Merge branch 'main' into feat/memory-store-registry

Author: d-v-b

.github/workflows/check_changelogs.yml

@@ -2,6 +2,10 @@ name: Check changelog entries
 
 on:
   pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
 
 jobs:
   check-changelogs:

.github/workflows/gpu_test.yml

@@ -13,6 +13,9 @@ on:
 env:
   LD_LIBRARY_PATH: /usr/local/cuda/extras/CUPTI/lib64:/usr/local/cuda/lib64
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true

.github/workflows/hypothesis.yaml

@@ -9,6 +9,9 @@ on:
     - cron: "0 0 * * *" # Daily “At 00:00” UTC
   workflow_dispatch: # allows you to trigger manually
 
+permissions:
+  contents: read
+
 env:
   FORCE_COLOR: 3
 

.github/workflows/lint.yml

@@ -7,6 +7,9 @@ on:
     branches: [main, 3.1.x]
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
@@ -17,9 +20,4 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
-      - name: Install uv
-        uses: astral-sh/setup-uv@v7
-      - name: Install prek
-        run: uv tool install prek
-      - name: Run prek
-        run: prek run --all-files
+      - uses: j178/prek-action@v1

.github/workflows/needs_release_notes.yml

@@ -1,7 +1,8 @@
 name: "Pull Request Labeler"
 
 on:
-  - pull_request_target
+  - pull_request_target:
+      types: [opened, reopened, synchronize]
 
 jobs:
   labeler:

.github/workflows/nightly_wheels.yml

@@ -6,6 +6,9 @@ on:
     - cron: '0 2 * * *'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   build_and_upload_nightly:
     name: Build and upload nightly wheels

.github/workflows/releases.yml

@@ -1,6 +1,14 @@
 name: Wheels
 
-on: [push, pull_request]
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
 
 jobs:
 

.github/workflows/test.yml

@@ -10,6 +10,9 @@ on:
     branches: [ main, 3.1.x ]
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
@@ -150,4 +153,4 @@ jobs:
           contains(needs.*.result, 'cancelled')
         run: exit 1
       - name: Success
-        run: echo Success!
+        run: echo Success!

.pre-commit-config.yaml

@@ -50,11 +50,6 @@ repos:
     rev: 2026.03.02
     hooks:
       - id: sp-repo-review
-  - repo: https://github.com/pre-commit/pygrep-hooks
-    rev: v1.10.0
-    hooks:
-      - id: rst-directive-colons
-      - id: rst-inline-touching-normal
   - repo: https://github.com/numpy/numpydoc
     rev: v1.10.0
     hooks:

pyproject.toml

@@ -422,6 +422,7 @@ markers = [
 [tool.repo-review]
 ignore = [
 	"PC111",  # fix Python code in documentation - enable later
+    "PC170",  # use PyGrep hooks - no *.rst files to check
 	"PC180",  # for JavaScript - not interested
 	"PC902",  # pre-commit.ci custom autofix message - not using autofix
 ]