🔧 Maintenance round

[denialhaag]

🤖 AI text below 🤖

• Update the scientific-python/cookie pre-commit hook
• Add the zizmor pre-commit hook
• Add the check-codecov pre-commit hook to check-jsonschema
• Streamline Trove classifiers
• Add lower bound for sphinx-llm
• Drop the unused Inkscape documentation dependency
• Drop the unused Graphviz documentation dependency
• Streamline package stylization in documentation

[denialhaag]

@coderabbitai full review

[coderabbitai]

✅ Action performed

Full review finished.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: fdcb43cd-cfd3-43bf-b73c-d7e84a1312d3

📥 Commits

Reviewing files that changed from the base of the PR and between a9332b1 and 0f729c9.

⛔ Files ignored due to path filters (1)

• uv.lock is excluded by !**/*.lock

📒 Files selected for processing (9)

• .github/workflows/cd.yml
• .github/workflows/ci.yml
• .github/workflows/nextjs.yml
• .github/workflows/release-drafter.yml
• .github/workflows/templating.yml
• .pre-commit-config.yaml
• docs/conf.py
• docs/references.md
• pyproject.toml

💤 Files with no reviewable changes (1)

• docs/conf.py

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Summary by CodeRabbit

• Security

  • Strengthened automation security by restricting workflow permissions by default and granting only required access.
  • Prevented build checkouts from persisting credentials.
  • Added automated security scanning to development checks.

• Documentation

  • Updated documentation tooling and package metadata.
  • Refined package classification information and documentation references.
  • Removed obsolete documentation configuration and review exceptions.

• Chores

  • Added code coverage validation to pre-commit checks.
  • Updated the scientific Python tooling configuration.

Walkthrough

The pull request restricts GitHub Actions permissions at workflow and job scope. It adds pre-commit checks, updates documentation configuration and references, and revises package classifiers, documentation dependencies, and repository-review settings.

Changes

Workflow Permission Scoping

Layer / File(s)	Summary
CI and CD permission scopes .github/workflows/ci.yml, .github/workflows/cd.yml	Workflows now default to no permissions. Jobs declare explicit read, attestation, contents, and OIDC permissions.
Deployment and automation permissions .github/workflows/nextjs.yml, .github/workflows/templating.yml, .github/workflows/release-drafter.yml	Build and deployment jobs use explicit permissions. Checkout no longer persists credentials. The templating workflow scopes generated App token permissions. Release Drafter settings are reordered without value changes.

Project Configuration and Validation

Layer / File(s)	Summary
Pre-commit validation hooks .pre-commit-config.yaml	The configuration adds check-codecov and zizmor hooks and updates the scientific-Python cookie revision.
Documentation and package metadata docs/conf.py, docs/references.md, pyproject.toml	The Sphinx extension and reference emphasis are updated. Package classifiers and documentation dependencies are revised. Obsolete repository-review ignores are removed.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: ⚪ Minimal · up to 0f729

This maintenance PR introduces no supported merge-blocking correctness, security, availability, or deployment risk at its current head and is merge-ready after normal checks and review.

Poem

A rabbit checks each token tight,
Grants read access, keeps scopes light.
New hooks hop through every file,
Docs and classifiers align in style.
“Zizmor guards the workflows bright!”

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (1 warning, 1 inconclusive)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description lists changes but omits the required motivation, dependency details, issue line handling, and checklist responses.	Add motivation and context, list dependencies or state that none are required, remove or complete the issue line, and complete the checklist.
Title check	❓ Inconclusive	The title identifies a maintenance change but is too broad to show the primary updates in the pull request.	Use a specific title such as "Tighten CI permissions and update maintenance tooling."

✅ Passed checks (3 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (8 skipped: 8 unsupported.)
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch maintenance-round

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!