Project maintenance: security pin, dependency alignment, CI overhaul, AGENTS.md, release-notes workflow #34

Merged

coding-agent-marvin8 merged 0 commits from refs/pull/34/head into main

2026-07-19 06:31:20 +00:00

coding-agent-marvin8 commented

2026-07-19 05:00:55 +00:00

(Migrated from codeberg.org)

Brings zaojun up to the maintenance standard established in feed2fedi:

Pins click>=8.3.3 in uv constraint-dependencies to close PYSEC-2026-2132 (HIGH, transitive via docs/release tooling); bumps cyclopts, mkdocstrings, prek, ruff, ty, and uv to the latest versions passing zaojun --min-age=7; aligns .pre-commit-config.yaml revs with the locked versions and the zaojun hook with 1.7.1; regenerates uv.lock and pylock.toml.
CI: all ci.yml jobs now run on the zhuiri runner, uv is installed via astral-sh/setup-uv@v5, and gitleaks is pinned to the pre-commit rev with checksum verification. weekly-checks.yml uses setup-uv and stays on codeberg-small-lazy.
README: Forgejo Actions CI badge replaces the retired Woodpecker badge, CodeLimit badge removed, docs links point at zaojun.marvin8.zone.
Agent instructions consolidated into AGENTS.md with CLAUDE.md as a symlink; stale codelimit/httpx references fixed, gitmoji set opened up, ruff format --check added to the definition of done, release-notes rules slimmed to the template-based reset.
Adds Release-Notes.md.template and the fediverse-validate / fediverse-post justfile recipes.

Full nox suite green locally (12 sessions: ruff, ty, interrogate, complexipy, pysentry, pytest 3.11–3.14t, deptry, dependency_versions).

Closes #33

Brings zaojun up to the maintenance standard established in feed2fedi: - Pins click>=8.3.3 in uv constraint-dependencies to close PYSEC-2026-2132 (HIGH, transitive via docs/release tooling); bumps cyclopts, mkdocstrings, prek, ruff, ty, and uv to the latest versions passing zaojun --min-age=7; aligns .pre-commit-config.yaml revs with the locked versions and the zaojun hook with 1.7.1; regenerates uv.lock and pylock.toml. - CI: all ci.yml jobs now run on the zhuiri runner, uv is installed via astral-sh/setup-uv@v5, and gitleaks is pinned to the pre-commit rev with checksum verification. weekly-checks.yml uses setup-uv and stays on codeberg-small-lazy. - README: Forgejo Actions CI badge replaces the retired Woodpecker badge, CodeLimit badge removed, docs links point at zaojun.marvin8.zone. - Agent instructions consolidated into AGENTS.md with CLAUDE.md as a symlink; stale codelimit/httpx references fixed, gitmoji set opened up, ruff format --check added to the definition of done, release-notes rules slimmed to the template-based reset. - Adds Release-Notes.md.template and the fediverse-validate / fediverse-post justfile recipes. Full nox suite green locally (12 sessions: ruff, ty, interrogate, complexipy, pysentry, pytest 3.11–3.14t, deptry, dependency_versions). Closes #33