ReactiveX / RxPY / 29772002410

94%

push

github

ci: upgrade ShipIt to 3.0.1, tag releases, and clear Dependabot alerts (#798)

* ci: upgrade ShipIt to 3.0.1, tag releases and harden PyPI publish

Upgrade EasyBuild.ShipIt from 2.0.2 to 3.0.1.

ShipIt does not create git tags, so releases published through this
workflow were left untagged (the most recent tag is v5.0.0a2; 5.0.0rc1
was never tagged). The release job now reads the version from
pyproject.toml, creates an annotated v<version> tag, pushes it and cuts
a GitHub release. PEP 440 pre-releases are marked as such, and tag
creation is skipped when the tag already exists so re-runs are safe.

The publish step previously ended in `|| echo 'Version exists'`, which
reported success on any failure, including an expired token, a network
error or rejected metadata. It now only treats a genuine "already
exists" response as success and fails loudly otherwise.

* build(deps): upgrade locked dev dependencies to clear Dependabot alerts

Run `uv lock --upgrade` to resolve all 10 open Dependabot alerts. Every
alert was in uv.lock and reached the tree through test/CI tooling only
(coveralls -> urllib3/requests/idna, pre-commit -> virtualenv/filelock).
The sole runtime dependency of reactivex is typing-extensions, so no
published wheel was affected.

Each package now sits at or above its patched version:

  urllib3    2.5.0    -> 2.7.0   (>= 2.7.0)
  requests   2.32.5   -> 2.34.2  (>= 2.33.0)
  idna       3.11     -> 3.18    (>= 3.15)
  Pygments   2.19.2   -> 2.20.0  (>= 2.20.0)
  virtualenv 20.35.4  -> 21.6.1  (>= 20.36.1)
  filelock   3.20.0   -> 3.31.1  (>= 3.20.3)

The upgrade also bumps ruff to 0.15.22, whose formatter reformats the
return type of switch_latest(); that change is included here to keep
`ruff format --check` green.

* ci: align pre-commit hook versions with the lockfile

The ruff-pre-commit hook was pinned at v0.8.0 while the test group
resolved ruff 0.15.22, so the formatter CI enforces and the formatter
`uv run ruff format` applies were dif... (continued)

1 of 1 new or added line in 1 file covered. (100.0%)

25388 of 27146 relevant lines covered (93.52%)

0.94 hits per line