Skip to content

Update template to v0.8.0 - #1242

Closed
scverse-bot wants to merge 4 commits into
scverse:mainfrom
scverse-bot:template-update-v2-scverse-squidpy-v0.8.0
Closed

Update template to v0.8.0#1242
scverse-bot wants to merge 4 commits into
scverse:mainfrom
scverse-bot:template-update-v2-scverse-squidpy-v0.8.0

Conversation

@scverse-bot

Copy link
Copy Markdown
Contributor

cookiecutter-scverse released v0.8.0.

Changes

This release comes with a bunch of smaller fixes and changes to the template, and a lot of under-the-hood changes reducing friction with template sync and initialization.

Changes

The most notable change is the introduction of zizmor as pre-commit hook for hardening github actions against supply-chain attacks. Github actions will be pinned to an immutable hash instead of a version number. Dependabot will take care of updating them (by @ilan-gold, @grst, @ilia-kats in scverse/cookiecutter-scverse#498).

Additionally, we introduced a helper package, scverse-misc, that contains utility code shared across scverse core and ecosystem packages. As an initial step, we moved custom sphinx extensions that were previously part of the template into scverse-misc (by @ilia-kats in scverse/cookiecutter-scverse#529). Rollout of additional features (shared logging and settings) will follow in the next release.

The remaining changes are listed below:

Updates to the template

Template sync, docs, and initialization (changes do not affect instance repos)

Additional remarks

  • unsubscribe: If you don’t want to receive these PRs in the future,
    add skip: true to template-repos.yml using a PR or,
    if you never want to sync from the template again, delete the .cruft.json file in the root of your repository.
  • If there are merge conflicts, you need to resolve them manually.
  • The scverse template works best when the pre-commit.ci, readthedocs and codecov services are enabled.
    Make sure to activate those apps if you haven't already.

timtreis added a commit that referenced this pull request Aug 12, 2026
* Adopt cookiecutter-scverse v0.8.0 CI/security hardening

Cherry-picks the low-risk, high-value parts of the v0.8.0 template sync
(PR #1242) while keeping squidpy's customized pyproject.toml, docs/conf.py,
custom.css, gitignore, and the squidpy-specific CI jobs untouched.

- pre-commit: add zizmor hook; bump biome/pyproject-fmt/ruff hooks
- add dependabot for github-actions (weekly, grouped)
- build/release/test workflows: pin actions to immutable SHAs, add
  least-privilege permissions blocks, persist-credentials: false
- test workflow: switch codecov upload to OIDC (drop CODECOV_TOKEN),
  keeping the data-cache job, system deps + Xvfb, macOS matrix and
  figure artifacts
- readthedocs: build on Python 3.14 + nodejs, keep notebooks submodule
- cruft: record v0.8.0 sync

* [pre-commit.ci] auto fixes from pre-commit.com hooks

for more information, see https://pre-commit.ci

* docs: adopt scverse_misc.sphinx_ext, drop local typed_returns

v0.8.0 moved shared sphinx extensions into the scverse-misc package.
Replace the local docs/extensions/typed_returns.py monkeypatch with
scverse_misc.sphinx_ext and add scverse-misc[sphinx] to the docs group.
Theme, intersphinx and the rest of conf.py stay as squidpy's.

* ci: harden test-notebooks.yaml for zizmor

Pin actions to immutable SHAs, add a least-privilege permissions block,
and set persist-credentials: false. Same hardening the template applies
to the other workflows; zizmor (added in this PR) flagged this
squidpy-specific workflow.

---------

Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>
@timtreis timtreis closed this Aug 12, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants