Modernize dev tooling and pin CI action versions

.github/dependabot.yml

@@ -11,6 +11,8 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
+    cooldown:
+      default-days: 7
     groups:
       github-actions:
         patterns:
@@ -21,6 +23,8 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
+    cooldown:
+      default-days: 7
     groups:
       python-requirements:
         patterns:

.github/workflows/devcontainer-ci.yaml

@@ -20,9 +20,11 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
       - name: Use Node.js 20.x
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: 20.x
       - run: npm install -g @devcontainers/cli

.github/workflows/labeler.yaml

@@ -2,7 +2,7 @@ name: Pull Request Labeler
 
 on:
   workflow_dispatch:
-  pull_request_target:
+  pull_request:
 
 permissions:
   contents: read
@@ -12,5 +12,7 @@ jobs:
   labeler:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v6
-    - uses: actions/labeler@v6
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      with:
+        persist-credentials: false
+    - uses: actions/labeler@f27b608878404679385c85cfa523b85ccb86e213 # v6.1.0

.github/workflows/live-repo-smoke-matrix.yaml

@@ -19,32 +19,36 @@ jobs:
         os: [ubuntu-latest]
         python_version: [ "3.10", "3.11", "3.12", "3.13"]
     steps:
-    - uses: actions/checkout@v6
-    - uses: astral-sh/setup-uv@v7
-      with:
-        python-version: ${{ matrix.python_version }}
-    - name: Install dependencies
-      run: uv sync
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        with:
+          enable-cache: true
+          prune-cache: false
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version: ${{ matrix.python_version }}
 
-    - name: Clone Testing Repositories
-      run: |
-        git clone https://github.com/Azure-Samples/azure-search-openai-demo
+      - name: Clone Testing Repositories
+        run: |
+          git clone https://github.com/Azure-Samples/azure-search-openai-demo
 
-    - name: Test Check Broken Paths in azure-search-openai-demo
-      if: always()
-      run: |
-        cd azure-search-openai-demo
-        uv run --project .. markdown-checker -d . -f check_broken_paths -gu ''
+      - name: Test Check Broken Paths in azure-search-openai-demo
+        if: always()
+        run: |
+          cd azure-search-openai-demo
+          uv run --project .. markdown-checker -d . -f check_broken_paths -gu ''
 
-    - name: Test Check URLs Country locale in azure-search-openai-demo
-      if: always()
-      run: |
-        cd azure-search-openai-demo
-        uv run --project .. markdown-checker -d . -f check_urls_locale -gu ''
+      - name: Test Check URLs Country locale in azure-search-openai-demo
+        if: always()
+        run: |
+          cd azure-search-openai-demo
+          uv run --project .. markdown-checker -d . -f check_urls_locale -gu ''
 
-    - name: Test Check Broken URLs in azure-search-openai-demo
-      if: always()
-      continue-on-error: true
-      run: |
-        cd azure-search-openai-demo
-        uv run --project .. markdown-checker -d . -f check_broken_urls -gu ''
+      - name: Test Check Broken URLs in azure-search-openai-demo
+        if: always()
+        continue-on-error: true
+        run: |
+          cd azure-search-openai-demo
+          uv run --project .. markdown-checker -d . -f check_broken_urls -gu ''

.github/workflows/live-repo-smoke-pr.yaml

@@ -19,63 +19,68 @@ jobs:
     runs-on: ubuntu-latest
     continue-on-error: true
     steps:
-    - uses: actions/checkout@v6
-    - name: Set up uv
-      uses: astral-sh/setup-uv@v7
-      with:
-        python-version: "3.10"
-    - name: Install dependencies
-      run: uv sync
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        with:
+          enable-cache: true
+          prune-cache: false
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version-file: pyproject.toml
 
-    - name: Clone Repo
-      run: git clone https://github.com/Azure-Samples/azure-search-openai-demo
+      - name: Clone Repo
+        run: git clone https://github.com/Azure-Samples/azure-search-openai-demo
 
-    - name: Test Check Broken Paths in azure-search-openai-demo
-      if: always()
-      run: |
-        cd azure-search-openai-demo
-        uv run --project .. markdown-checker -d . -f check_broken_paths -gu ''
-    - name: Test Check URLs Country locale in azure-search-openai-demo
-      if: always()
-      run: |
-        cd azure-search-openai-demo
-        uv run --project .. markdown-checker -d . -f check_urls_locale -gu ''
+      - name: Test Check Broken Paths in azure-search-openai-demo
+        if: always()
+        run: |
+          cd azure-search-openai-demo
+          uv run --project .. markdown-checker -d . -f check_broken_paths -gu ''
+      - name: Test Check URLs Country locale in azure-search-openai-demo
+        if: always()
+        run: |
+          cd azure-search-openai-demo
+          uv run --project .. markdown-checker -d . -f check_urls_locale -gu ''
 
-    - name: Test Check Broken URLs in azure-search-openai-demo
-      if: always()
-      continue-on-error: true
-      run: |
-        cd azure-search-openai-demo
-        uv run --project .. markdown-checker -d . -f check_broken_urls -gu ''
+      - name: Test Check Broken URLs in azure-search-openai-demo
+        if: always()
+        continue-on-error: true
+        run: |
+          cd azure-search-openai-demo
+          uv run --project .. markdown-checker -d . -f check_broken_urls -gu ''
 
   live-repo-smoke-markdown-checker:
     name: Live Repo Smoke - markdown-checker
     runs-on: ubuntu-latest
     continue-on-error: true
     steps:
-    - uses: actions/checkout@v6
-    - name: Set up uv
-      uses: astral-sh/setup-uv@v7
-      with:
-        python-version: "3.10"
-    - name: Install dependencies
-      run: uv sync
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        with:
+          enable-cache: true
+          prune-cache: false
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version-file: pyproject.toml
+      - name: Test Check Broken Paths in markdown-checker
+        if: always()
+        run: |
+          uv run markdown-checker -d . -f check_broken_paths -gu ''
+      - name: Test Check URLs Country locale in markdown-checker
+        if: always()
+        run: |
+          uv run markdown-checker -d . -f check_urls_locale -gu ''
+      - name: Test Check Broken URLs in markdown-checker
+        if: always()
+        continue-on-error: true
+        run: |
+          uv run markdown-checker -d . -f check_broken_urls -gu ''
 
-    - name: Test Check Broken Paths in markdown-checker
-      if: always()
-      run: |
-        uv run markdown-checker -d . -f check_broken_paths -gu ''
-    - name: Test Check URLs Country locale in markdown-checker
-      if: always()
-      run: |
-        uv run markdown-checker -d . -f check_urls_locale -gu ''
-    - name: Test Check Broken URLs in markdown-checker
-      if: always()
-      continue-on-error: true
-      run: |
-        uv run markdown-checker -d . -f check_broken_urls -gu ''
-
-    - name: Set job summary
-      if: ${{ always() &&  hashFiles('./comment.md') != '' }}
-      shell: bash
-      run: cat ./comment.md >> $GITHUB_STEP_SUMMARY
+      - name: Set job summary
+        if: ${{ always() &&  hashFiles('./comment.md') != '' }}
+        shell: bash
+        run: cat ./comment.md >> $GITHUB_STEP_SUMMARY

.github/workflows/pre-commit.yaml

@@ -0,0 +1,29 @@
+name: pre-commit
+on:
+  pull_request:
+  push:
+    branches: [main, stable]
+permissions: {}
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+jobs:
+  main:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        with:
+          enable-cache: true
+          prune-cache: false
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        id: setup-python
+        with:
+          python-version-file: pyproject.toml
+      - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        with:
+          path: ~/.cache/pre-commit
+          key: pre-commit|${{ hashFiles('pyproject.toml', '.pre-commit-config.yaml') }}
+      - run: uv run --locked --no-default-groups --group pre-commit pre-commit run --show-diff-on-failure --color=always --all-files

.github/workflows/python-unit-tests.yaml

@@ -31,28 +31,54 @@ jobs:
         os: [ubuntu-latest]
         python_version: ["3.10", "3.11", "3.12", "3.13"]
     steps:
-    - uses: actions/checkout@v6
-    - uses: astral-sh/setup-uv@v7
-      with:
-        python-version: ${{ matrix.python_version }}
-    - name: Install dependencies
-      run: uv sync --extra test
-
-    - name: Run unit tests
-      run: uv run pytest tests/ --ignore=tests/smoke -v --cov
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        with:
+          enable-cache: true
+          prune-cache: false
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version: ${{ matrix.python_version }}
+      - name: Run unit tests
+        run: uv run --locked --no-default-groups --group tests pytest tests/ --ignore=tests/smoke -v --cov
 
   smoke-tests:
     name: Smoke Tests
     runs-on: ubuntu-latest
     needs: unit-tests
     steps:
-    - uses: actions/checkout@v6
-    - uses: astral-sh/setup-uv@v7
-      with:
-        python-version: "3.10"
-    - name: Install dependencies
-      run: uv sync --extra test
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        with:
+          enable-cache: true
+          prune-cache: false
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version-file: pyproject.toml
+      - name: Run smoke tests
+        continue-on-error: true
+        run: uv run --locked --no-default-groups --group tests pytest tests/smoke -m smoke -v
 
-    - name: Run smoke tests
-      continue-on-error: true
-      run: uv run pytest tests/smoke -m smoke -v
+  typing:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        with:
+          enable-cache: true
+          prune-cache: false
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version-file: pyproject.toml
+      - name: cache mypy
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        with:
+          path: ./.mypy_cache
+          key: mypy|${{ hashFiles('pyproject.toml') }}
+      - run: uv run --locked --no-default-groups --group dev tox run -e typing