Various upgrades

.github/matrix.py

@@ -1,3 +1,4 @@
+# noqa:INP001
 import fileinput
 import json
 import re
@@ -9,21 +10,22 @@
 def main():
     actions_matrix = []
 
-    for tox_env in fileinput.input():
-        tox_env = tox_env.rstrip()
-
-        if python_match := PY_VERSIONS_RE.match(tox_env):
-            version_tuple = python_match.groups()
-        else:
-            version_tuple = sys.version_info[0:2]
-
-        python_version = "{}.{}".format(*version_tuple)
-        actions_matrix.append(
-            {
-                "python": python_version,
-                "tox_env": tox_env,
-            }
-        )
+    with fileinput.input() as f:
+        for tox_env_line in f:
+            tox_env = tox_env_line.rstrip()
+
+            if python_match := PY_VERSIONS_RE.match(tox_env):
+                version_tuple = python_match.groups()
+            else:
+                version_tuple = sys.version_info[0:2]
+
+            python_version = "{}.{}".format(*version_tuple)
+            actions_matrix.append(
+                {
+                    "python": python_version,
+                    "tox_env": tox_env,
+                }
+            )
 
     print(json.dumps(actions_matrix))  # noqa:T201
 

.github/workflows/ci.yml

@@ -3,20 +3,21 @@ on: pull_request
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
+permissions: {}
 jobs:
   matrix:
     name: Build test matrix
     runs-on: ubuntu-24.04
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           persist-credentials: false
           ref: ${{ github.event.pull_request.head.sha }}
       - name: Setup Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
-          python-version: "3.13"
+          python-version: "3.14"
           cache: "pip"
           cache-dependency-path: "requirements/*.txt"
       - name: Run tox
@@ -37,12 +38,12 @@ jobs:
       fail-fast: false
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           persist-credentials: false
           ref: ${{ github.event.pull_request.head.sha }}
       - name: Setup Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: ${{ matrix.python }}
           cache: "pip"
@@ -66,17 +67,18 @@ jobs:
     if: always()
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           persist-credentials: false
           ref: ${{ github.event.pull_request.head.sha }}
       - name: Setup Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
-          python-version: "3.13"
+          python-version: "3.14"
           cache: "pip"
           cache-dependency-path: "requirements/*.txt"
-      - uses: actions/download-artifact@v4
+      - name: Download coverage data
+        uses: actions/download-artifact@v5
         with:
           pattern: coverage-data-*
           merge-multiple: true

.github/workflows/publish.yml

@@ -5,6 +5,8 @@ on:
     tags:
       - "*"
 
+permissions: {}
+
 jobs:
   build:
     name: Build packages
@@ -13,13 +15,13 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           persist-credentials: false
       - name: Setup Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
-          python-version: "3.13"
+          python-version: "3.14"
       - name: Build packages
         run: |
           pip install -r requirements/testing.txt
@@ -44,7 +46,7 @@ jobs:
 
     steps:
       - name: Download packages
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v5
         with:
           name: python-package-distributions
           path: dist/
@@ -61,20 +63,13 @@ jobs:
       url: ${{ github.server_url }}/${{ github.repository }}/releases/tag/${{ github.ref_name }}
     permissions:
       contents: write
-      id-token: write
 
     steps:
       - name: Download packages
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v5
         with:
           name: python-package-distributions
           path: dist/
-      - name: Sign packages
-        uses: sigstore/gh-action-sigstore-python@v3.0.0
-        with:
-          inputs: >-
-            ./dist/*.tar.gz
-            ./dist/*.whl
       - name: Create GitHub Release
         env:
           GH_TOKEN: ${{ github.token }}
@@ -83,7 +78,7 @@ jobs:
           "$GITHUB_REF_NAME"
           --repo "$GITHUB_REPOSITORY"
           --title "${GITHUB_REPOSITORY#*/} $GITHUB_REF_NAME"
-      - name: Upload artifact signatures to GitHub Release
+      - name: Upload packages to GitHub Release
         env:
           GH_TOKEN: ${{ github.token }}
         run: >-