From b51038c7106330f00fc8ae39c2c605dec2fccd9c Mon Sep 17 00:00:00 2001 From: Daniel Haag <121057143+denialhaag@users.noreply.github.com> Date: Thu, 20 Aug 2026 23:53:38 +0200 Subject: [PATCH 1/3] Maintenance round Assisted-by: Opus 5 via Claude Code --- .github/workflows/cd.yml | 14 ++++++++------ .github/workflows/ci.yml | 18 +++++++++++++----- .github/workflows/nextjs.yml | 7 +++---- .github/workflows/release-drafter.yml | 2 +- .github/workflows/templating.yml | 7 +++++-- .pre-commit-config.yaml | 11 ++++++++++- docs/conf.py | 1 - docs/references.md | 8 ++++---- pyproject.toml | 10 ++++------ uv.lock | 20 +------------------- 10 files changed, 49 insertions(+), 49 deletions(-) diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml index 161c6e46..341c77cb 100644 --- a/.github/workflows/cd.yml +++ b/.github/workflows/cd.yml @@ -7,18 +7,20 @@ on: paths: - .github/workflows/cd.yml -permissions: - contents: read - id-token: write +permissions: {} jobs: build-sdist: name: 🐍 Packaging uses: munich-quantum-toolkit/workflows/.github/workflows/reusable-python-packaging-sdist.yml@579203ef22082fa5d5483412f442e50d0c5ff4a7 # v2.2.2 + permissions: + contents: read build-wheel: name: 🐍 Packaging uses: munich-quantum-toolkit/workflows/.github/workflows/reusable-python-packaging-wheel-build.yml@579203ef22082fa5d5483412f442e50d0c5ff4a7 # v2.2.2 + permissions: + contents: read deploy: if: github.event_name == 'release' && github.event.action == 'published' @@ -27,11 +29,11 @@ jobs: environment: name: pypi url: https://pypi.org/p/mqt.problemsolver + needs: [build-sdist, build-wheel] permissions: - id-token: write - attestations: write + attestations: write # Needed to attest the built artifacts contents: read - needs: [build-sdist, build-wheel] + id-token: write # Needed to attest and to publish to PyPI steps: - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 12c3edce..a59a5efa 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -11,15 +11,14 @@ concurrency: group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }} cancel-in-progress: true -permissions: - contents: read - id-token: write - security-events: write +permissions: {} jobs: change-detection: name: 🔍 Change uses: munich-quantum-toolkit/workflows/.github/workflows/reusable-change-detection.yml@579203ef22082fa5d5483412f442e50d0c5ff4a7 # v2.2.2 + permissions: + contents: read python-tests: name: 🐍 Test @@ -32,6 +31,8 @@ jobs: uses: munich-quantum-toolkit/workflows/.github/workflows/reusable-python-tests.yml@579203ef22082fa5d5483412f442e50d0c5ff4a7 # v2.2.2 with: runs-on: ${{ matrix.runs-on }} + permissions: + contents: read python-coverage: name: 🐍 Coverage @@ -50,20 +51,27 @@ jobs: with: enable-ty: true enable-mypy: false + permissions: + contents: read build-sdist: name: 🚀 CD needs: change-detection if: fromJSON(needs.change-detection.outputs.run-cd) uses: munich-quantum-toolkit/workflows/.github/workflows/reusable-python-packaging-sdist.yml@579203ef22082fa5d5483412f442e50d0c5ff4a7 # v2.2.2 + permissions: + contents: read build-wheel: name: 🚀 CD needs: change-detection if: fromJSON(needs.change-detection.outputs.run-cd) uses: munich-quantum-toolkit/workflows/.github/workflows/reusable-python-packaging-wheel-build.yml@579203ef22082fa5d5483412f442e50d0c5ff4a7 # v2.2.2 + permissions: + contents: read - required-checks-pass: # This job does nothing and is only used for branch protection + # This job does nothing and is only used for branch protection + required-checks-pass: name: 🚦 Check if: always() needs: diff --git a/.github/workflows/nextjs.yml b/.github/workflows/nextjs.yml index 4adda129..f8428d83 100644 --- a/.github/workflows/nextjs.yml +++ b/.github/workflows/nextjs.yml @@ -13,10 +13,7 @@ on: workflow_dispatch: # Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages -permissions: - contents: read - pages: write - id-token: write +permissions: {} # Allow only one concurrent deployment, skipping runs queued between the run in-progress and latest queued. # However, do NOT cancel in-progress runs as we want to allow these production deployments to complete. @@ -31,6 +28,8 @@ jobs: steps: - name: Checkout uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Setup Pages id: pages diff --git a/.github/workflows/release-drafter.yml b/.github/workflows/release-drafter.yml index d2b1d8dc..e1b96954 100644 --- a/.github/workflows/release-drafter.yml +++ b/.github/workflows/release-drafter.yml @@ -10,8 +10,8 @@ permissions: {} jobs: update_release_draft: name: Run + runs-on: ubuntu-slim permissions: contents: write - runs-on: ubuntu-slim steps: - uses: release-drafter/release-drafter@34d80673e067bdc0c24568d3af899c216adcfaa9 # v7.7.0 diff --git a/.github/workflows/templating.yml b/.github/workflows/templating.yml index 441234a5..91a2566f 100644 --- a/.github/workflows/templating.yml +++ b/.github/workflows/templating.yml @@ -8,19 +8,22 @@ on: - ".github/workflows/templating.yml" workflow_dispatch: # Allow manual triggering +permissions: {} + jobs: render-template: name: Render template runs-on: ubuntu-slim permissions: - contents: write - pull-requests: write + contents: read steps: - id: create-token uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 with: client-id: ${{ secrets.APP_ID }} private-key: ${{ secrets.APP_PRIVATE_KEY }} + permission-contents: write # Needed to push the templating branch + permission-pull-requests: write # Needed to open the templating pull request - uses: munich-quantum-toolkit/templates@d0c5adb86d19a5095f871cb6184cfdab298e943c # v1.4.2 with: token: ${{ steps.create-token.outputs.token }} diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index de6038d6..1644516b 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -30,14 +30,23 @@ repos: - repo: https://github.com/python-jsonschema/check-jsonschema rev: 0.38.0 hooks: + - id: check-codecov + priority: 0 - id: check-github-workflows priority: 0 - id: check-readthedocs priority: 0 + ## Check for security issues in GitHub Actions workflows + - repo: https://github.com/zizmorcore/zizmor-pre-commit + rev: v1.29.0 + hooks: + - id: zizmor + priority: 0 + ## Check best practices for scientific Python code - repo: https://github.com/scientific-python/cookie - rev: 2026.06.18 + rev: 2026.08.14 hooks: - id: sp-repo-review additional_dependencies: ["repo-review[cli]"] diff --git a/docs/conf.py b/docs/conf.py index 5a58b5fb..7e5bda4c 100644 --- a/docs/conf.py +++ b/docs/conf.py @@ -53,7 +53,6 @@ "sphinx.ext.intersphinx", "sphinx.ext.napoleon", "sphinx.ext.viewcode", - "sphinxcontrib.inkscapeconverter", "sphinxcontrib.bibtex", "sphinxext.opengraph", ] diff --git a/docs/references.md b/docs/references.md index ce9d6a72..103eefcc 100644 --- a/docs/references.md +++ b/docs/references.md @@ -1,8 +1,8 @@ # References -*MQT ProblemSolver* has a strong foundation in peer‑reviewed research. Many of -its built‑in algorithms are based on methods published in scientific journals -and conferences. For an overview of *MQT ProblemSolver* and its features, see +MQT ProblemSolver has a strong foundation in peer‑reviewed research. Many of its +built‑in algorithms are based on methods published in scientific journals and +conferences. For an overview of MQT ProblemSolver and its features, see {cite:p}`quetschlich2023mqtproblemsolver`. If you want to cite this article, please use the following BibTeX entry: @@ -17,7 +17,7 @@ please use the following BibTeX entry: } ``` -*MQT ProblemSolver* is part of the Munich Quantum Toolkit, which is described in +MQT ProblemSolver is part of the Munich Quantum Toolkit, which is described in {cite:p}`mqt`. If you want to cite the Munich Quantum Toolkit, please use the following BibTeX entry: diff --git a/pyproject.toml b/pyproject.toml index 986402f2..7cb475f3 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -51,10 +51,11 @@ dependencies = [ classifiers = [ "Development Status :: 4 - Beta", "Intended Audience :: Developers", + "Intended Audience :: Information Technology", "Intended Audience :: Science/Research", "Natural Language :: English", - "Operating System :: Microsoft :: Windows", "Operating System :: MacOS", + "Operating System :: Microsoft :: Windows", "Operating System :: POSIX :: Linux", "Programming Language :: Python :: 3", "Programming Language :: Python :: 3 :: Only", @@ -63,22 +64,21 @@ classifiers = [ "Programming Language :: Python :: 3.12", "Programming Language :: Python :: 3.13", "Topic :: Scientific/Engineering :: Electronic Design Automation (EDA)", + "Topic :: Scientific/Engineering :: Quantum Computing", "Typing :: Typed", ] [dependency-groups] docs = [ "furo>=2025.09.25", - "graphviz>=0.21.0", "myst-nb>=1.3.0", "sphinx>=8.1.3", "sphinx>=8.2.3; python_version >= '3.11'", "sphinx-autoapi>=3.6.0", "sphinx-copybutton>=0.5.2", "sphinx-design>=0.6.1", - "sphinx-llm", + "sphinx-llm>=0.4.1", "sphinxcontrib-bibtex>=2.6.5", - "sphinxcontrib-svg2pdfconverter>=1.3.0", "sphinxext-opengraph>=0.13.0", ] test = [ @@ -259,8 +259,6 @@ aer = "aer" [tool.repo-review.ignore] GH200 = "We use Renovate instead of Dependabot" -MY100 = "We use ty instead of mypy" -PC111 = "We use ruff instead of blacken-docs" PC160 = "We use a mirror of crate-ci/typos" PC170 = "We do not use rST files anymore" diff --git a/uv.lock b/uv.lock index c5474a10..e3a18adf 100644 --- a/uv.lock +++ b/uv.lock @@ -2030,7 +2030,6 @@ dev = [ ] docs = [ { name = "furo" }, - { name = "graphviz" }, { name = "myst-nb" }, { name = "sphinx", version = "8.1.3", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version < '3.11'" }, { name = "sphinx", version = "9.0.4", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version == '3.11.*'" }, @@ -2041,7 +2040,6 @@ docs = [ { name = "sphinx-design", version = "0.7.0", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version >= '3.11'" }, { name = "sphinx-llm" }, { name = "sphinxcontrib-bibtex" }, - { name = "sphinxcontrib-svg2pdfconverter" }, { name = "sphinxext-opengraph" }, ] test = [ @@ -2090,16 +2088,14 @@ dev = [ ] docs = [ { name = "furo", specifier = ">=2025.9.25" }, - { name = "graphviz", specifier = ">=0.21.0" }, { name = "myst-nb", specifier = ">=1.3.0" }, { name = "sphinx", specifier = ">=8.1.3" }, { name = "sphinx", marker = "python_full_version >= '3.11'", specifier = ">=8.2.3" }, { name = "sphinx-autoapi", specifier = ">=3.6.0" }, { name = "sphinx-copybutton", specifier = ">=0.5.2" }, { name = "sphinx-design", specifier = ">=0.6.1" }, - { name = "sphinx-llm" }, + { name = "sphinx-llm", specifier = ">=0.4.1" }, { name = "sphinxcontrib-bibtex", specifier = ">=2.6.5" }, - { name = "sphinxcontrib-svg2pdfconverter", specifier = ">=1.3.0" }, { name = "sphinxext-opengraph", specifier = ">=0.13.0" }, ] test = [ @@ -4840,20 +4836,6 @@ wheels = [ { url = "https://files.pythonhosted.org/packages/52/a7/d2782e4e3f77c8450f727ba74a8f12756d5ba823d81b941f1b04da9d033a/sphinxcontrib_serializinghtml-2.0.0-py3-none-any.whl", hash = "sha256:6e2cb0eef194e10c27ec0023bfeb25badbbb5868244cf5bc5bdc04e4464bf331", size = 92072, upload-time = "2024-07-29T01:10:08.203Z" }, ] -[[package]] -name = "sphinxcontrib-svg2pdfconverter" -version = "2.1.0" -source = { registry = "https://pypi.org/simple" } -dependencies = [ - { name = "sphinx", version = "8.1.3", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version < '3.11'" }, - { name = "sphinx", version = "9.0.4", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version == '3.11.*'" }, - { name = "sphinx", version = "9.1.0", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version >= '3.12'" }, -] -sdist = { url = "https://files.pythonhosted.org/packages/b9/05/11b12853b6a0398bd19d5464b68cb97dde21c354265ff2c1929f92ae03a9/sphinxcontrib_svg2pdfconverter-2.1.0.tar.gz", hash = "sha256:9756e82d5f3bf11629ffcbafb1f8a1092d3bb4789e33494032cdce9a9c8459d3", size = 6805, upload-time = "2026-03-05T18:23:44.74Z" } -wheels = [ - { url = "https://files.pythonhosted.org/packages/ce/7d/9b6b1ef6fe13bac6455d002ca4a626fac325cf94b4183f31cafe9b1ed17c/sphinxcontrib_svg2pdfconverter-2.1.0-py3-none-any.whl", hash = "sha256:805635ac274583e1606b0ec7fb21f16b69ca8ff223dd7e237d91127015628b0c", size = 9259, upload-time = "2026-03-05T18:23:43.662Z" }, -] - [[package]] name = "sphinxext-opengraph" version = "0.13.0" From 0f729c959eff7f9374b601c84b64f6ae326d6ca3 Mon Sep 17 00:00:00 2001 From: Daniel Haag <121057143+denialhaag@users.noreply.github.com> Date: Fri, 21 Aug 2026 00:36:56 +0200 Subject: [PATCH 2/3] Restore GitHub Pages permissions at the job level Assisted-by: Opus 5 via Claude Code --- .github/workflows/nextjs.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.github/workflows/nextjs.yml b/.github/workflows/nextjs.yml index f8428d83..2b497d76 100644 --- a/.github/workflows/nextjs.yml +++ b/.github/workflows/nextjs.yml @@ -25,6 +25,8 @@ jobs: # Build job build: runs-on: ubuntu-latest + permissions: + contents: read steps: - name: Checkout uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 @@ -68,6 +70,9 @@ jobs: url: ${{ steps.deployment.outputs.page_url }} runs-on: ubuntu-latest needs: build + permissions: + id-token: write # Needed to verify the deployment originates from this workflow + pages: write # Needed to deploy to GitHub Pages steps: - name: Deploy to GitHub Pages id: deployment From cbc2ddf1362f8bb8a4c176e71c02ab565d31b44f Mon Sep 17 00:00:00 2001 From: Daniel Haag <121057143+denialhaag@users.noreply.github.com> Date: Fri, 21 Aug 2026 01:01:38 +0200 Subject: [PATCH 3/3] Streamline `nextjs.yml` --- .github/workflows/nextjs.yml | 13 +++++-------- 1 file changed, 5 insertions(+), 8 deletions(-) diff --git a/.github/workflows/nextjs.yml b/.github/workflows/nextjs.yml index 2b497d76..7b31cb78 100644 --- a/.github/workflows/nextjs.yml +++ b/.github/workflows/nextjs.yml @@ -5,14 +5,11 @@ name: Deploy Next.js site to Pages on: - # Runs on pushes targeting the default branch push: - branches: ["main"] - - # Allows you to run this workflow manually from the Actions tab + branches: + - main workflow_dispatch: -# Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages permissions: {} # Allow only one concurrent deployment, skipping runs queued between the run in-progress and latest queued. @@ -33,13 +30,13 @@ jobs: with: persist-credentials: false - - name: Setup Pages + - name: Set up GitHub Pages id: pages uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0 with: static_site_generator: next - - name: Setup Node + - name: Set up Node uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: "24" @@ -65,10 +62,10 @@ jobs: # Deployment job deploy: + runs-on: ubuntu-latest environment: name: github-pages url: ${{ steps.deployment.outputs.page_url }} - runs-on: ubuntu-latest needs: build permissions: id-token: write # Needed to verify the deployment originates from this workflow