chore: Migrate tooling to uv, prek, ruff and ty

.envrc

@@ -1,6 +1,3 @@
+# shellcheck shell=bash
 # Use shell.nix to build the development environment
-if [ -x "$(command -v lorri)" ]; then
-  eval "$(lorri direnv)"
-else
-  use nix
-fi
+use nix

.github/actions/nix-shell/action.yml

@@ -1,12 +1,8 @@
 name: "Prepare nix-shell"
-description:
-  Download cache, build nix-shell and potentially upload any new
-  derivations to cache
-
+description: Download cache, build nix-shell and potentially upload any new derivations to cache
 inputs:
   cachix_auth_token:
     required: true
-
 runs:
   using: "composite"
   steps:
@@ -17,7 +13,6 @@ runs:
       with:
         name: pyramid-openapi3
         authToken: '${{ inputs.cachix_auth_token }}'
-
     - name: Build nix-shell
       shell: bash
       run: nix-shell --run "echo 'nix-shell successfully entered'"

.github/workflows/ci.yml

@@ -1,8 +1,6 @@
 # Run all tests, linters, code analysis and other QA tasks on
 # every push to master and PRs.
-
 name: CI
-
 on:
   workflow_dispatch:
   pull_request:
@@ -11,7 +9,6 @@ on:
       - main
     tags:
       - '*'
-
 # To SSH into the runner to debug a failure, add the following step before
 # the failing step
 #    - uses: lhotari/action-upterm@v1
@@ -22,126 +19,89 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
-
+permissions:
+  contents: read
 jobs:
-
-  test_312:
-    name: "Python 3.12 Tests"
-
-    runs-on: ubuntu-22.04
-
+  test_314:
+    name: "Python 3.14 Tests"
+    runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: ./.github/actions/nix-shell
         with:
           cachix_auth_token: '${{ secrets.CACHIX_AUTH_TOKEN }}'
-
       - name: Run linters and unit tests
         run: |
-          nix-shell --run "make lint all=true"
-          nix-shell --run "make types"
-          nix-shell --run "make unit"
-
+          nix-shell --run "make tests frozen=1"
       - name: Run tests for the singlefile example
         run: |
           cd examples/singlefile
-          nix-shell --run "python -m unittest app.py"
-
+          nix-shell --run "uv run --no-sync python -m unittest app"
       - name: Run tests for the todoapp example
         run: |
           cd examples/todoapp
-          nix-shell --run "python -m unittest tests.py"
-
+          nix-shell --run "uv run --no-sync python -m unittest tests"
       - name: Run tests for the splitfile example
         run: |
           cd examples/splitfile
-          nix-shell --run "python -m unittest tests.py"
-
+          nix-shell --run "uv run --no-sync python -m unittest tests"
       - name: Save coverage report
         uses: actions/upload-artifact@v4
         with:
           name: htmlcov
           path: htmlcov/
-
-  test_310:
-    name: "Python 3.10 Tests"
-
-    runs-on: ubuntu-22.04
-
+  test_311:
+    name: "Python 3.11 Tests (oldest supported dependencies)"
+    runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: ./.github/actions/nix-shell
         with:
           cachix_auth_token: '${{ secrets.CACHIX_AUTH_TOKEN }}'
-
-      - name: Run linters and unit tests
+      - name: Run unit tests against the oldest supported dependencies
         run: |
-          nix-shell --run "PYTHON=python3.10 make lint all=true"
-          nix-shell --run "PYTHON=python3.10 make types"
-          nix-shell --run "PYTHON=python3.10 make unit"
-
+          cp uv-oldest.lock uv.lock
+          nix-shell --run "uv sync --frozen --python 3.11"
+          nix-shell --run "make tests python=3.11 frozen=1"
       - name: Run tests for the singlefile example
         run: |
           cd examples/singlefile
-          nix-shell --run "python3.10 -m unittest app.py"
-
+          nix-shell --run "uv run --no-sync --python 3.11 python -m unittest app"
       - name: Run tests for the todoapp example
         run: |
           cd examples/todoapp
-          nix-shell --run "python3.10 -m unittest tests.py"
-
+          nix-shell --run "uv run --no-sync --python 3.11 python -m unittest tests"
       - name: Run tests for the splitfile example
         run: |
           cd examples/splitfile
-          nix-shell --run "python3.10 -m unittest tests.py"
-
-      - name: Save coverage report
-        uses: actions/upload-artifact@v4
-        with:
-          name: htmlcov-py310
-          path: htmlcov/
-
-
+          nix-shell --run "uv run --no-sync --python 3.11 python -m unittest tests"
   release:
     name: "Release to PyPI"
-
     if: github.event_name == 'push' && contains(github.ref, 'refs/tags/')
-    needs: [test_312, test_310]
-    runs-on: ubuntu-22.04
-
-    # To test publishing to testpypi:
-    # * change version in pyproject.toml to 0.16.1-alpha.1 or similar
-    # * uncomment POETRY_REPOSITORIES_TESTPYPI_URL and POETRY_PYPI_TOKEN_TESTPYPI
-    # * append `-r testpypi` to poetry publish command
-    # * `git ci && git tag 0.16.1-alpha.1 && git push --tags`
-
+    needs: [test_314, test_311]
+    runs-on: ubuntu-latest
     env:
-      POETRY_PYPI_TOKEN_PYPI: ${{ secrets.POETRY_PYPI_TOKEN_PYPI }}
-
-      # POETRY_PYPI_TOKEN_TESTPYPI: ${{ secrets.POETRY_PYPI_TOKEN_TESTPYPI }}
-      # POETRY_REPOSITORIES_TESTPYPI_URL: https://test.pypi.org/legacy/
-
+      UV_PUBLISH_TOKEN: ${{ secrets.POETRY_PYPI_TOKEN_PYPI }}
     permissions:
       contents: write
-
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: ./.github/actions/nix-shell
         with:
           cachix_auth_token: '${{ secrets.CACHIX_AUTH_TOKEN }}'
-
       - name: verify git tag matches pyproject.toml version
         run: |
-          echo "$GITHUB_REF_NAME"
-          POETRY_VERSION=$(nix-shell --run "poetry version --short")
-          echo $POETRY_VERSION
-
-          [[ "$GITHUB_REF_NAME" == "$POETRY_VERSION" ]] && exit 0 || exit 1
-
-      - run: nix-shell --run "poetry publish --build"
-
+          PROJECT_VERSION=$(nix-shell --run "uv version --short")
+          echo "tag=$GITHUB_REF_NAME project=$PROJECT_VERSION"
+          [[ "$GITHUB_REF_NAME" == "$PROJECT_VERSION" ]] && exit 0 || exit 1
+      - run: nix-shell --run "uv build && uv publish"
       - name: Create GitHub Release
-        uses: softprops/action-gh-release@v2
-        with:
-          generate_release_notes: true
-          make_latest: true
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh release create "$GITHUB_REF_NAME" --generate-notes --latest

.github/zizmor.yml

@@ -0,0 +1,7 @@
+# Allow version-tag pins (ref-pin) for GitHub Actions rather than requiring
+# commit SHA hash-pins, matching the pinning style used across this repository.
+rules:
+  unpinned-uses:
+    config:
+      policies:
+        "*": ref-pin

.gitignore

@@ -102,16 +102,14 @@ venv.bak/
 # mkdocs documentation
 /site
 
-# mypy
-.mypy_cache/
+# ruff
+.ruff_cache/
 
 # Sublime Markdown preview
 Readme.html
 
 # Coverage reports
 cov.xml
-htmltypecov/
-typecov/
 junit.xml
 
 # `make install` flag