From 4d7a0a29f6eb0dd4309b64c5cbe60316f7fb1968 Mon Sep 17 00:00:00 2001 From: "pre-commit-ci[bot]" <66853113+pre-commit-ci[bot]@users.noreply.github.com> Date: Mon, 7 Sep 2026 19:40:24 +0000 Subject: [PATCH 1/3] chore: update pre-commit hooks MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit updates: - [github.com/astral-sh/ruff-pre-commit: v0.16.0 → v0.16.6](https://github.com/astral-sh/ruff-pre-commit/compare/v0.16.0...v0.16.6) - [github.com/codespell-project/codespell: v2.4.2 → v2.4.3](https://github.com/codespell-project/codespell/compare/v2.4.2...v2.4.3) - [github.com/DavidAnson/markdownlint-cli2: v0.22.1 → v0.23.2](https://github.com/DavidAnson/markdownlint-cli2/compare/v0.22.1...v0.23.2) - [github.com/scientific-python/cookie: 2026.06.18 → 2026.08.14](https://github.com/scientific-python/cookie/compare/2026.06.18...2026.08.14) - [github.com/zizmorcore/zizmor-pre-commit: v1.26.1 → v1.30.0](https://github.com/zizmorcore/zizmor-pre-commit/compare/v1.26.1...v1.30.0) - [github.com/twisted/towncrier: 25.8.0 → 26.9.0](https://github.com/twisted/towncrier/compare/25.8.0...26.9.0) --- .pre-commit-config.yaml | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index 54345c819e..be96f1551f 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -17,13 +17,13 @@ default_language_version: repos: - repo: https://github.com/astral-sh/ruff-pre-commit - rev: v0.16.0 + rev: v0.16.6 hooks: - id: ruff-check args: ["--fix", "--show-fixes"] - id: ruff-format - repo: https://github.com/codespell-project/codespell - rev: v2.4.2 + rev: v2.4.3 hooks: - id: codespell args: ["-L", "fo,ihs,kake,te", "-S", "fixture"] @@ -34,7 +34,7 @@ repos: exclude: mkdocs.yml - id: trailing-whitespace - repo: https://github.com/DavidAnson/markdownlint-cli2 - rev: v0.22.1 + rev: v0.23.2 hooks: # Markdown structure/hygiene. Rule selection and ignores are in # .markdownlint-cli2.jsonc; complements ci/lint_docs.py (RST residue, @@ -72,7 +72,7 @@ repos: files: ^packages/zarr-http-server/ stages: [pre-push] - repo: https://github.com/scientific-python/cookie - rev: 2026.06.18 + rev: 2026.08.14 hooks: - id: sp-repo-review - repo: https://github.com/numpy/numpydoc @@ -89,10 +89,10 @@ repos: types: [python] files: ^(src|tests)/ - repo: https://github.com/zizmorcore/zizmor-pre-commit - rev: v1.26.1 + rev: v1.30.0 hooks: - id: zizmor - repo: https://github.com/twisted/towncrier - rev: 25.8.0 + rev: 26.9.0 hooks: - id: towncrier-check From 38770c9b569fd047fabb3dcc487da4366501a8e6 Mon Sep 17 00:00:00 2001 From: Davis Vann Bennett Date: Thu, 17 Sep 2026 11:12:17 +0200 Subject: [PATCH 2/3] style: reformat a README example for ruff 0.16.6 ruff-format v0.16.6 formats Python code blocks in Markdown, and normalizes this inline comment to PEP 8's two spaces. Fallout from the hook bump in this pull request, not a behavior change. Assisted-by: ClaudeCode:claude-opus-5 Co-Authored-By: Claude Opus 5 --- packages/zarr-http-server/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/zarr-http-server/README.md b/packages/zarr-http-server/README.md index 53df0d2f50..c68f2c9ed2 100644 --- a/packages/zarr-http-server/README.md +++ b/packages/zarr-http-server/README.md @@ -30,7 +30,7 @@ store = zarr.storage.MemoryStore() array = zarr.create_array(store, shape=(100,), chunks=(10,), dtype="float64") with serve_background(node_app(array)) as server: - print(server.url) # e.g. http://127.0.0.1:8000 + print(server.url) # e.g. http://127.0.0.1:8000 ``` Building an app and running it are separate steps, and either app works with From 436e6b5558eaf8ddf5328abb2c3c42506664f060 Mon Sep 17 00:00:00 2001 From: Davis Vann Bennett Date: Thu, 17 Sep 2026 11:12:25 +0200 Subject: [PATCH 3/3] ci: pin just-version in setup-just steps zizmor v1.30.0 adds the `unpinned-tools` audit, which flags all twelve `extractions/setup-just` steps across the three package workflows: pinning the action by SHA still leaves the action free to install whatever just is newest at run time, so a just release can change CI without a commit here. Pinned to 1.58.0, which is what the action resolves to today, so this changes nothing about the current builds while making that choice explicit. Assisted-by: ClaudeCode:claude-opus-5 Co-Authored-By: Claude Opus 5 --- .github/workflows/zarr-http-server.yml | 16 ++++++++++++++++ .github/workflows/zarr-indexing.yml | 16 ++++++++++++++++ .github/workflows/zarr-metadata.yml | 16 ++++++++++++++++ 3 files changed, 48 insertions(+) diff --git a/.github/workflows/zarr-http-server.yml b/.github/workflows/zarr-http-server.yml index a30d990a33..f3530ebc33 100644 --- a/.github/workflows/zarr-http-server.yml +++ b/.github/workflows/zarr-http-server.yml @@ -54,6 +54,10 @@ jobs: run: uv python install ${{ matrix.python-version }} - name: Install just uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 # v4 + with: + # Pin the tool, not just the action: without this the action + # installs whatever just is newest at run time. + just-version: 1.58.0 - name: Sync test dependency groups # The examples group carries the deps the README examples need, so the # test that reads a served array back with a zarr client runs here @@ -77,6 +81,10 @@ jobs: uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1 - name: Install just uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 # v4 + with: + # Pin the tool, not just the action: without this the action + # installs whatever just is newest at run time. + just-version: 1.58.0 - name: Run ruff run: just lint @@ -99,6 +107,10 @@ jobs: run: uv python install 3.12 - name: Install just uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 # v4 + with: + # Pin the tool, not just the action: without this the action + # installs whatever just is newest at run time. + just-version: 1.58.0 - name: Sync test dependency group run: uv sync --group test --python 3.12 - name: Run mypy @@ -121,6 +133,10 @@ jobs: enable-cache: true - name: Install just uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 # v4 + with: + # Pin the tool, not just the action: without this the action + # installs whatever just is newest at run time. + just-version: 1.58.0 - name: Build docs run: just docs-check diff --git a/.github/workflows/zarr-indexing.yml b/.github/workflows/zarr-indexing.yml index 3b106e16aa..c77c9a9741 100644 --- a/.github/workflows/zarr-indexing.yml +++ b/.github/workflows/zarr-indexing.yml @@ -41,6 +41,10 @@ jobs: enable-cache: true - name: Install just uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 # v4 + with: + # Pin the tool, not just the action: without this the action + # installs whatever just is newest at run time. + just-version: 1.58.0 - name: Set up Python ${{ matrix.python-version }} run: uv python install ${{ matrix.python-version }} # The suite imports nothing from `zarr`; it runs against the repo-root @@ -70,6 +74,10 @@ jobs: uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1 - name: Install just uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 # v4 + with: + # Pin the tool, not just the action: without this the action + # installs whatever just is newest at run time. + just-version: 1.58.0 - name: Run ruff # The ruff version pin lives in packages/zarr-indexing/justfile. run: just lint @@ -95,6 +103,10 @@ jobs: run: uv sync --group test --python 3.12 - name: Install just uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 # v4 + with: + # Pin the tool, not just the action: without this the action + # installs whatever just is newest at run time. + just-version: 1.58.0 - name: Run pyright # The pyright invocation lives in packages/zarr-indexing/justfile. run: just typecheck @@ -116,6 +128,10 @@ jobs: enable-cache: true - name: Install just uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 # v4 + with: + # Pin the tool, not just the action: without this the action + # installs whatever just is newest at run time. + just-version: 1.58.0 - name: Build docs # The strict mkdocs build lives in packages/zarr-indexing/justfile. run: just docs-check diff --git a/.github/workflows/zarr-metadata.yml b/.github/workflows/zarr-metadata.yml index 069f6d5060..87065e5913 100644 --- a/.github/workflows/zarr-metadata.yml +++ b/.github/workflows/zarr-metadata.yml @@ -44,6 +44,10 @@ jobs: enable-cache: true - name: Install just uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 # v4 + with: + # Pin the tool, not just the action: without this the action + # installs whatever just is newest at run time. + just-version: 1.58.0 - name: Set up Python ${{ matrix.python-version }} run: uv python install ${{ matrix.python-version }} - name: Sync test dependency group @@ -66,6 +70,10 @@ jobs: uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1 - name: Install just uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 # v4 + with: + # Pin the tool, not just the action: without this the action + # installs whatever just is newest at run time. + just-version: 1.58.0 - name: Run ruff run: just lint @@ -86,6 +94,10 @@ jobs: enable-cache: true - name: Install just uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 # v4 + with: + # Pin the tool, not just the action: without this the action + # installs whatever just is newest at run time. + just-version: 1.58.0 - name: Run pyright # The pyright version and interpreter pins live in the justfile. run: just typecheck @@ -107,6 +119,10 @@ jobs: enable-cache: true - name: Install just uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 # v4 + with: + # Pin the tool, not just the action: without this the action + # installs whatever just is newest at run time. + just-version: 1.58.0 - name: Build docs run: just docs-check