Refresh project configuration

.github/dependabot.yml

@@ -12,20 +12,19 @@ updates:
     directory: "/"
     patterns: ["*"]
     multi-ecosystem-group: "dependencies"
-
-  - package-ecosystem: "pre-commit"
-    directory: "/"
-    patterns: ["*"]
-    multi-ecosystem-group: "dependencies"
+    cooldown:
+      default-days: 7
 
   - package-ecosystem: "pip"
     directory: "/"
     patterns: ["*"]
     multi-ecosystem-group: "dependencies"
+    cooldown:
+      default-days: 7
 
   - package-ecosystem: "pre-commit"
     directory: "/"
-    schedule:
-      # Check for updates on the first Sunday of every month, 8PM UTC
-      interval: "cron"
-      cronjob: "0 20 * * sun#1"
+    patterns: ["*"]
+    multi-ecosystem-group: "dependencies"
+    cooldown:
+      default-days: 7

.github/workflows/ci.yml

@@ -1,4 +1,8 @@
 name: CI
+
+permissions:
+  contents: read
+
 on:
   pull_request:
   push:
@@ -24,9 +28,12 @@ jobs:
 
   towncrier:
     name: Check towncrier
+    permissions:
+      contents: read
+      pull-requests: write
     uses: beeware/.github/.github/workflows/towncrier-run.yml@main
     with:
-      tox-source: "--group tox-uv"
+      tox-source: "--group tox"
 
   package:
     name: Package Colosseum
@@ -46,35 +53,35 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        python-version: [ "3.10", "3.11", "3.12", "3.13", "3.14", "3.15" ]
+        python-version: [ "3.11", "3.12", "3.13", "3.14", "3.15" ]
         include:
           # Builds must pass by default
           - experimental: false
 
           # Development Python can fail without failing the entire job
-          - python-version: "3.14"
+          - python-version: "3.15"
             experimental: true
     steps:
     - name: Checkout
-      uses: actions/checkout@v7.0.1
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         fetch-depth: 0
+        persist-credentials: false
 
     - name: Set up Python ${{ matrix.python-version }}
-      uses: actions/setup-python@v7.0.0
+      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
       with:
         python-version: ${{ matrix.python-version }}
         allow-prereleases: true
 
     - name: Get Packages
-      uses: actions/download-artifact@v8.0.1
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
       with:
         name: ${{ needs.package.outputs.artifact-name }}
         path: dist
 
     - name: Install Tox
-      run: python -m pip install --group tox-uv
-
+      run: python -m pip install --group tox
 
     - name: Test
       run: tox -e py --installpkg dist/colosseum-*.whl

.github/workflows/dependabot-changenote.yml

@@ -8,5 +8,8 @@ on:
 jobs:
   changenote:
     name: Dependabot Change Note
+    permissions:
+      contents: read
     uses: beeware/.github/.github/workflows/dependabot-changenote.yml@main
-    secrets: inherit
+    secrets:
+      BRUTUS_PAT_TOKEN: ${{ secrets.BRUTUS_PAT_TOKEN }}

.github/workflows/publish.yml

@@ -11,12 +11,12 @@ jobs:
       # This permission is required for trusted publishing.
       id-token: write
     steps:
-      - uses: dsaltares/fetch-gh-release-asset@1.1.2
+      - uses: dsaltares/fetch-gh-release-asset@aa2ab1243d6e0d5b405b973c89fa4d06a2d0fff7 # 1.1.2
         with:
           version: tags/${{ github.event.release.tag_name }}
           file: ${{ github.event.repository.name }}.*
           regex: true
           target: dist/
 
       - name: Publish release to production PyPI
-        uses: pypa/gh-action-pypi-publish@release/v1
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33  # v1.14.2

.github/workflows/release.yml

@@ -1,5 +1,8 @@
 name: Create Release
 
+permissions:
+  contents: read
+
 on:
   push:
     tags:
@@ -8,6 +11,10 @@ on:
 jobs:
   ci:
     name: CI
+    permissions:
+      contents: read
+      id-token: write
+      attestations: write
     uses: ./.github/workflows/ci.yml
     with:
       attest-package: "true"
@@ -26,12 +33,12 @@ jobs:
           echo "VERSION=${GITHUB_REF_NAME#v}" | tee -a $GITHUB_ENV
 
       - name: Set up Python
-        uses: actions/setup-python@v7.0.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.x"
 
       - name: Get packages
-        uses: actions/download-artifact@v8.0.1
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: ${{ needs.ci.outputs.artifact-name }}
           path: dist
@@ -47,14 +54,17 @@ jobs:
           test $(python -c "from colosseum import __version__; print(__version__)") = $VERSION
 
       - name: Create release
-        uses: ncipollo/release-action@v1.21.0
-        with:
-          name: ${{ env.VERSION }}
-          draft: true
-          artifacts: dist/*
-          artifactErrorsFailBuild: true
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+        run: |
+          gh release create "${GITHUB_REF_NAME}" \
+            --title "${VERSION}" \
+            --draft \
+            --verify-tag \
+            dist/*
 
       - name: Publish release to Test PyPI
-        uses: pypa/gh-action-pypi-publish@release/v1
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
         with:
-          repository_url: https://test.pypi.org/legacy/
+          repository-url: https://test.pypi.org/legacy/

.github/zizmor.yml

@@ -0,0 +1,9 @@
+rules:
+  unpinned-uses:
+    config:
+      # Allow BeeWare-provided actions to be unpinned. If an attacker is in a
+      # position to exploit those action, they're probably able to exploit
+      # repositories directly; and it's significantly easier for our internal
+      # actions to automatically be the most recent versions.
+      policies:
+        beeware/*: ref-pin

.pre-commit-config.yaml

@@ -4,6 +4,7 @@ repos:
     hooks:
       - id: check-toml
       - id: check-yaml
+        args: ['--unsafe']
       - id: check-case-conflict
       - id: check-docstring-first
       - id: end-of-file-fixer
@@ -14,3 +15,11 @@ repos:
       - id: ruff-format
       - id: ruff-check
         args: [ --fix ]
+  - repo: https://github.com/rvben/rumdl-pre-commit
+    rev: v0.2.20
+    hooks:
+      - id: rumdl
+  - repo: https://github.com/zizmorcore/zizmor-pre-commit
+    rev: v1.27.0
+    hooks:
+      - id: zizmor

.pyspelling.yml

@@ -0,0 +1,62 @@
+matrix:
+- name: markdown
+  aspell:
+    lang: en
+    d: en_US
+    mode:
+      - markdown
+      - url
+      - email
+  dictionary:
+    wordlists:
+    - docs/spelling_wordlist
+    output: _build/dictionary/python.dic
+  sources:
+  - 'docs/en/**/*.md'
+  pipeline:
+  - pyspelling.filters.markdown:
+      markdown_extensions:
+      - markdown.extensions.toc
+      - markdown.extensions.admonition
+      - markdown.extensions.attr_list
+      - pymdownx.superfences
+      - pymdownx.blocks.admonition
+      - pymdownx.blocks.caption
+      - pymdownx.blocks.tab
+  - pyspelling.filters.html:
+      comments: true
+      attributes:
+        - title
+        - alt
+      ignores:
+        - 'code'
+        - 'pre'
+        - 'nospell'  # Allows for ignoring a word or words inline.
+  - pyspelling.filters.context:
+      context_visible_first: true
+      escapes: '\\[\\`~]'
+      delimiters:
+        # Ignores the Jinja directives and their contents
+        - open: '{%'
+          content: '[\d\D]*'
+          close: '%}'
+        # Ignores the Jinja variables and their contents
+        - open: '{{'
+          content: '[\d\D]*'
+          close: '}}'
+        # Ignores the autorefs link targets
+        - open: '\]\['
+          content: '[\d\D]*'
+          close: '\]'
+        # Ignore the mkdocstrings calls
+        - open: ':::'
+          content: '[\d\D]*'
+          close: '\n'
+        # Ignore the single line Snippets syntax
+        - open: '-8<\-'
+          content: '[\d\D]*'
+          close: '\n'
+        # Ignore the multiline Snippets syntax
+        - open: '-8<\-\n'
+          content: '[\d\D]*'
+          close: '-8<-\n'

.readthedocs.yaml

@@ -0,0 +1,20 @@
+# .readthedocs.yaml
+# Read the Docs configuration file
+# See https://docs.readthedocs.io/en/stable/config-file/v2.html for details
+
+version: 2
+
+build:
+  os: ubuntu-24.04
+  tools:
+    # Docs are always built on Python 3.13. See also the tox config.
+    python: "3.13"
+  jobs:
+    post_checkout:
+      - git fetch --unshallow
+    pre_install:
+      - python -m pip install --upgrade pip
+      - python -m pip install --group tox
+    build:
+      html:
+        - python -m tox -e docs-all -- --output=$READTHEDOCS_OUTPUT/html/

CONTRIBUTING.md

@@ -1,7 +1,7 @@
 # Contributing
 
-PyBee <3's contributions!
+BeeWare <3's contributions!
 
-Please be aware, PyBee operates under a Code of Conduct.
+Please be aware, BeeWare operates under a Code of Conduct.
 
-See [CONTRIBUTING to PyBee](http://pybee.org/contributing) for details.
+See [CONTRIBUTING to BeeWare](https://beeware.org/contributing) for details.