Add development quality checks

.github/workflows/codeql-analysis.yml

@@ -46,6 +46,8 @@ jobs:
     steps:
     - name: Checkout repository
       uses: actions/checkout@v7
+      with:
+        persist-credentials: false
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL

.github/workflows/continuous-deployment.yaml

@@ -19,6 +19,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v7
+        with:
+          persist-credentials: false
 
       - name: Setup uv
         uses: astral-sh/setup-uv@v10.0.1
@@ -45,6 +47,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v7
+        with:
+          persist-credentials: false
 
       - id: install-uv
         name: Install uv
@@ -68,7 +72,9 @@ jobs:
 
       - name: Verify package distribution
         if: matrix.python == '3.13' && vars.PACKAGE_IMPORT_NAME != ''
-        run: make package-verify PACKAGE=${{ vars.PACKAGE_IMPORT_NAME }}
+        env:
+          PACKAGE_IMPORT_NAME: ${{ vars.PACKAGE_IMPORT_NAME }}
+        run: make package-verify PACKAGE="$PACKAGE_IMPORT_NAME"
 
       - name: Prune uv cache
         run: uv cache prune --ci
@@ -80,6 +86,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v7
+        with:
+          persist-credentials: false
 
       - id: install-uv
         name: Install uv

.github/workflows/docs.yaml

@@ -23,6 +23,8 @@ jobs:
       - id: checkout
         name: Checkout
         uses: actions/checkout@v7
+        with:
+          persist-credentials: false
 
       - id: install-uv
         name: Install uv
@@ -63,6 +65,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v7
+        with:
+          persist-credentials: false
 
       - name: Setup uv
         uses: astral-sh/setup-uv@v10.0.1

.pre-commit-config.yaml

@@ -77,6 +77,13 @@ repos:
 
   - repo: local
     hooks:
+      - id: zizmor
+        name: zizmor
+        entry: uv run zizmor .github/workflows
+        language: system
+        files: ^\.github/workflows/.*\.ya?ml$
+        pass_filenames: false
+
       - id: ty
         name: ty
         entry: uv run ty check

MANIFEST.in

@@ -1,5 +1,22 @@
+include .codespell-ignore-words.txt
+include .editorconfig
+include .gitattributes
+include .gitignore
+include .pre-commit-config.yaml
+include .python-version
+include AGENTS.md
+include CHANGELOG.md
 include LICENSE
 include README.md
 include CODE_OF_CONDUCT.md
 include CONTRIBUTING.md
+include Makefile
+include RELEASING.md
 include SECURITY.md
+include TEMPLATE_SETUP.md
+include uv.lock
+include zizmor.yml
+recursive-include .devcontainer *
+recursive-include .github *
+recursive-include docs *.md *.py Makefile
+recursive-include tests *.py

Makefile

@@ -7,7 +7,7 @@ COVERAGE_FAIL_UNDER ?= 80
 TEST_ARGS ?=
 RUN = $(if $(UV_PYTHON),UV_PYTHON=$(UV_PYTHON)) $(UV) run
 
-.PHONY: all help install install-all install-dev install-test install-test-extras install-docs check verify diff-check lint format-check format fix type-check test test-serial test-parallel coverage build package-check package-verify docs docs-check linkcheck build-docs serve-docs hooks clean
+.PHONY: all help install install-all install-dev install-test install-test-extras install-docs check verify diff-check lint format-check format fix type-check dependency-check workflow-check manifest-check test test-serial test-parallel coverage build package-check package-verify docs docs-check linkcheck build-docs serve-docs hooks clean
 
 help: ## Show available commands
 	@awk 'BEGIN {FS = ":.*## "}; /^[a-zA-Z0-9_-]+:.*## / {printf "%-18s %s\n", $$1, $$2}' $(MAKEFILE_LIST)
@@ -31,9 +31,9 @@ install-docs: ## Install dependencies for documentation
 
 all: verify ## Run the complete verification suite
 
-check: diff-check lint format-check type-check ## Run fast, non-mutating code checks
+check: diff-check lint format-check type-check dependency-check workflow-check ## Run fast, non-mutating code checks
 
-verify: check test build docs-check ## Run all local CI checks
+verify: check test manifest-check build docs-check ## Run all local CI checks
 
 diff-check: ## Check the diff for whitespace errors
 	git diff --check
@@ -54,6 +54,15 @@ fix: ## Apply Ruff lint fixes and formatting
 type-check: ## Check static types with ty
 	$(RUN) ty check
 
+dependency-check: ## Check dependency declarations with Deptry
+	$(RUN) deptry .
+
+workflow-check: ## Audit GitHub Actions workflows with Zizmor
+	$(RUN) zizmor .github/workflows
+
+manifest-check: ## Check source distribution contents
+	$(RUN) check-manifest
+
 test: ## Run tests serially
 	$(RUN) pytest $(TEST_ARGS)
 
@@ -67,12 +76,15 @@ coverage: ## Enforce coverage for PACKAGE
 	$(RUN) pytest $(TEST_ARGS) --cov="$(PACKAGE)" --cov-branch --cov-report=term-missing:skip-covered --cov-fail-under="$(COVERAGE_FAIL_UNDER)"
 
 build: ## Build source and wheel distributions
+	rm -rf dist
 	$(UV) build --sdist --wheel
+	$(RUN) twine check dist/*
 
 package-check: ## Build, install, and import PACKAGE in an isolated environment
 	@test -n "$(PACKAGE)" || { echo "Set PACKAGE to the library import name."; exit 2; }
 	@temp_dir=$$(mktemp -d); trap 'rm -rf "$$temp_dir"' EXIT; \
 	$(UV) build --wheel --out-dir "$$temp_dir/dist"; \
+	$(RUN) check-wheel-contents "$$temp_dir"/dist/*.whl; \
 	$(UV) venv --no-project "$$temp_dir/venv"; \
 	$(UV) pip install --python "$$temp_dir/venv/bin/python" "$$temp_dir"/dist/*.whl; \
 	cd "$$temp_dir" && "$$temp_dir/venv/bin/python" -c 'import importlib; importlib.import_module("$(PACKAGE)")'

pyproject.toml

@@ -32,7 +32,18 @@ Issues = "https://github.com/your-org/your-package-name/issues"
 # your-command = "your_package_name.cli:main"
 
 [dependency-groups]
-dev = ["pre-commit", "ruff", "setuptools-scm", "ty", "vulture"]
+dev = [
+    "check-manifest",
+    "check-wheel-contents",
+    "deptry",
+    "pre-commit",
+    "ruff",
+    "setuptools-scm",
+    "twine",
+    "ty",
+    "vulture",
+    "zizmor",
+]
 test = [
     "pytest",
     "pytest-cov",