chore: Sync with WeblateOrg/meta

Author: nijel

.editorconfig

@@ -0,0 +1,40 @@
+# Copyright © Michal Čihař <michal@weblate.org>
+#
+# SPDX-License-Identifier: CC0-1.0
+
+# This file is maintained in https://github.com/WeblateOrg/meta/
+
+root = true
+
+[*]
+indent_style = space
+indent_size = 2
+end_of_line = lf
+charset = utf-8
+trim_trailing_whitespace = true
+insert_final_newline = true
+spaces_around_operators = true
+
+[*.bat]
+end_of_line = crlf
+
+[*.html]
+indent_size = 2
+
+[*.py]
+indent_size = 4
+
+[*.rst]
+indent_size = 3
+
+[*.js]
+quote_type = double
+
+[*.{markdown,md}]
+trim_trailing_whitespace = false
+
+[[shell]]
+indent_style = space
+indent_size = 4
+space_redirects = true
+simplify = true

.github/workflows/ci.yml

@@ -250,7 +250,7 @@ jobs:
         path: dist
 
   sdist:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     name: Package sdist
     steps:
     - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
@@ -282,7 +282,7 @@ jobs:
 
   release:
     name: Release
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     if: ${{ startsWith(github.ref, 'refs/tags/') || github.event_name == 'workflow_dispatch' }}
     needs: all-tests
     permissions:
@@ -309,7 +309,7 @@ jobs:
         args: --non-interactive --skip-existing wheels-*/*
 
   release_github:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     name: Create release on GitHub
     permissions:
       contents: write

.github/workflows/dependency-review.yml

@@ -0,0 +1,22 @@
+# Copyright © Michal Čihař <michal@weblate.org>
+#
+# SPDX-License-Identifier: CC0-1.0
+
+# This file is maintained in https://github.com/WeblateOrg/meta/
+name: Dependency Review
+on:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  dependency-review:
+    runs-on: ubuntu-slim
+    steps:
+    - name: Checkout Repository
+      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8   # v6.0.1
+      with:
+        persist-credentials: false
+    - name: Dependency Review
+      uses: actions/dependency-review-action@3c4e3dcb1aa7874d2c16be7d79418e9b7efd6261   # v4.8.2

.github/workflows/pre-commit.yml

@@ -44,6 +44,7 @@ jobs:
         python-version: '3.14'
     - uses: astral-sh/setup-uv@61cb8a9741eeb8a550a1b8544337180c0fc8476b # v7.2.0
       with:
+        version: 0.9.25
         enable-cache: false
     - name: detect method
       id: detect

.github/workflows/pull_requests.yaml

@@ -0,0 +1,28 @@
+# Copyright © Michal Čihař <michal@weblate.org>
+#
+# SPDX-License-Identifier: CC0-1.0
+
+# This file is maintained in https://github.com/WeblateOrg/meta/
+
+name: Pull request automation
+
+on: # zizmor: ignore[dangerous-triggers]
+  pull_request_target:
+    types: opened
+
+permissions:
+  contents: read
+
+jobs:
+  weblate_automerge:
+    runs-on: ubuntu-slim
+    name: Weblate automerge
+    if: github.actor == 'weblate'
+    steps:
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      with:
+        persist-credentials: false
+    - name: Enable Pull Request Automerge
+      run: gh pr merge --rebase --auto "${{ github.event.pull_request.number }}"
+      env:
+        GH_TOKEN: ${{ secrets.WEBLATE_CI_TOKEN }}

.pre-commit-config.yaml

@@ -10,7 +10,6 @@ repos:
   - id: check-toml
   - id: check-merge-conflict
   - id: check-json
-  - id: debug-statements
   - id: mixed-line-ending
     args: [--fix=lf]
   - id: pretty-format-json
@@ -66,3 +65,5 @@ repos:
   - id: gitleaks
 ci:
   autoupdate_schedule: quarterly
+  skip:
+  - reuse

SECURITY.md

@@ -0,0 +1,29 @@
+<!--
+Copyright © Michal Čihař <michal@weblate.org>
+
+SPDX-License-Identifier: CC0-1.0
+
+This file is maintained in https://github.com/WeblateOrg/meta/
+-->
+
+# Weblate security
+
+The Weblate team takes security and related transparency very seriously.
+We welcome any peer review of our 100% open-source code to ensure nobody's Weblate
+is ever compromised or hacked.
+
+If you think you have identified a security issue with a Weblate project, **do
+not open a public issue**.
+
+To responsibly report a security issue, please navigate to the Security tab for
+the repository and click “Report a vulnerability”.
+
+Be sure to include as much detail as necessary in your report. As with
+reporting normal issues, a minimal reproducible example will help the
+maintainers address the issue faster.
+
+More information about practices for reporting and fixing security issues is
+described in [our documentation][1]. This ensures all vulnerabilities are
+solved securely, quickly, and transparently.
+
+[1]: https://docs.weblate.org/en/latest/security/issues.html