Feature/prep patch

[laurejt]

Associated Issue(s): resolves #37

Changes in this PR

Security

• Add zizmor pre-commit hook
• Pin GitHub repos to full commit hashes
• Update permissions for GitHub Actions

GitHub Actions

• Fixed python-publish.yml
• Add some handling for Dependabot PRs to pr-check.yml
• Named ruff GitHub Action
• Removed use of third party action for changelog.yml

Dependabot

• Add version updates for uv
• Reduce version updates to monthly
• Add 7-day cooldowns to all version updates (needs to be set at the ecosystem level, not the multi-ecosystem group level)
• Reconfigure version updates into a single multi-ecosystem group (i.e., one PR for all version updates) with PRs targeting develop

uv

• Pin python version to 3.12 with .python-version
• Remove .python-version from .gitignore
• Add 7-day cooldown for uv (in pyproject.toml)
• Upgrade uv.lock using uv lock --upgrade

Misc

• Update codecov badge in README
• Update changelog

Notes

Temporarily, I've dropped the ruff check from being required due to the name change

• For Dependabot, cooldowns need to be set for each ecosystem level, not in the multi-ecosystem group
• Do we want to add lower bounds to our package dependencies in the pyproject.toml?
• I believe this PR should also address the following Dependabot security alerts based on the uv.lock:
  • django
    • https://github.com/Princeton-CDH/viapy/security/dependabot/3
    • https://github.com/Princeton-CDH/viapy/security/dependabot/4
    • https://github.com/Princeton-CDH/viapy/security/dependabot/5
    • https://github.com/Princeton-CDH/viapy/security/dependabot/6
    • https://github.com/Princeton-CDH/viapy/security/dependabot/7
    • https://github.com/Princeton-CDH/viapy/security/dependabot/9
    • https://github.com/Princeton-CDH/viapy/security/dependabot/10
    • https://github.com/Princeton-CDH/viapy/security/dependabot/11
  • pygments: https://github.com/Princeton-CDH/viapy/security/dependabot/2
  • idna: https://github.com/Princeton-CDH/viapy/security/dependabot/14
  • pytest: https://github.com/Princeton-CDH/viapy/security/dependabot/8
  • requests: https://github.com/Princeton-CDH/viapy/security/dependabot/1
  • urllib3:
    • https://github.com/Princeton-CDH/viapy/security/dependabot/12
    • https://github.com/Princeton-CDH/viapy/security/dependabot/13

Reviewer Checklist

• Check changelog is clear and sufficient
• Confirm that logic for pr-check.yml is reasonable and sufficiently matches our workflow
• Confirm that the messaging for changelog.yml is reasonable and sufficient
  - [ ] PR resolves the 14 open Dependabot alerts

[read-the-docs-community]

Documentation build overview

📚 viapy | 🛠️ Build #33098487 | 📁 Comparing 51bfc59 against latest (51d7b6f)

  🔍 Preview build  

2 files changed

± changelog.html
± index.html

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 97.47%. Comparing base (5ffefd6) to head (51bfc59).

Additional details and impacted files

@@           Coverage Diff            @@
##           develop      #40   +/-   ##
========================================
  Coverage    97.47%   97.47%           
========================================
  Files            8        8           
  Lines          357      357           
  Branches        15       15           
========================================
  Hits           348      348           
  Misses           4        4           
  Partials         5        5           

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.