harden dependency environment (#4066)

* chore(deps): bump the actions group across 1 directory with 8 updates (#176)

Bumps the actions group with 8 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [prefix-dev/setup-pixi](https://github.com/prefix-dev/setup-pixi) | `0.9.5` | `0.9.6` |
| [codecov/codecov-action](https://github.com/codecov/codecov-action) | `6.0.0` | `6.0.1` |
| [github/issue-metrics](https://github.com/github/issue-metrics) | `4.2.2` | `4.2.7` |
| [j178/prek-action](https://github.com/j178/prek-action) | `2.0.3` | `2.0.4` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `7.0.0` | `7.0.1` |
| [actions/download-artifact](https://github.com/actions/download-artifact) | `7.0.0` | `8.0.1` |
| [pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish) | `1.13.0` | `1.14.0` |
| [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action) | `0.5.3` | `0.5.6` |



Updates `prefix-dev/setup-pixi` from 0.9.5 to 0.9.6
- [Release notes](https://github.com/prefix-dev/setup-pixi/releases)
- [Commits](prefix-dev/setup-pixi@1b2de7f...5185adf)

Updates `codecov/codecov-action` from 6.0.0 to 6.0.1
- [Release notes](https://github.com/codecov/codecov-action/releases)
- [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md)
- [Commits](codecov/codecov-action@57e3a13...e79a696)

Updates `github/issue-metrics` from 4.2.2 to 4.2.7
- [Release notes](https://github.com/github/issue-metrics/releases)
- [Commits](github-community-projects/issue-metrics@c9e9838...1e38d5e)

Updates `j178/prek-action` from 2.0.3 to 2.0.4
- [Release notes](https://github.com/j178/prek-action/releases)
- [Commits](j178/prek-action@6ad8027...bdca6f1)

Updates `actions/upload-artifact` from 7.0.0 to 7.0.1
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@v7...043fb46)

Updates `actions/download-artifact` from 7.0.0 to 8.0.1
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](actions/download-artifact@v7...3e5f45b)

Updates `pypa/gh-action-pypi-publish` from 1.13.0 to 1.14.0
- [Release notes](https://github.com/pypa/gh-action-pypi-publish/releases)
- [Commits](pypa/gh-action-pypi-publish@v1.13.0...cef2210)

Updates `zizmorcore/zizmor-action` from 0.5.3 to 0.5.6
- [Release notes](https://github.com/zizmorcore/zizmor-action/releases)
- [Commits](zizmorcore/zizmor-action@b1d7e1f...5f14fd0)

---
updated-dependencies:
- dependency-name: prefix-dev/setup-pixi
  dependency-version: 0.9.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: codecov/codecov-action
  dependency-version: 6.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: github/issue-metrics
  dependency-version: 4.2.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: j178/prek-action
  dependency-version: 2.0.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: actions/upload-artifact
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: actions/download-artifact
  dependency-version: 8.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: pypa/gh-action-pypi-publish
  dependency-version: 1.14.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: zizmorcore/zizmor-action
  dependency-version: 0.5.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): pin dev tooling for reproducible CI

The hatch test envs and bare `uv run` resolve [dependency-groups] fresh
from PyPI and ignore uv.lock, so an unrelated upstream tooling release
can break CI without any change on our side (e.g. the pytest 9.1.0
`duplicate parametrization` regression, pytest-dev/pytest#14591).

Pin dev *tooling* (pytest & plugins, coverage, hypothesis, mypy, ruff,
mkdocs*, towncrier, moto, ...) to exact versions. Leave runtime/
integration deps (fsspec, obstore, s3fs, botocore, numcodecs,
universal-pathlib) floating so the `optional` test matrix keeps
exercising their latest releases; the `min_deps`/`upstream` envs cover
the floor and bleeding edge.

Also:
- Add a focused `release` dependency group as the single source of truth
  for the towncrier pin; `docs` includes it. prepare_release.yml now runs
  `uv run --only-group release towncrier build` instead of an unpinned
  `pip install towncrier`.
- Add a `uv` dependabot ecosystem so the pins and uv.lock get weekly
  update PRs instead of silently rotting.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: 3 people

.github/dependabot.yml

@@ -12,6 +12,19 @@ updates:
           - "*"
     cooldown:
       default-days: 7
+  # Keep the pinned dev tooling in pyproject.toml's [dependency-groups] and the
+  # uv.lock current. Without this the exact pins (e.g. pytest) would never be
+  # bumped automatically and would silently rot.
+  - package-ecosystem: "uv"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    groups:
+      python-dependencies:
+        patterns:
+          - "*"
+    cooldown:
+      default-days: 7
   - package-ecosystem: "github-actions"
     directory: "/"
     target-branch: "support/v2"

.github/workflows/prepare_release.yml

@@ -42,15 +42,12 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
 
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
-        with:
-          python-version: '3.12'
-
-      - name: Install towncrier
-        run: pip install towncrier
+      - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
 
       - name: Build changelog
-        run: towncrier build --version "$VERSION" --yes
+        # Use the pinned towncrier from the `release` dependency group (single
+        # source of truth) rather than an unpinned standalone install.
+        run: uv run --only-group release towncrier build --version "$VERSION" --yes
         env:
           VERSION: ${{ inputs.version }}
 

pyproject.toml

@@ -83,56 +83,68 @@ Discussions = "https://github.com/zarr-developers/zarr-python/discussions"
 documentation = "https://zarr.readthedocs.io/"
 homepage = "https://github.com/zarr-developers/zarr-python"
 
+# Dev *tooling* is pinned to exact versions for reproducible CI: the hatch envs
+# (see `tool.hatch.envs.*`) and bare `uv run` resolve these groups fresh from
+# PyPI and do NOT consult uv.lock, so an unrelated tooling release can break CI
+# without any change on our side (e.g. the pytest 9.1.0 `duplicate
+# parametrization` regression). Runtime/integration deps (fsspec, obstore, s3fs,
+# botocore, numcodecs, universal-pathlib) are intentionally left floating so the
+# `optional` test matrix keeps exercising their latest releases; their floor and
+# bleeding edge are covered by the `min_deps` and `upstream` hatch envs. Bump the
+# pins deliberately, e.g. via dependabot or `uv lock --upgrade`.
 [dependency-groups]
 test = [
-    "coverage>=7.10",
-    "pytest",
-    "pytest-asyncio",
-    "pytest-cov",
-    "pytest-accept",
-    "numpydoc",
-    "hypothesis",
-    "pytest-xdist",
-    "pytest-benchmark",
-    "pytest-codspeed",
-    "tomlkit",
-    "uv",
+    "coverage==7.14.0",
+    "pytest==9.0.3",
+    "pytest-asyncio==1.3.0",
+    "pytest-cov==7.1.0",
+    "pytest-accept==0.2.3",
+    "numpydoc==1.10.0",
+    "hypothesis==6.152.7",
+    "pytest-xdist==3.8.0",
+    "pytest-benchmark==5.2.3",
+    "pytest-codspeed==5.0.1",
+    "tomlkit==0.15.0",
+    "uv==0.11.15",
 ]
 remote-tests = [
     {include-group = "test"},
     "fsspec>=2023.10.0",
     "obstore>=0.5.1",
     "botocore",
     "s3fs>=2023.10.0",
-    "moto[s3,server]",
-    "requests",
+    "moto[s3,server]==5.2.1",
+    "requests==2.34.1",
+]
+release = [
+    "towncrier==25.8.0",
 ]
 docs = [
     # Doc building
-    "mkdocs-material[imaging]>=9.6.14",
-    "mkdocs>=1.6.1,<2",
-    "mkdocstrings>=0.29.1",
-    "mkdocstrings-python>=1.16.10",
-    "mike>=2.1.3",
-    "mkdocs-jupyter>=0.25.1",
-    "mkdocs-redirects>=1.2.0",
-    "markdown-exec[ansi]",
-    "griffe-inherited-docstrings",
-    "ruff",
+    "mkdocs-material[imaging]==9.7.6",
+    "mkdocs==1.6.1",
+    "mkdocstrings==1.0.4",
+    "mkdocstrings-python==2.0.3",
+    "mike==2.2.0",
+    "mkdocs-jupyter==0.26.3",
+    "mkdocs-redirects==1.2.3",
+    "markdown-exec[ansi]==1.12.1",
+    "griffe-inherited-docstrings==1.1.3",
+    "ruff==0.15.12",
     # Changelog generation
-    "towncrier",
+    {include-group = "release"},
     # Optional dependencies to run examples
     "numcodecs[msgpack]",
     "s3fs>=2023.10.0",
-    "astroid<4",
-    "pytest",
+    "astroid==3.3.11",
+    "pytest==9.0.3",
 ]
 dev = [
     {include-group = "test"},
     {include-group = "remote-tests"},
     {include-group = "docs"},
     "universal-pathlib",
-    "mypy",
+    "mypy==2.1.0",
 ]
 
 [tool.coverage.report]