ci: reproduce the release support matrix and required checks

.github/dependabot.yml

@@ -0,0 +1,9 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      github-actions:
+        patterns: ["*"]

.github/workflows/ci.yml

@@ -4,178 +4,15 @@ on:
   push:
     branches: [main]
   pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
 jobs:
-  ruff:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6
-      - uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57
-      - run: uv run --locked --only-group dev ruff check src/ tests/
-      - run: uv run --locked --only-group dev ruff format --check --diff src/ tests/
-
-  spelling:
-    name: Spell Check with Typos
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout Actions Repository
-        uses: actions/checkout@v6
-      - name: Spell Check Repo
-        uses: crate-ci/typos@v1.45.0
-
-  distributions:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6
-      - uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57
-      - run: uv build --sdist
-      - run: uv build dist/*.tar.gz --wheel
-      - run: uv run --locked --only-group dev python tools/check_distribution.py dist/*.whl dist/*.tar.gz
-
-  minimal-install:
-    runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        python-version: ["3.10", "3.14"]
-    steps:
-      - uses: actions/checkout@v6
-      - uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57
-      - run: uv build --wheel
-      - run: uv venv --python "${{ matrix.python-version }}" .minimal
-      - run: uv pip install --python .minimal/bin/python dist/*.whl "beartype==0.23.0rc0"
-      - run: .minimal/bin/python -I tools/smoke_minimal.py
-
-  typecheck:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6
-      - uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57
-        with:
-          enable-cache: true
-      - run: uv run --locked pytest tests/test_typecheck.py -v
-
-  typecheck-compat:
-    runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]
-    steps:
-      - uses: actions/checkout@v6
-      - uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57
-        with:
-          enable-cache: true
-      - run: uv run --locked --python "${{ matrix.python-version }}" pytest tests/test_typecheck.py -v
-
-  # -----------------------------------------------------------------------
-  # Test — always run (locked dev env)
-  # -----------------------------------------------------------------------
-
-  test:
-    needs: [ruff, spelling, typecheck]
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6
-      - uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57
-      - run: uv run --locked tox run -e dev
-
-  # -----------------------------------------------------------------------
-  # PR: fast compat matrix
-  # -----------------------------------------------------------------------
-
-  compat-pr:
-    if: github.event_name == 'pull_request'
-    needs: [test]
-    runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - { python: py310, beartype: bt023rc0, backend: cpu }
-          - { python: py314, beartype: bt023rc0, backend: cpu }
-          - { python: py310, beartype: bt023rc0, backend: numpy22 }
-          - { python: py310, beartype: bt023rc0, backend: jax05 }
-          - { python: py310, beartype: bt023rc0, backend: torch26 }
-          - { python: py310, beartype: bt023rc0, backend: optree014 }
-          - { python: py313, beartype: bt023rc0, backend: numpy24 }
-          - { python: py313, beartype: bt023rc0, backend: jax09 }
-          - { python: py313, beartype: bt023rc0, backend: torch210 }
-          - { python: py313, beartype: bt023rc0, backend: optree019 }
-    name: ${{ matrix.python }}-${{ matrix.beartype }}-${{ matrix.backend }}
-    steps:
-      - uses: actions/checkout@v6
-      - uses: astral-sh/setup-uv@v7
-      - run: uv run --locked tox run -e "${{ matrix.python }}-${{ matrix.beartype }}-${{ matrix.backend }}"
-
-  typecheck-pr:
-    if: github.event_name == 'pull_request'
-    needs: [test]
-    runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - { env: py313-bt023rc0-type-pyright1408 }
-          - { env: py313-bt023rc0-type-mypy119 }
-          - { env: py313-bt023rc0-type-ty }
-          - { env: py313-bt023rc0-type-pyrefly }
-    name: ${{ matrix.env }}
-    steps:
-      - uses: actions/checkout@v6
-      - uses: astral-sh/setup-uv@v7
-      - run: uv run --locked tox run -e "${{ matrix.env }}"
-
-  # -----------------------------------------------------------------------
-  # Push: medium compat matrix
-  # -----------------------------------------------------------------------
-
-  compat-push:
-    if: github.event_name == 'push'
-    needs: [test]
-    runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - { python: py310, beartype: bt023rc0, backend: cpu }
-          - { python: py314, beartype: bt023rc0, backend: cpu }
-          - { python: py310, beartype: bt023rc0, backend: numpy22 }
-          - { python: py310, beartype: bt023rc0, backend: jax05 }
-          - { python: py310, beartype: bt023rc0, backend: torch26 }
-          - { python: py310, beartype: bt023rc0, backend: optree014 }
-          - { python: py312, beartype: bt023rc0, backend: numpy24 }
-          - { python: py312, beartype: bt023rc0, backend: jax09 }
-          - { python: py312, beartype: bt023rc0, backend: torch210 }
-          - { python: py312, beartype: bt023rc0, backend: optree019 }
-          - { python: py313, beartype: bt023rc0, backend: numpy24 }
-          - { python: py313, beartype: bt023rc0, backend: jax09 }
-          - { python: py313, beartype: bt023rc0, backend: torch210 }
-          - { python: py313, beartype: bt023rc0, backend: optree019 }
-    name: ${{ matrix.python }}-${{ matrix.beartype }}-${{ matrix.backend }}
-    steps:
-      - uses: actions/checkout@v6
-      - uses: astral-sh/setup-uv@v7
-      - run: uv run --locked tox run -e "${{ matrix.python }}-${{ matrix.beartype }}-${{ matrix.backend }}"
-
-  typecheck-push:
-    if: github.event_name == 'push'
-    needs: [test]
-    runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - { env: py313-bt023rc0-type-pyright1408 }
-          - { env: py313-bt023rc0-type-mypy119 }
-          - { env: py313-bt023rc0-type-ty }
-          - { env: py313-bt023rc0-type-pyrefly }
-    name: ${{ matrix.env }}
-    steps:
-      - uses: actions/checkout@v6
-      - uses: astral-sh/setup-uv@v7
-      - run: uv run --locked tox run -e "${{ matrix.env }}"
+  validate:
+    uses: ./.github/workflows/validate.yml

.github/workflows/docs.yml

@@ -20,14 +20,12 @@ jobs:
     env:
       FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
     steps:
-      - uses: actions/checkout@v6
-      - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+      - uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v7
         with:
-          python-version: "3.12"
-      - run: uv sync --group docs --no-dev
-      - run: uv run zensical build --clean
-      - uses: actions/upload-pages-artifact@v4
+          version: "0.11.17"
+      - run: uv run --locked --only-group docs zensical build --clean
+      - uses: actions/upload-pages-artifact@7b1f4a764d45c48632c6b24a0339c27f5614fb0b # v4
         with:
           path: site
 
@@ -41,4 +39,4 @@ jobs:
       url: ${{ steps.deployment.outputs.page_url }}
     steps:
       - id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4

.github/workflows/nightly.yml

@@ -5,53 +5,13 @@ on:
     - cron: "0 4 * * *"
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}
   cancel-in-progress: true
 
 jobs:
-  # -----------------------------------------------------------------------
-  # Full tox matrix — oldest + newest of each axis
-  # -----------------------------------------------------------------------
-
-  compat-nightly:
-    runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - { python: py310, beartype: bt023rc0, backend: cpu }
-          - { python: py314, beartype: bt023rc0, backend: cpu }
-          - { python: py310, beartype: bt023rc0, backend: numpy22 }
-          - { python: py310, beartype: bt023rc0, backend: jax05 }
-          - { python: py310, beartype: bt023rc0, backend: torch26 }
-          - { python: py310, beartype: bt023rc0, backend: optree014 }
-          - { python: py313, beartype: bt023rc0, backend: numpy24 }
-          - { python: py313, beartype: bt023rc0, backend: jax09 }
-          - { python: py313, beartype: bt023rc0, backend: torch210 }
-          - { python: py313, beartype: bt023rc0, backend: optree019 }
-    name: ${{ matrix.python }}-${{ matrix.beartype }}-${{ matrix.backend }}
-    steps:
-      - uses: actions/checkout@v6
-      - uses: astral-sh/setup-uv@v7
-      - run: uv run --locked tox run -e "${{ matrix.python }}-${{ matrix.beartype }}-${{ matrix.backend }}"
-
-  # -----------------------------------------------------------------------
-  # All typechecker versions
-  # -----------------------------------------------------------------------
-
-  typecheck-nightly:
-    runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - { env: py313-bt023rc0-type-pyright1408 }
-          - { env: py313-bt023rc0-type-mypy119 }
-          - { env: py313-bt023rc0-type-ty }
-          - { env: py313-bt023rc0-type-pyrefly }
-    name: ${{ matrix.env }}
-    steps:
-      - uses: actions/checkout@v6
-      - uses: astral-sh/setup-uv@v7
-      - run: uv run --locked tox run -e "${{ matrix.env }}"
+  validate:
+    uses: ./.github/workflows/validate.yml