drop 3.9, updade CI & code, add zizmor + typos

.github/dependabot.yaml

@@ -0,0 +1,13 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions" # zizmor: ignore[dependabot-cooldown]
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    target-branch: main
+
+  - package-ecosystem: "cargo" # zizmor: ignore[dependabot-cooldown]
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    target-branch: main

.github/workflows/CI.yml

@@ -7,58 +7,104 @@ on:
 
   workflow_dispatch:
 
+permissions: {}
+
 concurrency:
   group: ci-${{ github.ref }}
-  cancel-in-progress: ${{ !startsWith(github.ref, 'refs/tags/') }}
+  cancel-in-progress: ${{ github.ref_type != 'tag' }}
+
+env:
+  (^_^): &interpreters            "3.10 3.11 3.12 3.13 3.14 3.14t 3.15 3.15t pypy3.11"
+  ○_○: &interpreters_without_pypy "3.10 3.11 3.12 3.13 3.14 3.14t 3.15 3.15t"
+
 
 jobs:
+  tools:
+    name: ${{ matrix.name }}
+    runs-on: ubuntu-latest
+
+    strategy:
+      matrix:
+        include:
+          - name: "zizmor"
+            command: zizmor .github/
+
+          - name: "typos"
+            command: typos --config typos.toml
+
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.14"
+
+      - name: "Install uv"
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        with:
+          # zizmor: ignore[cache-poisoning]
+          enable-cache: ${{ github.event_name == 'pull_request' }}
+
+      - name: "Install ${{ matrix.name }}"
+        run: uv pip install --group ${{ matrix.name }} --system
+
+      - name: "Run ${{ matrix.name }}"
+        run: ${{ matrix.command }}
+
   build-linux:
     runs-on: ubuntu-latest
     strategy:
       matrix:
         platform:
           - {
               target: x86_64,
-              interpreter: "3.10 3.11 3.12 3.13 3.14 3.14t 3.15 3.15t pypy3.11",
+              interpreter: *interpreters
             }
           - {
               target: x86,
-              interpreter: "3.10 3.11 3.12 3.13 3.14 3.14t 3.15 3.15t pypy3.11",
+              interpreter: *interpreters
             }
           - {
               target: aarch64,
-              interpreter: "3.10 3.11 3.12 3.13 3.14 3.14t 3.15 3.15t pypy3.11",
+              interpreter: *interpreters
             }
           - {
               target: armv7,
-              interpreter: "3.10 3.11 3.12 3.13 3.14 3.14t 3.15 3.15t pypy3.11",
+              interpreter: *interpreters
             }
           - {
               target: s390x,
-              interpreter: "3.10 3.11 3.12 3.13 3.14 3.14t 3.15 3.15t pypy3.11",
+              interpreter: *interpreters
             }
           - {
               target: ppc64le,
-              interpreter: "3.10 3.11 3.12 3.13 3.14 3.14t 3.15 3.15t pypy3.11",
+              interpreter: *interpreters
             }
 
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
-      - uses: actions/setup-python@v6.2.0
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.x"
 
-      - uses: PyO3/maturin-action@v1.51.0
+      - uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
+        # zizmor: ignore[cache-poisoning]
         with:
           target: ${{ matrix.platform.target }}
-          args: --release --out dist --interpreter ${{ matrix.platform.interpreter }}
-          sccache: ${{ !startsWith(github.ref, 'refs/tags/') }}
+          sccache: ${{ github.ref_type != 'tag' }}
           manylinux: auto
+          args: >-
+            --release 
+            --out dist 
+            --interpreter ${{ matrix.platform.interpreter }}
+            --compatibility pypi
 
-      - uses: actions/upload-artifact@v7.0.1
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: wheels-linux-${{ matrix.platform.target }}
           path: dist
@@ -70,38 +116,43 @@ jobs:
         platform:
           - {
               target: x86_64,
-              interpreter: "3.10 3.11 3.12 3.13 3.14 3.14t 3.15 3.15t pypy3.11",
+              interpreter: *interpreters
             }
           - {
               target: x86,
-              interpreter: "3.10 3.11 3.12 3.13 3.14 3.14t 3.15 3.15t pypy3.11",
+              interpreter: *interpreters
             }
           - {
               target: aarch64,
-              interpreter: "3.10 3.11 3.12 3.13 3.14 3.14t 3.15 3.15t pypy3.11",
+              interpreter: *interpreters
             }
           - {
               target: armv7,
-              interpreter: "3.10 3.11 3.12 3.13 3.14 3.14t 3.15 3.15t pypy3.11",
+              interpreter: *interpreters
             }
 
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
-      - uses: actions/setup-python@v6.2.0
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.x"
 
-      - uses: PyO3/maturin-action@v1.51.0
+      - uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
+        # zizmor: ignore[cache-poisoning]
         with:
           target: ${{ matrix.platform.target }}
-          args: --release --out dist --interpreter ${{ matrix.platform.interpreter }}
-          sccache: ${{ !startsWith(github.ref, 'refs/tags/') }}
+          sccache: ${{ github.ref_type != 'tag' }}
           manylinux: musllinux_1_2
+          args: >-
+            --release 
+            --out dist 
+            --interpreter ${{ matrix.platform.interpreter }}
+            --compatibility pypi
 
-      - uses: actions/upload-artifact@v7.0.1
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: wheels-musllinux-${{ matrix.platform.target }}
           path: dist
@@ -113,30 +164,35 @@ jobs:
         platform:
           - {
               target: x64,
-              interpreter: "3.10 3.11 3.12 3.13 3.14 3.14t 3.15 3.15t pypy3.11",
+              interpreter: *interpreters
             }
           - {
               target: x86,
-              interpreter: "3.10 3.11 3.12 3.13 3.14 3.14t 3.15 3.15t",
+              interpreter: *interpreters_without_pypy,
             }
 
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
-      - uses: actions/setup-python@v6.2.0
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.x"
           architecture: ${{ matrix.platform.target }}
 
-      - uses: PyO3/maturin-action@v1.51.0
+      - uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
+        # zizmor: ignore[cache-poisoning]
         with:
           target: ${{ matrix.platform.target }}
-          args: --release --out dist --interpreter ${{ matrix.platform.interpreter }}
-          sccache: ${{ !startsWith(github.ref, 'refs/tags/') }}
+          sccache: ${{ github.ref_type != 'tag' }}
+          args: >-
+            --release 
+            --out dist 
+            --interpreter ${{ matrix.platform.interpreter }}
+            --compatibility pypi
 
-      - uses: actions/upload-artifact@v7.0.1
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: wheels-windows-${{ matrix.platform.target }}
           path: dist
@@ -148,55 +204,60 @@ jobs:
         platform:
           - {
               target: x86_64,
-              interpreter: "3.10 3.11 3.12 3.13 3.14 3.14t 3.15 3.15t pypy3.11",
+              interpreter: *interpreters
             }
           - {
               target: aarch64,
-              interpreter: "3.10 3.11 3.12 3.13 3.14 3.14t 3.15 3.15t pypy3.11",
+              interpreter: *interpreters
             }
 
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
-      - uses: actions/setup-python@v6.2.0
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.x"
 
-      - uses: PyO3/maturin-action@v1.51.0
+      - uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
+        # zizmor: ignore[cache-poisoning]
         with:
           target: ${{ matrix.platform.target }}
-          args: --release --out dist --interpreter ${{ matrix.platform.interpreter }}
-          sccache: ${{ !startsWith(github.ref, 'refs/tags/') }}
+          sccache: ${{ github.ref_type != 'tag' }}
+          args: >-
+            --release 
+            --out dist 
+            --interpreter ${{ matrix.platform.interpreter }}
+            --compatibility pypi
 
-      - uses: actions/upload-artifact@v7.0.1
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: wheels-macos-${{ matrix.platform.target }}
           path: dist
 
   build-sdist:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
       - name: Build sdist
-        uses: PyO3/maturin-action@v1.51.0
+        uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
         with:
           command: sdist
           args: --out dist
 
       - name: Upload sdist
-        uses: actions/upload-artifact@v7.0.1
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: wheels-sdist
           path: dist
 
   release:
     runs-on: ubuntu-latest
-    if: startsWith(github.ref, 'refs/tags/') || github.event_name == 'workflow_dispatch'
+    if: github.ref_type != 'tag' || github.event_name == 'workflow_dispatch'
     needs:
       - build-linux
       - build-musllinux
@@ -209,14 +270,14 @@ jobs:
       contents: write
 
     steps:
-      - uses: actions/download-artifact@v8.0.1
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           pattern: wheels-*
           merge-multiple: true
           path: dist
 
       - name: Publish to PyPI
-        if: startsWith(github.ref, 'refs/tags/')
-        uses: pypa/gh-action-pypi-publish@release/v1
+        if: github.ref_type != 'tag'
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
         with:
           packages-dir: dist

.github/workflows/docs.yml

@@ -3,29 +3,35 @@ name: Deploy Docs
 on:
   workflow_dispatch:
 
-permissions:
-  contents: write
-  pages: write
-  id-token: write
-
 jobs:
   build:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
 
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        # zizmor: ignore[artipacked]
         with:
           fetch-depth: 0
 
-      - uses: actions/setup-python@v6.2.0
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: 3.14
 
-      - run: pip install "mkdocs-material" "mkdocstrings[python]"
+      - name: "Install uv"
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        with:
+          enable-cache: false
+
+      - run: uv pip install --group docs --system
       - run: mkdocs gh-deploy --config-file docs/mkdocs.yml --force
 
   deploy_mkdocs:
     needs: build
+    permissions:
+      pages: write
+      id-token: write
 
     environment:
       name: github-pages
@@ -34,15 +40,16 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: gh-pages
+          persist-credentials: false
 
-      - uses: actions/configure-pages@v6.0.0
+      - uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
 
-      - uses: actions/upload-pages-artifact@v5.0.0
+      - uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
         with:
           path: "."
 
       - id: deployment
-        uses: actions/deploy-pages@v5.0.0
+        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0