Remove or protect secrets in Actions (#9544)

Author: radarhere

.github/workflows/test-docker.yml

@@ -108,7 +108,6 @@ jobs:
       with:
         flags: GHA_Docker
         name: ${{ matrix.docker }}
-        token: ${{ secrets.CODECOV_ORG_TOKEN }}
 
   success:
     permissions:

.github/workflows/test-mingw.yml

@@ -92,4 +92,3 @@ jobs:
           files: ./coverage.xml
           flags: GHA_Windows
           name: "MSYS2 MinGW"
-          token: ${{ secrets.CODECOV_ORG_TOKEN }}

.github/workflows/test-windows.yml

@@ -234,7 +234,6 @@ jobs:
         files: ./coverage.xml
         flags: GHA_Windows
         name: ${{ runner.os }} Python ${{ matrix.python-version }}
-        token: ${{ secrets.CODECOV_ORG_TOKEN }}
 
   success:
     permissions:

.github/workflows/test.yml

@@ -177,7 +177,6 @@ jobs:
       with:
         flags: ${{ matrix.os == 'ubuntu-latest' && 'GHA_Ubuntu' || 'GHA_macOS' }}
         name: ${{ matrix.os }} Python ${{ matrix.python-version }}
-        token: ${{ secrets.CODECOV_ORG_TOKEN }}
 
   success:
     permissions:

.github/workflows/wheels.yml

@@ -264,6 +264,9 @@ jobs:
     needs: count-dists
     runs-on: ubuntu-latest
     name: Upload wheels to scientific-python-nightly-wheels
+    environment:
+      name: release-anaconda
+      url: https://anaconda.org/channels/anaconda/packages/pillow/overview
     steps:
       - uses: actions/download-artifact@v8
         with:

.pre-commit-config.yaml

@@ -1,12 +1,12 @@
 repos:
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.15.4
+    rev: v0.15.9
     hooks:
       - id: ruff-check
         args: [--exit-non-zero-on-fix]
 
   - repo: https://github.com/psf/black-pre-commit-mirror
-    rev: 26.1.0
+    rev: 26.3.1
     hooks:
       - id: black
 
@@ -24,7 +24,7 @@ repos:
         exclude: (Makefile$|\.bat$|\.cmake$|\.eps$|\.fits$|\.gd$|\.opt$)
 
   - repo: https://github.com/pre-commit/mirrors-clang-format
-    rev: v22.1.0
+    rev: v22.1.2
     hooks:
       - id: clang-format
         types: [c]
@@ -54,14 +54,14 @@ repos:
         exclude: ^\.github/.*TEMPLATE|^Tests/(fonts|images)/
 
   - repo: https://github.com/python-jsonschema/check-jsonschema
-    rev: 0.37.0
+    rev: 0.37.1
     hooks:
       - id: check-github-workflows
       - id: check-readthedocs
       - id: check-renovate
 
   - repo: https://github.com/zizmorcore/zizmor-pre-commit
-    rev: v1.22.0
+    rev: v1.23.1
     hooks:
       - id: zizmor
 
@@ -71,7 +71,7 @@ repos:
       - id: sphinx-lint
 
   - repo: https://github.com/tox-dev/pyproject-fmt
-    rev: v2.16.2
+    rev: v2.21.0
     hooks:
       - id: pyproject-fmt
 

pyproject.toml

@@ -186,12 +186,6 @@ lint.isort.required-imports = [
 [tool.pyproject-fmt]
 max_supported_python = "3.14"
 
-[tool.pytest]
-addopts = [ "-ra", "--color=auto" ]
-testpaths = [
-  "Tests",
-]
-
 [tool.mypy]
 python_version = "3.10"
 pretty = true
@@ -203,3 +197,9 @@ follow_imports = "silent"
 warn_redundant_casts = true
 warn_unreachable = true
 warn_unused_ignores = true
+
+[tool.pytest]
+addopts = [ "-ra", "--color=auto" ]
+testpaths = [
+  "Tests",
+]