Modernize CI, harden workflows, swap pyright for ty.

Make zizmor --pedantic clean by pinning actions to SHAs, scoping
permissions, setting persist-credentials: false, and routing matrix /
github.ref_name through env vars. Add zizmor (pedantic) to pre-commit.

Move the noxfile to a uv-native layout (uv sync + dependency-groups),
drop the virtualenv fallback, and let uv install Pythons in CI in place
of actions/setup-python.

Drop Python 3.9 and 3.10, add 3.14, bump PyPy to 3.11.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: Julian

.github/workflows/ci.yml

@@ -12,95 +12,98 @@ on:
     - cron: "33 8 * * *"
   workflow_dispatch:
 
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   list:
+    name: List nox sessions
     runs-on: ubuntu-latest
+    permissions:
+      contents: read  # checkout
     outputs:
       noxenvs: ${{ steps.noxenvs-matrix.outputs.noxenvs }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.0
+        with:
+          persist-credentials: false
       - name: Set up uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b  # v7.1.0
         with:
-          enable-cache: true
+          enable-cache: false
       - id: noxenvs-matrix
         run: |
           echo >>$GITHUB_OUTPUT noxenvs=$(
             uvx nox --list-sessions --json | jq '[.[].session]'
           )
 
   ci:
+    name: Run nox session
     needs: list
     runs-on: ubuntu-latest
+    permissions:
+      contents: read  # checkout
 
     strategy:
       fail-fast: false
       matrix:
         noxenv: ${{ fromJson(needs.list.outputs.noxenvs) }}
         posargs: [""]
         include:
-          - noxenv: tests-3.12
+          - noxenv: tests-3.14
             posargs: coverage github
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.0
         with:
           submodules: "recursive"
-      - name: Install dependencies
-        run: sudo apt-get update && sudo apt-get install -y libenchant-2-dev
-        if: runner.os == 'Linux' && startsWith(matrix.noxenv, 'docs')
-      - name: Install dependencies
-        run: brew install enchant
-        if: runner.os == 'macOS' && startsWith(matrix.noxenv, 'docs')
-      - name: Set up Python
-        uses: actions/setup-python@v6
-        with:
-          python-version: |
-            3.9
-            3.10
-            3.11
-            3.12
-            3.13
-            pypy3.10
-          allow-prereleases: true
-
+          persist-credentials: false
       - name: Set up uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b  # v7.1.0
         with:
-          enable-cache: true
+          enable-cache: false
 
       - name: Run nox
-        run: uvx nox -s "${{ matrix.noxenv }}" -- ${{ matrix.posargs }}
+        env:
+          NOXENV: ${{ matrix.noxenv }}
+          POSARGS: ${{ matrix.posargs }}
+        run: uvx nox -s "$NOXENV" -- $POSARGS
 
   packaging:
+    name: Package and release
     needs: ci
     runs-on: ubuntu-latest
     environment:
       name: PyPI
       url: https://pypi.org/p/schemastore
 
     permissions:
-      contents: write
-      id-token: write
+      contents: write  # gh release create
+      id-token: write  # OIDC for trusted publishing to PyPI
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.0
         with:
           submodules: "recursive"
+          persist-credentials: false
 
       - name: Set up uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b  # v7.1.0
         with:
-          enable-cache: true
+          enable-cache: false
 
       - name: Build our distributions
         run: uv run --frozen --with 'build[uv]' -m build --installer=uv
 
       - name: Publish to PyPI
         if: github.event_name == 'push' && startsWith(github.event.ref, 'refs/tags')
-        uses: pypa/gh-action-pypi-publish@release/v1
+        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b  # release/v1
       - name: Create a Release
         if: github.event_name == 'push' && startsWith(github.event.ref, 'refs/tags')
-        run: gh release create ${{ github.ref_name }} dist/* --generate-notes
         env:
           GH_TOKEN: ${{ github.token }}
+          REF_NAME: ${{ github.ref_name }}
+        run: gh release create "$REF_NAME" dist/* --generate-notes

.pre-commit-config.yaml

@@ -39,3 +39,8 @@ repos:
         alias: ruff
       - id: ruff-check
         alias: ruff
+  - repo: https://github.com/zizmorcore/zizmor-pre-commit
+    rev: v1.24.1
+    hooks:
+      - id: zizmor
+        args: [--pedantic]

noxfile.py

@@ -8,17 +8,10 @@
 PYPROJECT = ROOT / "pyproject.toml"
 PACKAGE = ROOT / "schemastore"
 
-REQUIREMENTS = dict(
-    tests=ROOT / "test-requirements.txt",
-)
-REQUIREMENTS_IN = [  # this is actually ordered, as files depend on each other
-    (path.parent / f"{path.stem}.in", path) for path in REQUIREMENTS.values()
-]
-
-SUPPORTED = ["3.9", "3.10", "pypy3.10", "3.11", "3.12", "3.13"]
+SUPPORTED = ["3.11", "pypy3.11", "3.12", "3.13", "3.14"]
 LATEST = SUPPORTED[-1]
 
-nox.options.default_venv_backend = "uv|virtualenv"
+nox.options.default_venv_backend = "uv"
 nox.options.sessions = []
 
 
@@ -36,7 +29,12 @@ def tests(session):
     """
     Run the test suite with a corresponding Python version.
     """
-    session.install("-r", REQUIREMENTS["tests"])
+    session.run_install(
+        "uv",
+        "sync",
+        f"--python={session.virtualenv.location}",
+        env={"UV_PROJECT_ENVIRONMENT": session.virtualenv.location},
+    )
 
     if session.posargs and session.posargs[0] == "coverage":
         if len(session.posargs) > 1 and session.posargs[1] == "github":
@@ -102,24 +100,5 @@ def typing(session):
     """
     Check static typing.
     """
-    session.install("pyright", ROOT)
-    session.run("pyright", *session.posargs, PACKAGE)
-
-
-@session(default=False)
-def requirements(session):
-    """
-    Update the project's pinned requirements.
-
-    You should commit the result afterwards.
-    """
-    if session.venv_backend == "uv":
-        cmd = ["uv", "pip", "compile"]
-    else:
-        session.install("pip-tools")
-        cmd = ["pip-compile", "--resolver", "backtracking", "--strip-extras"]
-
-    for each, out in REQUIREMENTS_IN:
-        # otherwise output files end up with silly absolute path comments...
-        relative = each.relative_to(ROOT)
-        session.run(*cmd, "--upgrade", "--output-file", out, relative)
+    session.install("ty", ROOT)
+    session.run("ty", "check", *session.posargs, PACKAGE)

pyproject.toml

@@ -8,7 +8,7 @@ source = "vcs"
 [project]
 name = "schemastore"
 description = "Easy use of the JSON SchemaStore from Python, as a referencing.Registry"
-requires-python = ">=3.8"
+requires-python = ">=3.11"
 readme = "README.md"
 keywords = ["schemastore", "json", "yaml", "schemas", "referencing", "jsonschema"]
 authors = [
@@ -21,11 +21,10 @@ classifiers = [
   "License :: OSI Approved :: Apache Software License",
   "Operating System :: OS Independent",
   "Programming Language :: Python",
-  "Programming Language :: Python :: 3.9",
-  "Programming Language :: Python :: 3.10",
   "Programming Language :: Python :: 3.11",
   "Programming Language :: Python :: 3.12",
   "Programming Language :: Python :: 3.13",
+  "Programming Language :: Python :: 3.14",
   "Programming Language :: Python :: Implementation :: CPython",
   "Programming Language :: Python :: Implementation :: PyPy",
   "Topic :: File Formats :: JSON",
@@ -42,6 +41,11 @@ Homepage = "https://github.com/python-jsonschema/schemastore"
 Issues = "https://github.com/python-jsonschema/schemastore/issues/"
 Source = "https://github.com/python-jsonschema/schemastore"
 
+[dependency-groups]
+dev = [
+  "pytest>=8.3.4",
+]
+
 [tool.coverage.html]
 show_contexts = true
 skip_covered = false
@@ -65,9 +69,7 @@ ignore = [
   "D001",  # one sentence per line, so max length doesn't make sense
 ]
 
-[tool.pyright]
-reportUnnecessaryTypeIgnoreComment = true
-strict = ["**/*"]
+[tool.ty.src]
 exclude = [
   "**/tests/__init__.py",
   "**/tests/test_*.py",
@@ -120,7 +122,6 @@ ignore = [
   "SIM300", # Not sure what heuristic this uses, but it's easily incorrect
   "SLF001",  # Private usage within this package itself is fine
   "TD",  # These TODO style rules are also silly
-  "UP007",  # We support 3.9
 ]
 
 [tool.ruff.lint.flake8-pytest-style]