Release/v0.8.20

.devcontainer/README.md

@@ -0,0 +1,8 @@
+# Dev Container
+
+VS Code Dev Container configuration for Rhiza.
+
+- **`devcontainer.json`** — container definition, extensions, and VS Code settings
+- **`bootstrap.sh`** — post-create setup script
+
+Open in VS Code and select **Reopen in Container**, or use [GitHub Codespaces](https://codespaces.new/jebel-quant/rhiza).

.github/workflows/rhiza_ci.yml

@@ -3,9 +3,11 @@
 #
 # Workflow: Continuous Integration
 #
-# Purpose: Run tests on multiple Python versions to ensure compatibility.
+# Purpose: Run tests on multiple Python versions, check dependencies, run
+#          pre-commit hooks, verify documentation coverage, validate the
+#          project, run security scans, and check license compliance.
 #
-# Trigger: On push and pull requests to main/master branches.
+# Trigger: On push and pull_request.
 
 name: (RHIZA) CI
 
@@ -15,9 +17,7 @@ permissions:
 
 on:
   push:
-    branches: [ main, master ]
   pull_request:
-    branches: [ main, master ]
 
 jobs:
   generate-matrix:
@@ -92,6 +92,74 @@ jobs:
           if-no-files-found: ignore
 
 
+  typecheck:
+    name: Type checking
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v6.0.2
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v7.6.0
+        with:
+          version: "0.11.2"
+
+      - name: Configure git auth for private packages
+        uses: ./.github/actions/configure-git-auth
+        with:
+          token: ${{ secrets.GH_PAT }}
+
+      - name: Run ty type checker (make typecheck)
+        # Runs `uv run ty check src/` as defined in .rhiza/make.d/test.mk.
+        # ty is configured via [tool.ty.environment] in pyproject.toml.
+        env:
+          UV_EXTRA_INDEX_URL: ${{ secrets.UV_EXTRA_INDEX_URL }}
+        run: make typecheck
+
+  deptry:
+    name: Check dependencies with deptry
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v6.0.2
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v7.6.0
+        with:
+          version: "0.11.2"
+
+      - name: Configure git auth for private packages
+        uses: ./.github/actions/configure-git-auth
+        with:
+          token: ${{ secrets.GH_PAT }}
+
+      - name: Run deptry
+        run: make deptry
+
+  pre-commit:
+    name: Pre-commit hooks
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v6.0.2
+
+      - name: Configure git auth for private packages
+        uses: ./.github/actions/configure-git-auth
+        with:
+          token: ${{ secrets.GH_PAT }}
+
+      - name: Cache pre-commit environments
+        uses: actions/cache@v5
+        with:
+          path: ~/.cache/pre-commit
+          key: pre-commit-${{ runner.os }}-${{ hashFiles('.pre-commit-config.yaml') }}
+          restore-keys: |
+            pre-commit-${{ runner.os }}-
+
+      - name: Run pre-commit
+        run: |
+          make fmt
+
   docs-coverage:
     runs-on: ubuntu-latest
     steps:
@@ -114,6 +182,87 @@ jobs:
         run: |
           make docs-coverage
 
+  validation:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6.0.2
+        with:
+          lfs: true
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v7.6.0
+        with:
+          version: "0.11.2"
+
+      - name: Configure git auth for private packages
+        uses: ./.github/actions/configure-git-auth
+        with:
+          token: ${{ secrets.GH_PAT }}
+
+      - name: Validate
+        shell: bash
+        run: |
+          make validate
+
+  security:
+    name: Security scanning
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v6.0.2
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v7.6.0
+        with:
+          version: "0.11.2"
+
+      - name: Configure git auth for private packages
+        uses: ./.github/actions/configure-git-auth
+        with:
+          token: ${{ secrets.GH_PAT }}
+
+      - name: Run security scans
+        env:
+          UV_EXTRA_INDEX_URL: ${{ secrets.UV_EXTRA_INDEX_URL }}
+        run: make security
+
+  license:
+    name: License compliance scan
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v6.0.2
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v7.6.0
+        with:
+          version: "0.11.2"
+
+      - name: Configure git auth for private packages
+        uses: ./.github/actions/configure-git-auth
+        with:
+          token: ${{ secrets.GH_PAT }}
+
+      - name: Run license check
+        env:
+          UV_EXTRA_INDEX_URL: ${{ secrets.UV_EXTRA_INDEX_URL }}
+        run: make license
+
+      - name: Generate LICENSES.md
+        env:
+          UV_EXTRA_INDEX_URL: ${{ secrets.UV_EXTRA_INDEX_URL }}
+        run: |
+          uv run --with pip-licenses pip-licenses --format markdown --output-file LICENSES.md
+
+      - name: Upload LICENSES.md
+        uses: actions/upload-artifact@v7
+        with:
+          name: LICENSES.md
+          path: LICENSES.md
+          if-no-files-found: ignore
+
   coverage-badge:
     needs: test
     runs-on: ubuntu-latest