The project uses uv. Everything else comes from the lockfile.
uv syncCI runs these three commands on Python 3.10 and 3.14 across Linux, macOS and Windows. Run them before pushing and the pull request will not tell you anything you did not already know.
uv run ruff check .
uv run ruff format --check .
uv run pytestuv run ruff format . rewrites the files rather than reporting on them.
Commit messages follow Conventional Commits. The default
branch is protected: code / all-checks must pass, and merges go through a merge queue that
rebuilds each pull request against the real base before landing it. Use gh pr merge --auto and
let the queue take it from there.
Adding a dependency also means committing the updated uv.lock, because CI installs with
uv sync --locked and will fail on a stale one.
A release is a pull request that raises version in pyproject.toml. When it merges,
release.yml compares that version against PyPI, and publishes if it is new. Nothing else
publishes, so a merge that leaves the version alone ships nothing.
Publishing uses trusted publishing — GitHub's OIDC token, no stored PyPI credentials.