Adopt cookiecutter-scverse v0.8.0 CI/security hardening - #1257
Merged
Conversation
Cherry-picks the low-risk, high-value parts of the v0.8.0 template sync (PR #1242) while keeping squidpy's customized pyproject.toml, docs/conf.py, custom.css, gitignore, and the squidpy-specific CI jobs untouched. - pre-commit: add zizmor hook; bump biome/pyproject-fmt/ruff hooks - add dependabot for github-actions (weekly, grouped) - build/release/test workflows: pin actions to immutable SHAs, add least-privilege permissions blocks, persist-credentials: false - test workflow: switch codecov upload to OIDC (drop CODECOV_TOKEN), keeping the data-cache job, system deps + Xvfb, macOS matrix and figure artifacts - readthedocs: build on Python 3.14 + nodejs, keep notebooks submodule - cruft: record v0.8.0 sync
for more information, see https://pre-commit.ci
v0.8.0 moved shared sphinx extensions into the scverse-misc package. Replace the local docs/extensions/typed_returns.py monkeypatch with scverse_misc.sphinx_ext and add scverse-misc[sphinx] to the docs group. Theme, intersphinx and the rest of conf.py stay as squidpy's.
timtreis
force-pushed
the
template-v0.8.0-hardening
branch
from
August 11, 2026 22:11
2f7925c to
5c70dde
Compare
Pin actions to immutable SHAs, add a least-privilege permissions block, and set persist-credentials: false. Same hardening the template applies to the other workflows; zizmor (added in this PR) flagged this squidpy-specific workflow.
timtreis
marked this pull request as ready for review
August 11, 2026 22:23
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #1257 +/- ##
=======================================
Coverage 78.62% 78.62%
=======================================
Files 63 63
Lines 9330 9330
Branches 1557 1557
=======================================
Hits 7336 7336
Misses 1422 1422
Partials 572 572 🚀 New features to boost your workflow:
|
| "ipywidgets>=8", | ||
| "myst-nb>=0.17.1", | ||
| "nbsphinx>=0.8.1", | ||
| "scverse-misc[sphinx]>=0.1.2,<0.2", |
Member
Author
There was a problem hiding this comment.
The inclusion or the upper pin?
Member
Author
There was a problem hiding this comment.
In case some 0.2+ release changes anything, I'd rather introduce this with a controlled PR than having a sudden breakage 🤷
selmanozleyen
approved these changes
Aug 12, 2026
selmanozleyen
left a comment
selmanozleyen
left a comment
Member
There was a problem hiding this comment.
Thanks, this has been bugging me for a while as well
timtreis
added a commit
to timtreis/squidpy
that referenced
this pull request
Aug 12, 2026
The v0.8.0 template sync (scverse#1257) deleted docs/extensions/typed_returns.py, which renders numpy-style Returns type annotations as clean cross-references. Without it, public functions annotated '-> NDArray' emit an unresolvable numpy._typing._array_like.NDArray reference, and the docs build (run with -W) fails. This is why main's Read the Docs build is currently red. Restore the extension and re-register it in conf.py. Verified green with a full 'sphinx-build -M html docs docs/_build -W'.
timtreis
added a commit
that referenced
this pull request
Aug 12, 2026
The v0.8.0 template sync (#1257) deleted docs/extensions/typed_returns.py, which renders numpy-style Returns type annotations as clean cross-references. Without it, public functions annotated '-> NDArray' emit an unresolvable numpy._typing._array_like.NDArray reference, and the docs build (run with -W) fails. This is why main's Read the Docs build is currently red. Restore the extension and re-register it in conf.py. Verified green with a full 'sphinx-build -M html docs docs/_build -W'.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Cherry-picks the low-risk, high-value parts of the v0.8.0 template sync (#1242), leaving squidpy's customized theme, dependencies, and squidpy-specific CI jobs intact.
CI / security hardening
permissions:blocks,persist-credentials: false.use_oidc: true, dropsCODECOV_TOKEN). Kept:ensure-data-is-cached, data cache, system deps + Xvfb, macOS matrix, figure artifacts.docs/notebookssubmodule +UV_CONSTRAINT.Docs
scverse_misc.sphinx_ext(v0.8.0 moved shared sphinx extensions into thescverse-miscpackage) and drop the localdocs/extensions/typed_returns.pymonkeypatch. Addsscverse-misc[sphinx]to the docs group. Theme, intersphinx, and the rest ofconf.pystay squidpy's.pyproject.tomlalso carries thepyproject-fmtnormalization from the bumped hook (pre-commit.ci).Deliberately NOT taken from #1242
Template's
pyproject.toml(reverts deps/version/authorship to the seed skeleton), the fulldocs/conf.pyrewrite (theme swapsphinx_rtd_theme->sphinx_book_theme),docs/_static/css/custom.css(deletes 122 lines),.vscode/*,docs/changelog.md, and the stricter ruffD/TID/RUF100rules (worth a separate PR).Supersedes #1242, which should be closed.