ci: zizmor and depedency-groups (#149)

Co-authored-by: Philipp A. <flying-sheep@web.de>
Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>

Author: 3 people

.github/workflows/build.yaml

@@ -22,11 +22,12 @@ jobs:
     permissions:
       id-token: write # to authenticate as Trusted Publisher to pypi.org
     steps:
-      - uses: actions/checkout@v5
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@v6
         with:
           python-version: ${{ env.PYTHON_VERSION }}
-          cache: "pip"
       - run: pip install build
       - run: python -m build
       - name: Publish to PyPI

.github/workflows/ci.yml

@@ -10,6 +10,8 @@ env:
   FORCE_COLOR: "1"
   UV_CONSTRAINT: "${{ github.workspace }}/.github/constraints.txt"
 
+permissions: {}
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
   cancel-in-progress: true
@@ -24,15 +26,18 @@ jobs:
         python-version: ["3.12", "3.14"]
     steps:
       - uses: actions/checkout@v6
-        with: { fetch-depth: 0, filter: blob:none }
-      - uses: astral-sh/setup-uv@v7
+        with:
+          fetch-depth: 0
+          filter: blob:none
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@v8.1.0
         with:
           python-version: ${{ matrix.python-version }}
       - run: uv tool install hatch
       - run: hatch -v env create hatch-test.py${{ matrix.python-version }}
       - run: hatch test --cover --python=${{ matrix.python-version }}
       - run: hatch env run --env hatch-test.py${{ matrix.python-version }} -- coverage xml
-      - uses: codecov/codecov-action@v5
+      - uses: codecov/codecov-action@v6
         with:
           files: coverage.xml
           use_oidc: true

pyproject.toml

@@ -28,38 +28,43 @@ dependencies = [
   "param",
 ]
 
-[tool.hatch]
-envs.default.dependencies = [ "ipykernel" ]
-envs.default.installer = "uv"
-envs.default.python = "3.13"
-envs.docs.scripts.build = "sphinx-build -b html docs docs/_build/html -W {args}"
-envs.docs.scripts.open = "python -m webbrowser {args:docs/_build/html/index.html}"
-envs.docs.scripts.clean = "git clean -fdX -- {args:docs}"
-envs.docs.scripts.install-kernel = "python -m ipykernel install --user --name=hv-anndata --display-name=hv-anndata"
-envs.docs.dependencies = [
+[dependency-groups]
+dev = [ { include-group = "test" } ]
+test = [
+  "holoviews>=1.23.0rc0", # Can be removed from final release
+  "nbformat-types",
+  # for VS Code’s coverage function (not needed for `hatch test -c`)
+  "pytest-cov",
+  "scanpy",
+]
+docs = [
   "furo",
   "holoviews>=1.22",
   "ipykernel",
   "ipywidgets",
   "jupyter-bokeh",
   "myst-nb",
-  "pooch",
   "plotly",
+  "pooch",
   "scanpy[scrublet]",
   "scanpydoc",
   "sphinx",
   "sphinx-autodoc-typehints",
-  "sphinx-exec-jupyter[holoviews] @ git+https://github.com/flying-sheep/sphinx-exec-jupyter.git",
   "sphinx-design",
+  "sphinx-exec-jupyter[holoviews] @ git+https://github.com/flying-sheep/sphinx-exec-jupyter.git",
   "sphinx-issues",
 ]
-envs.hatch-test.dependencies = [
-  # for VS Code’s coverage function (not needed for `hatch test -c`)
-  "pytest-cov",
-  "nbformat-types",
-  "scanpy",
-  "holoviews>=1.23.0rc0", # Can be removed from final release
-]
+
+[tool.hatch]
+envs.default.dependencies = [ "ipykernel" ]
+envs.default.installer = "uv"
+envs.default.python = "3.13"
+envs.docs.scripts.build = "sphinx-build -b html docs docs/_build/html -W {args}"
+envs.docs.scripts.open = "python -m webbrowser {args:docs/_build/html/index.html}"
+envs.docs.scripts.clean = "git clean -fdX -- {args:docs}"
+envs.docs.scripts.install-kernel = "python -m ipykernel install --user --name=hv-anndata --display-name=hv-anndata"
+envs.docs.dependency-groups = [ "docs" ]
+envs.hatch-test.dependency-groups = [ "test" ]
 metadata.hooks.docstring-description = {}
 version.source = "vcs"