Modernize CIs and fix zizmor lints

.github/dependabot.yml

@@ -0,0 +1,26 @@
+# See https://docs.github.com/en/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/keeping-your-actions-up-to-date-with-dependabot
+
+version: 2
+updates:
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "daily"
+    labels:
+      - "Bot"
+    groups:
+      github-actions:
+        patterns:
+          - '*'
+    cooldown:
+      default-days: 7
+
+  - package-ecosystem: "pre-commit"
+    directory: "/"
+    schedule:
+      interval: "daily"
+    labels:
+      - "Bot"
+    cooldown:
+      default-days: 7

.github/workflows/deploy-docs.yml

@@ -1,6 +1,9 @@
 
 name: Documentation
 
+# no permissions by default
+permissions: {}
+
 on:
   pull_request:
   push:
@@ -13,28 +16,31 @@ on:
 jobs:
   build-docs:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    defaults:
+      run:
+        shell: bash -l {0}
 
     steps:
-    - name: checkout
-      uses: actions/checkout@v3
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
       with:
         fetch-depth: 0
+        persist-credentials: false
 
     - name: Setup Micromamba
-      uses: mamba-org/setup-micromamba@v1
+      uses: mamba-org/setup-micromamba@d7c9bd84e824b79d2af72a2d4196c7f4300d3476  # v3.0.0
       with:
         environment-name: TEST
         init-shell: bash
         create-args: >-
           python=3 --file requirements.txt --file requirements-dev.txt --channel conda-forge
 
-    - name: Install branca
-      shell: bash -l {0}
+    - name: Install library
       run: |
         python -m pip install -e . --no-deps --force-reinstall
 
     - name: Build documentation
-      shell: bash -l {0}
       run: >
         set -e
         && pushd docs
@@ -43,7 +49,7 @@ jobs:
 
     - name: Deploy
       if: success() && github.event_name == 'release'
-      uses: peaceiris/actions-gh-pages@v3
+      uses: peaceiris/actions-gh-pages@84c30a85c19949d7eee79c4ff27748b70285e453  # v4.1.0
       with:
         github_token: ${{ secrets.GITHUB_TOKEN }}
         publish_dir: docs/build/html

.github/workflows/pypi.yml

@@ -1,6 +1,9 @@
 
 name: Publish to PyPI
 
+# no permissions by default
+permissions: {}
+
 on:
   pull_request:
   push:
@@ -17,11 +20,17 @@ defaults:
 jobs:
   packages:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      with:
+        # Should be enough for setuptools-scm
+        fetch-depth: 100
+        persist-credentials: false
 
     - name: Set up Python
-      uses: actions/setup-python@v4
+      uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6.3.0
       with:
         python-version: "3.x"
 
@@ -47,7 +56,7 @@ jobs:
 
     - name: Publish a Python distribution to PyPI
       if: success() && github.event_name == 'release'
-      uses: pypa/gh-action-pypi-publish@release/v1
+      uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b  # v1.14.0
       with:
         user: __token__
         password: ${{ secrets.PYPI_PASSWORD }}

.github/workflows/test_code.yml

@@ -1,5 +1,8 @@
 name: Code Tests
 
+# no permissions by default
+permissions: {}
+
 on:
   pull_request:
   push:
@@ -8,29 +11,33 @@ on:
 jobs:
   run:
     runs-on: ${{ matrix.os }}
+    defaults:
+      run:
+        shell: bash -l {0}
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, windows-latest]
-        python-version: ["3.8", "3.12"]
+        os: [ ubuntu-latest, windows-latest, macos-latest ]
+        python-version: ["3.10", "3.14"]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      with:
+        fetch-depth: 0
+        persist-credentials: false
 
-    - name: Setup Micromamba Python ${{ matrix.python-version }}
-      uses: mamba-org/setup-micromamba@v1
+    - name: Setup Micromamba
+      uses: mamba-org/setup-micromamba@d7c9bd84e824b79d2af72a2d4196c7f4300d3476  # v3.0.0
       with:
         environment-name: TEST
         init-shell: bash
         create-args: >-
           python=${{ matrix.python-version }} pip --file requirements.txt --file requirements-dev.txt --channel conda-forge
 
-    - name: Install branca
-      shell: bash -l {0}
+    - name: Install library
       run: |
         python -m pip install -e . --no-deps --force-reinstall
 
     - name: Tests
-      shell: bash -l {0}
       run: |
         python -m pytest -vv -rxs tests -m "not headless"

.github/workflows/test_code_notebooks.yml

@@ -1,5 +1,8 @@
 name: Notebook Tests
 
+# no permissions by default
+permissions: {}
+
 on:
   pull_request:
   push:
@@ -8,24 +11,28 @@ on:
 jobs:
   run:
     runs-on: ubuntu-latest
+    defaults:
+      run:
+        shell: bash -l {0}
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      with:
+        fetch-depth: 0
+        persist-credentials: false
 
-    - name: Setup Micromamba Python 3
-      uses: mamba-org/setup-micromamba@v1
+    - name: Setup Micromamba
+      uses: mamba-org/setup-micromamba@d7c9bd84e824b79d2af72a2d4196c7f4300d3476  # v3.0.0
       with:
         environment-name: TEST
         init-shell: bash
         create-args: >-
           python=3 pip --file requirements.txt --file requirements-dev.txt --channel conda-forge
 
-    - name: Install branca
-      shell: bash -l {0}
+    - name: Install library
       run: |
         python -m pip install -e . --no-deps --force-reinstall
 
     - name: Notebook tests
-      shell: bash -l {0}
       run: |
         python -m pytest --nbval-lax examples

.github/workflows/test_mypy.yml

@@ -1,33 +1,38 @@
 name: Mypy type hint checks
 
+# no permissions by default
+permissions: {}
+
 on:
   pull_request:
   push:
-    branches:
-      - main
+    branches: [main]
 
 jobs:
   run:
     runs-on: ubuntu-latest
+    defaults:
+      run:
+        shell: bash -l {0}
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      with:
+        fetch-depth: 0
+        persist-credentials: false
 
-    - name: Setup Micromamba env
-      uses: mamba-org/setup-micromamba@v1
+    - name: Setup Micromamba
+      uses: mamba-org/setup-micromamba@d7c9bd84e824b79d2af72a2d4196c7f4300d3476  # v3.0.0
       with:
         environment-name: TEST
+        init-shell: bash
         create-args: >-
-          python=3
-          --file requirements.txt
-          --file requirements-dev.txt
+          python=3 pip --file requirements.txt --file requirements-dev.txt --channel conda-forge
 
-    - name: Install branca from source
-      shell: bash -l {0}
+    - name: Install library
       run: |
         python -m pip install -e . --no-deps --force-reinstall
 
     - name: Mypy test
-      shell: bash -l {0}
       run: |
         mypy branca

.github/workflows/test_selenium.yml

@@ -1,4 +1,7 @@
-name: Headless Tests
+name: Full Tests
+
+# no permissions by default
+permissions: {}
 
 on:
   pull_request:
@@ -8,24 +11,28 @@ on:
 jobs:
   run:
     runs-on: ubuntu-latest
+    defaults:
+      run:
+        shell: bash -l {0}
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      with:
+        fetch-depth: 0
+        persist-credentials: false
 
-    - name: Setup Micromamba Python 3
-      uses: mamba-org/setup-micromamba@v1
+    - name: Setup Micromamba
+      uses: mamba-org/setup-micromamba@d7c9bd84e824b79d2af72a2d4196c7f4300d3476  # v3.0.0
       with:
         environment-name: TEST
         init-shell: bash
         create-args: >-
           python=3 pip --file requirements.txt --file requirements-dev.txt --channel conda-forge
 
-    - name: Install branca
-      shell: bash -l {0}
+    - name: Install library
       run: |
         python -m pip install -e . --no-deps --force-reinstall
 
     - name: Tests
-      shell: bash -l {0}
       run: |
         pytest -vv -rxs tests -m "headless"

.pre-commit-config.yaml

@@ -21,7 +21,7 @@ repos:
       args: [--max-line-length=105, "--ignore=E203,W503"]
 
 - repo: https://github.com/pycqa/isort
-  rev: 9.0.0a3
+  rev: 9.0.0b1
   hooks:
     - id: isort
       additional_dependencies: [toml]
@@ -56,3 +56,12 @@ repos:
   rev: v4.0.0
   hooks:
     - id: add-trailing-comma
+
+ci:
+    autofix_commit_msg: |
+        [pre-commit.ci] auto fixes from pre-commit.com hooks
+
+        for more information, see https://pre-commit.ci
+    autofix_prs: false
+    skip: []
+    submodules: false

requirements-dev.txt

@@ -1,24 +1,12 @@
-black
 check-manifest
-flake8
-flake8-builtins
-flake8-comprehensions
-flake8-mutable
-flake8-print
-isort
 jupyter
 mypy
 nbsphinx
 nbval
 numpy
-pre-commit
-pylint
 pytest
 pytest-cov
-pytest-flake8
 pytest-xdist
 selenium
 setuptools_scm
 sphinx
-twine
-wheel