v3.3.0

.github/workflows/audit.yml

@@ -0,0 +1,43 @@
+---
+name: audit
+
+# Dependency vulnerability audit (pip-audit, see the `audit` env in tox.ini).
+#
+# This is deliberately *not* wired into the `tests` workflow: a new advisory
+# can be published against an unchanged dependency tree, so the audit is
+# time-triggered rather than change-triggered.  The pull_request trigger is
+# narrowed to the files that can change the dependency tree.
+on:
+  pull_request:
+    paths:
+      - pyproject.toml
+      - tox.ini
+      - .github/workflows/audit.yml
+  workflow_dispatch:
+  schedule:
+    # Mondays 04:17 UTC, well clear of the nightly link check (22:03).
+    - cron: "17 4 * * 1"
+
+concurrency:
+  group: audit-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  pip-audit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          # hatch-vcs derives the version from git tags; without them the
+          # project metadata pip-audit reads cannot be built.
+          fetch-depth: 0
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.13"
+      - uses: actions/cache@v4
+        with:
+          path: ~/.cache/pip
+          key: pip|${{ hashFiles('pyproject.toml') }}|${{ hashFiles('tox.ini') }}
+      - run: pip install tox
+      - name: Audit dependencies for known vulnerabilities
+        run: tox -e audit

.github/workflows/linkcheck.yml

@@ -7,29 +7,57 @@ on:
   schedule:
    - cron: "03 22 * * *"
 
+concurrency:
+  group: linkcheck-${{ github.ref }}
+  cancel-in-progress: false
+
 jobs:
   linkcheck:
     runs-on: ubuntu-latest
     permissions:
       issues: write
     steps:
     - uses: actions/checkout@v5
+    - name: Restore lychee cache
+      uses: actions/cache@v4
+      with:
+        path: .lycheecache
+        key: cache-lychee-${{ github.run_id }}
+        restore-keys: cache-lychee-
     - name: Check links with Lychee
       id: lychee
       uses: lycheeverse/lychee-action@v2
       with:
         fail: false
         args: >-
           --root-dir "$(pwd)"
-          --timeout 20
-          --max-retries 3
+          --timeout 30
+          --max-retries 6
+          --retry-wait-time 2
           --cache
           --max-cache-age 14d
           .
-    - name: Create Issue From File
-      if: steps.lychee.outputs.exit_code != 0
-      uses: peter-evans/create-issue-from-file@v5
-      with:
-        title: Link Checker Report
-        content-filepath: ./lychee/out.md
-        labels: report, automated issue
+    - name: Create or update Link Checker issue
+      if: steps.lychee.outputs.exit_code != 0 && github.ref == 'refs/heads/master'
+      env:
+        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      run: |
+        # Keep the oldest open report issue as canonical, fold duplicates in.
+        ISSUES=$(gh issue list --label "report" --state open --json number --jq '.[].number' | sort -n)
+        CANON=$(printf '%s\n' "$ISSUES" | head -1)
+        for n in $(printf '%s\n' "$ISSUES" | tail -n +2); do
+          gh issue close "$n" --comment "Duplicate of #${CANON} - auto-closed by the link checker."
+        done
+        if [ -n "$CANON" ]; then
+          gh issue edit "$CANON" --body-file ./lychee/out.md
+        else
+          gh issue create --title "Link Checker Report" --body-file ./lychee/out.md --label "report" --label "automated issue"
+        fi
+    - name: Close Link Checker issue if all links are healthy
+      if: steps.lychee.outputs.exit_code == 0 && github.ref == 'refs/heads/master'
+      env:
+        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      run: |
+        for n in $(gh issue list --label "report" --state open --json number --jq '.[].number'); do
+          gh issue close "$n" --comment "All links are now healthy."
+        done

.github/workflows/tests.yaml

@@ -97,7 +97,7 @@ jobs:
       - uses: actions/cache@v4
         with:
           path: ~/.cache/pip
-          key: pip|${{ hashFiles('setup.py') }}|${{ hashFiles('tox.ini') }}
+          key: pip|${{ hashFiles('pyproject.toml') }}|${{ hashFiles('tox.ini') }}
       - run: pip install tox
       - name: Configure Baikal with pre-seeded database
         run: |
@@ -326,7 +326,7 @@ jobs:
       - uses: actions/cache@v4
         with:
           path: ~/.cache/pip
-          key: pip|${{ hashFiles('setup.py') }}|${{ hashFiles('tox.ini') }}
+          key: pip|${{ hashFiles('pyproject.toml') }}|${{ hashFiles('tox.ini') }}
       - run: pip install tox
       - run: tox -e docs
   style:
@@ -339,7 +339,7 @@ jobs:
       - uses: actions/cache@v4
         with:
           path: ~/.cache/pip
-          key: pip|${{ hashFiles('setup.py') }}|${{ hashFiles('tox.ini') }}
+          key: pip|${{ hashFiles('pyproject.toml') }}|${{ hashFiles('tox.ini') }}
       - uses: actions/cache@v4
         with:
           path: ~/.cache/pre-commit
@@ -356,7 +356,7 @@ jobs:
       - uses: actions/cache@v4
         with:
           path: ~/.cache/pip
-          key: pip|${{ hashFiles('setup.py') }}|${{ hashFiles('tox.ini') }}
+          key: pip|${{ hashFiles('pyproject.toml') }}|${{ hashFiles('tox.ini') }}
       - run: pip install tox
       - run: tox -e deptry
   # The three async-* jobs below exist to test the async backend *selection* logic,

.gitignore

@@ -34,3 +34,7 @@ tests/docker-test-servers/*/baikal-backup/
 !tests/docker-test-servers/baikal/Specific/
 # Local test server configuration (may contain credentials)
 tests/caldav_test_servers.yaml
+# Lychee link checker cache
+.lycheecache
+# Scratch files from AI sessions (review notes, draft commit messages)
+docs/design/tmp-*

.lycheeignore

@@ -2,6 +2,7 @@
 https?://your\.server\.example\.com/.*
 https?://.*\.example\.com(:\d+)?(/.*)?$
 https?://domain/.*
+https?://evil.attacker.com/caldav/
 
 # Localhost URLs for test servers (not accessible in CI)
 http://localhost:\d+/.*
@@ -17,6 +18,7 @@ https://caldav\.gmx\.net/.*
 https://caldav\.icloud\.com/.*
 https://p\d+-caldav\.icloud\.com/.*
 https://posteo\.de:\d+/.*
+https://sync\.infomaniak\.com/.*
 https://purelymail\.com/.*
 https://webmail\.all-inkl\.com/.*
 https://www\.google\.com/calendar/dav/.*

.pre-commit-config.yaml

@@ -1,21 +1,21 @@
 ---
 repos:
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.9.4
+    rev: v0.15.20
     hooks:
-      - id: ruff
+      - id: ruff-check
         args: [--fix]
       - id: ruff-format
 
   - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v5.0.0
+    rev: v6.0.0
     hooks:
-      - id: check-byte-order-marker
+      - id: fix-byte-order-marker
       - id: trailing-whitespace
       - id: end-of-file-fixer
 
   - repo: https://github.com/pycalendar/ai-prompt-auto-commit
-    rev: v0.0.5
+    rev: v0.0.8
     hooks:
       - id: unstage-ai-prompts
       - id: append-ai-prompts
@@ -26,13 +26,13 @@ repos:
         stages: [manual]
 
   - repo: https://github.com/compilerla/conventional-pre-commit
-    rev: v3.4.0
+    rev: v4.4.0
     hooks:
       - id: conventional-pre-commit
         stages: [commit-msg]
 
   - repo: https://github.com/lycheeverse/lychee
-    rev: lychee-v0.24.1
+    rev: lychee-v0.24.2
     hooks:
       - id: lychee
         args: ["--no-progress", "--timeout", "10", "--exclude-path", ".lycheeignore", "--max-cache-age=30d", "--cache"]