovered are documented
-- [ ] If any modules have been updated, they've also been reformatted using black
+- [ ] If any modules have been updated, they've also been reformatted using black

.claude/commands/make-unit-tests-and-fixtures.md

@@ -81,4 +81,4 @@ Before finalizing:
 - [ ] Tests are independent
 - [ ] Naming is consistent with project patterns
 - [ ] Style guidelines are followed
-- [ ] `__init__.py` files are updated
+- [ ] `__init__.py` files are updated

.github/CODEOWNERS

@@ -10,4 +10,4 @@
 /.pre-commit-config.yaml    @camUrban
 **/pyproject.toml           @camUrban
 **/requirements*.txt        @camUrban
-**/setup.cfg                @camUrban
+**/setup.cfg                @camUrban

.github/dependabot.yml

@@ -0,0 +1,22 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
+    groups:
+      actions:
+        patterns:
+          - "*"
+  - package-ecosystem: pre-commit
+    directory: /
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
+    groups:
+      pre-commit:
+        patterns:
+          - "*"

.github/pull_request_template.md

@@ -12,7 +12,7 @@ Link any related issues using GitHub's syntax. For bugs, write, "Fixes #<issue n
 
 ## Changes
 
-List the changes you made in bullet points.
+* List the changes you made in bullet points.
 
 ## Dependency Updates
 
@@ -42,6 +42,6 @@ Identify the option that best describes the impact of your change, then delete t
 * [ ] If any major functionality was added or significantly changed, I have added or updated tests in the `tests` package.
 * [ ] Code locally passes all tests in the `tests` package.
 * [ ] This PR passes the ReadTheDocs build check (this runs automatically with the other workflows).
-* [ ] This PR passes the `black`, `codespell`, and `isort` GitHub actions.
+* [ ] This PR passes the `ascii-only`, `black`, `codespell`, `docformatter`, `isort`, and `pre-commit-hooks` GitHub actions.
 * [ ] This PR passes the `mypy` GitHub action.
-* [ ] This PR passes all the `tests` GitHub actions.
+* [ ] This PR passes all the `tests` GitHub actions.

.github/workflows/ascii-only.yml

@@ -0,0 +1,27 @@
+name: ascii-only
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  ascii-only:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
+      - name: Set up Python 3.13
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+        with:
+          python-version: "3.13"
+      - name: Install pre-commit
+        run: |
+          python -m pip install --upgrade pip
+          pip install pre-commit
+      - name: Run ascii-only hook
+        run: pre-commit run --all-files ascii-only

.github/workflows/black.yml

@@ -5,9 +5,14 @@ on:
   push:
     branches: [main]
 
+permissions:
+  contents: read
+
 jobs:
   black:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: psf/black@stable
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
+      - uses: psf/black@c6755bb741b6481d6b3d3bb563c83fa060db96c9 # 26.3.1

.github/workflows/codespell.yml

@@ -5,12 +5,17 @@ on:
   push:
     branches: [main]
 
+permissions:
+  contents: read
+
 jobs:
   codespell:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: codespell-project/actions-codespell@v2
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
+      - uses: codespell-project/actions-codespell@406322ec52dd7b488e48c1c4b82e2a8b3a1bf630 # v2
         continue-on-error: true
         with:
           ignore_words_file: .codespell-ignore.txt

.github/workflows/docformatter.yml

@@ -0,0 +1,27 @@
+name: docformatter
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  docformatter:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
+      - name: Set up Python 3.13
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+        with:
+          python-version: "3.13"
+      - name: Install pre-commit
+        run: |
+          python -m pip install --upgrade pip
+          pip install pre-commit
+      - name: Run docformatter hook
+        run: pre-commit run --all-files docformatter

.github/workflows/isort.yml

@@ -5,9 +5,14 @@ on:
   push:
     branches: [main]
 
+permissions:
+  contents: read
+
 jobs:
   isort:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: isort/isort-action@v1
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
+      - uses: isort/isort-action@24d8a7a51d33ca7f36c3f23598dafa33f7071326 # v1

.github/workflows/mypy.yml

@@ -5,13 +5,18 @@ on:
   push:
     branches: [main]
 
+permissions:
+  contents: read
+
 jobs:
   mypy:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
       - name: Set up Python 3.13
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: "3.13"
           cache: 'pip'

.github/workflows/pre-commit-hooks.yml

@@ -0,0 +1,53 @@
+name: pre-commit-hooks
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  pre-commit-hooks:
+    name: ${{ matrix.name }}
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - { hook: end-of-file-fixer,                    name: end-of-files }
+          - { hook: trailing-whitespace,                  name: trailing-whitespace }
+          - { hook: mixed-line-ending,                    name: mixed-line-endings }
+          - { hook: fix-byte-order-marker,                name: byte-order-marks }
+          - { hook: requirements-txt-fixer,               name: requirements-txt }
+          - { hook: check-merge-conflict,                 name: merge-conflicts }
+          - { hook: check-case-conflict,                  name: case-conflicts }
+          - { hook: check-illegal-windows-names,          name: illegal-names }
+          - { hook: check-symlinks,                       name: lost-symlinks }
+          - { hook: destroyed-symlinks,                   name: destroyed-symlinks }
+          - { hook: check-yaml,                           name: yaml-files }
+          - { hook: check-toml,                           name: toml-files }
+          - { hook: check-xml,                            name: xml-files }
+          - { hook: check-json,                           name: json-files }
+          - { hook: detect-private-key,                   name: private-keys }
+          - { hook: forbid-submodules,                    name: submodules }
+          - { hook: check-vcs-permalinks,                 name: vcs-permalinks }
+          - { hook: check-executables-have-shebangs,      name: exec-shebangs }
+          - { hook: check-shebang-scripts-are-executable, name: shebang-execs }
+          - { hook: check-added-large-files,              name: large-files }
+          - { hook: debug-statements,                     name: debug-statements }
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
+      - name: Set up Python 3.13
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+        with:
+          python-version: "3.13"
+      - name: Install pre-commit
+        run: |
+          python -m pip install --upgrade pip
+          pip install pre-commit
+      - name: Run ${{ matrix.name }} hook
+        run: pre-commit run --all-files ${{ matrix.hook }}

.github/workflows/publish.yml

@@ -0,0 +1,37 @@
+name: publish
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: publish
+  cancel-in-progress: false
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      contents: read
+      id-token: write  # OIDC token used to authenticate to PyPI as a trusted publisher.
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
+      - name: Set up Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+        with:
+          python-version: "3.13"
+      - name: Install build
+        run: |
+          python -m pip install --upgrade pip
+          pip install build
+      - name: Build package
+        run: python -m build
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0