chore: Update via rhiza

Author: github-actions[bot]

.github/workflows/rhiza_benchmarks.yml

@@ -0,0 +1,83 @@
+# This file is part of the jebel-quant/rhiza repository
+# (https://github.com/jebel-quant/rhiza).
+#
+# Workflow: Performance Benchmarks
+#
+# Purpose: Run performance benchmarks and detect regressions.
+#
+# Trigger: On push to main/master branches, PRs, and manual trigger.
+#
+# Regression Detection:
+#   - Compares against previous benchmark results stored in gh-pages branch
+#   - Alerts if performance degrades by more than 150% (configurable)
+#   - PRs will show a warning comment but not fail
+#   - Main branch updates the baseline for future comparisons
+
+name: (RHIZA) Benchmarks
+
+permissions:
+  contents: write
+  pull-requests: write
+
+on:
+  push:
+    branches: [ main, master ]
+  pull_request:
+    branches: [ main, master ]
+  workflow_dispatch:
+
+jobs:
+  benchmark:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+        with:
+          lfs: true
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v7
+        with:
+          version: "0.9.26"
+          python-version: "3.12"
+
+      - name: Run benchmarks
+        env:
+          UV_EXTRA_INDEX_URL: ${{ secrets.uv-extra-index-url }}
+        run: |
+          make benchmark
+
+      - name: Upload benchmark results
+        uses: actions/upload-artifact@v6
+        if: always()
+        with:
+          name: benchmark-results
+          path: |
+            _benchmarks/benchmarks.json
+            _benchmarks/benchmarks.svg
+            _benchmarks/benchmarks.html
+
+      # Regression detection using github-action-benchmark
+      # Stores benchmark history in gh-pages branch under /benchmarks
+      # Alerts if performance degrades by more than 150% of baseline
+      - name: Store benchmark result and check for regression
+        uses: benchmark-action/github-action-benchmark@v1
+        # run this only if _benchmarks/benchmarks.json exists
+        if: hashFiles('_benchmarks/benchmarks.json') != ''
+        with:
+          tool: 'pytest'
+          output-file-path: _benchmarks/benchmarks.json
+          # Store benchmark data in gh-pages branch
+          gh-pages-branch: gh-pages
+          benchmark-data-dir-path: benchmarks
+          # Only update baseline on main branch push (not PRs)
+          auto-push: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
+          # Alert if performance degrades by more than 150%
+          alert-threshold: '150%'
+          # Post comment on PR if regression detected
+          comment-on-alert: ${{ github.event_name == 'pull_request' }}
+          # Fail workflow if regression detected (disabled for PRs to allow investigation)
+          fail-on-alert: ${{ github.event_name == 'push' }}
+          # GitHub token for pushing to gh-pages and commenting
+          github-token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/rhiza_book.yml

@@ -14,7 +14,7 @@
 #   - 🧪 Run tests and generate coverage reports
 #   - 🚀 Deploy combined documentation to GitHub Pages
 
-name: "BOOK"
+name: "(RHIZA) BOOK"
 
 on:
   push:
@@ -43,18 +43,21 @@ jobs:
       - name: Install uv
         uses: astral-sh/setup-uv@v7
         with:
-          version: "0.9.24"
+          version: "0.9.26"
 
       - name: "Sync the virtual environment for ${{ github.repository }}"
         shell: bash
+        env:
+          UV_EXTRA_INDEX_URL: ${{ secrets.uv-extra-index-url }}
         run: |
-          export UV_EXTRA_INDEX_URL="${{ secrets.uv-extra-index-url }}"
           # will just use .python-version?
           uv sync --all-extras --all-groups --frozen
 
       - name: "Make the book"
+        env:
+          UV_EXTRA_INDEX_URL: ${{ secrets.uv-extra-index-url }}
         run: |
-          make book
+          make -f .rhiza/rhiza.mk book
 
       # Step 5: Package all artifacts for GitHub Pages deployment
       # This prepares the combined outputs for deployment by creating a single artifact
@@ -66,7 +69,7 @@ jobs:
       # Step 6: Deploy the packaged artifacts to GitHub Pages
       # This step publishes the content to GitHub Pages
       # The deployment is conditional based on whether the repository is a fork and the PUBLISH_COMPANION_BOOK variable is set
-      # If the repository is a fork, deployment is skipped to avoid unauthorized publishing
+      # If the repository is a fork, deployment is skipped to avoid unauthorised publishing
       # If PUBLISH_COMPANION_BOOK is not set, it defaults to allowing deployment
       - name: Deploy to GitHub Pages
         if: ${{ !github.event.repository.fork && (vars.PUBLISH_COMPANION_BOOK == 'true' || vars.PUBLISH_COMPANION_BOOK == '') }}

.github/workflows/rhiza_ci.yml

@@ -7,7 +7,7 @@
 #
 # Trigger: On push and pull requests to main/master branches.
 
-name: CI
+name: (RHIZA) CI
 
 permissions:
   contents: read
@@ -29,12 +29,14 @@ jobs:
       - name: Install uv
         uses: astral-sh/setup-uv@v7
         with:
-          version: "0.9.24"
+          version: "0.9.26"
 
       - id: versions
+        env:
+          UV_EXTRA_INDEX_URL: ${{ secrets.uv-extra-index-url }}
         run: |
           # Generate Python versions JSON from the script
-          JSON=$(make -s version-matrix)
+          JSON=$(make -f .rhiza/rhiza.mk -s version-matrix)
           echo "list=$JSON" >> "$GITHUB_OUTPUT"
 
       - name: Debug matrix
@@ -58,9 +60,11 @@ jobs:
       - name: Install uv
         uses: astral-sh/setup-uv@v7
         with:
-          version: "0.9.24"
+          version: "0.9.26"
           python-version: ${{ matrix.python-version }}
 
       - name: Run tests
+        env:
+          UV_EXTRA_INDEX_URL: ${{ secrets.uv-extra-index-url }}
         run: |
-          make test
+          make -f .rhiza/rhiza.mk test

.github/workflows/rhiza_codeql.yml

@@ -9,7 +9,22 @@
 # the `language` matrix defined below to confirm you have the correct set of
 # supported CodeQL languages.
 #
-name: "CodeQL Advanced"
+# ******** IMPORTANT: GitHub Advanced Security Required ********
+# CodeQL is FREE for public repositories, but requires GitHub Advanced Security
+# (part of GitHub Enterprise) for private repositories.
+#
+# This workflow automatically:
+# - Runs on public repositories
+# - Skips on private repositories (unless Advanced Security is available)
+#
+# To control this behavior, set the CODEQL_ENABLED repository variable:
+# - Set to 'true' to force enable (if you have Advanced Security on private repos)
+# - Set to 'false' to disable entirely
+# - Leave unset for automatic behavior (recommended)
+#
+# For more information, see docs/CUSTOMIZATION.md
+#
+name: "(RHIZA) CODEQL"
 
 on:
   push:
@@ -28,7 +43,15 @@ jobs:
     #   - https://gh.io/using-larger-runners (GitHub.com only)
     # Consider using larger runners or machines with greater resources for possible analysis time improvements.
     runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}
-    if: ${{ !github.event.repository.private }}
+    # CodeQL requires GitHub Advanced Security (part of GitHub Enterprise).
+    # For users without Enterprise license:
+    # - Public repositories: CodeQL is available for free
+    # - Private repositories: Requires GitHub Advanced Security
+    # To disable this workflow, set CODEQL_ENABLED repository variable to 'false'
+    # To enable this workflow for private repos with Advanced Security, set CODEQL_ENABLED to 'true'
+    if: |
+      vars.CODEQL_ENABLED == 'true' ||
+      (vars.CODEQL_ENABLED != 'false' && github.event.repository.visibility == 'public')
     permissions:
       # required for all workflows
       security-events: write

.github/workflows/rhiza_deptry.yml

@@ -10,7 +10,7 @@
 # Trigger: This workflow runs on every push and on pull requests to main/master
 #          branches (including from forks)
 
-name: "DEPTRY"
+name: "(RHIZA) DEPTRY"
 
 # Permissions: Only read access to repository contents is needed
 permissions:
@@ -27,14 +27,14 @@ jobs:
     name: Check dependencies with deptry
     runs-on: ubuntu-latest
     container:
-      image: ghcr.io/astral-sh/uv:0.9.24-python3.12-trixie
+      image: ghcr.io/astral-sh/uv:0.9.26-python3.12-trixie
 
     steps:
       - uses: actions/checkout@v6
 
       - name: Run deptry
-        run: make deptry
+        run: make -f .rhiza/rhiza.mk deptry
         # NOTE: make deptry is good style because it encapsulates the folders to check
         # (e.g. src and book/marimo) and keeps CI in sync with local development.
-        # Since we use a 'uv' container, the Makefile is optimized to use the
+        # Since we use a 'uv' container, the Makefile is optimised to use the
         # pre-installed 'uv' and 'uvx' from the system PATH.

.github/workflows/rhiza_devcontainer.yml

@@ -32,7 +32,7 @@
 #   or this workflow file itself is changed (in which case it skips gracefully).
 
 
-name: DEVCONTAINER
+name: (RHIZA) DEVCONTAINER
 
 on:
   push:
@@ -67,7 +67,7 @@ jobs:
           if [ -z "$REGISTRY" ]; then
             REGISTRY="ghcr.io"
           fi
-          echo "registry=$REGISTRY" >> $GITHUB_OUTPUT
+          echo "registry=$REGISTRY" >> "$GITHUB_OUTPUT"
 
       - name: Login to Container Registry
         uses: docker/login-action@v3
@@ -81,15 +81,15 @@ jobs:
         id: check
         run: |
           if [ ! -f ".devcontainer/devcontainer.json" ]; then
-            echo "exists=false" >> $GITHUB_OUTPUT
+            echo "exists=false" >> "$GITHUB_OUTPUT"
             echo "::warning::No .devcontainer/devcontainer.json found, skipping build"
           else
-            echo "exists=true" >> $GITHUB_OUTPUT
+            echo "exists=true" >> "$GITHUB_OUTPUT"
           fi
       # repository owner to lowercase for Docker image naming, as devcontainers/ci does not safeguard
       - name: Get lowercase repository owner
         id: repo_owner
-        run: echo "owner_lc=$(echo '${{ github.repository_owner }}' | tr '[:upper:]' '[:lower:]')" >> $GITHUB_OUTPUT
+        run: echo "owner_lc=$(echo '${{ github.repository_owner }}' | tr '[:upper:]' '[:lower:]')" >> "$GITHUB_OUTPUT"
 
       - name: Get Image Name
         if: steps.check.outputs.exists == 'true'
@@ -118,14 +118,14 @@ jobs:
 
           IMAGE_NAME="${{ steps.registry.outputs.registry }}/${{ steps.repo_owner.outputs.owner_lc }}/$IMAGE_NAME"
           echo "✅ Final image name: $IMAGE_NAME"
-          echo "image_name=$IMAGE_NAME" >> $GITHUB_OUTPUT
+          echo "image_name=$IMAGE_NAME" >> "$GITHUB_OUTPUT"
 
       - name: Sanitize Image Tag
         if: steps.check.outputs.exists == 'true'
         id: sanitized_tag
         run: |
           SANITIZED_TAG=$(echo "${{ github.ref_name }}-${{ github.sha }}" | tr '/' '-')
-          echo "sanitized_tag=$SANITIZED_TAG" >> $GITHUB_OUTPUT
+          echo "sanitized_tag=$SANITIZED_TAG" >> "$GITHUB_OUTPUT"
 
       - name: Build Devcontainer Image
         uses: devcontainers/ci@v0.3

.github/workflows/rhiza_docker.yml

@@ -7,7 +7,7 @@
 # Notes:
 #  - The image is built locally for validation only; it is not pushed to any registry.
 #  - Permissions are minimized (read-only) since no repository writes occur.
-name: DOCKER
+name: (RHIZA) DOCKER
 
 permissions:
   contents: read
@@ -56,11 +56,11 @@ jobs:
         id: python_version
         run: |
           if [ -f .python-version ]; then
-            PYTHON_VERSION=$(cat .python-version | tr -d '[:space:]')
-            echo "version=$PYTHON_VERSION" >> $GITHUB_OUTPUT
+            PYTHON_VERSION=$(tr -d '[:space:]' < .python-version)
+            echo "version=$PYTHON_VERSION" >> "$GITHUB_OUTPUT"
             echo "Using Python version: $PYTHON_VERSION"
           else
-            echo "version=3.12" >> $GITHUB_OUTPUT
+            echo "version=3.12" >> "$GITHUB_OUTPUT"
             echo "::warning::.python-version not found, using default 3.12"
           fi
 

.github/workflows/rhiza_marimo.yml

@@ -15,7 +15,7 @@
 #   - 🧪 Run each notebook in parallel using a matrix strategy
 #   - ✅ Fail-fast disabled to report all failing notebooks
 
-name: "MARIMO"
+name: "(RHIZA) MARIMO"
 
 permissions:
   contents: read
@@ -40,7 +40,10 @@ jobs:
       - name: Find notebooks and build matrix
         id: notebooks
         run: |
-          NOTEBOOK_DIR="book/marimo"
+          # Extract MARIMO_FOLDER from the project configuration (via Makefile)
+          # shellcheck disable=SC2016 # Single quotes intentional - Make syntax, not shell expansion
+          NOTEBOOK_DIR=$(make -s -f Makefile -f - <<< 'print: ; @echo $(or $(MARIMO_FOLDER),marimo)' print)
+
           echo "Searching notebooks in: $NOTEBOOK_DIR"
           # Check if directory exists
           if [ ! -d "$NOTEBOOK_DIR" ]; then
@@ -80,7 +83,7 @@ jobs:
       - name: Install uv
         uses: astral-sh/setup-uv@v7
         with:
-          version: "0.9.24"
+          version: "0.9.26"
 
       # Execute the notebook with the appropriate runner based on its content
       - name: Run notebook

.github/workflows/rhiza_mypy.yml

@@ -0,0 +1,33 @@
+# This file is part of the jebel-quant/rhiza repository
+# (https://github.com/jebel-quant/rhiza).
+#
+# Workflow: Mypy
+#
+# Purpose: Run static type checking with mypy in strict mode to ensure
+#          type safety across the codebase.
+#
+# Trigger: On push and pull requests to main/master branches.
+
+name: "(RHIZA) MYPY"
+
+permissions:
+  contents: read
+
+on:
+  push:
+    branches: [ main, master ]
+  pull_request:
+    branches: [ main, master ]
+
+jobs:
+  mypy:
+    name: Static type checking with mypy
+    runs-on: ubuntu-latest
+    container:
+      image: ghcr.io/astral-sh/uv:0.9.26-python3.12-trixie
+
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Run mypy
+        run: make -f .rhiza/rhiza.mk mypy

.github/workflows/rhiza_pre-commit.yml

@@ -14,7 +14,7 @@
 # Components:
 #   - 🔍 Run pre-commit checks using reusable action
 
-name: "PRE-COMMIT"
+name: "(RHIZA) PRE-COMMIT"
 permissions:
   contents: read
 
@@ -34,4 +34,4 @@ jobs:
       # Run pre-commit
       - name: Run pre-commit
         run: |
-          make fmt
+          make -f .rhiza/rhiza.mk fmt