CI: add linting and type checking

.github/dependabot.yaml

@@ -8,3 +8,29 @@ updates:
       ci-dependencies:
         patterns:
           - "*"
+    cooldown:
+      default-days: 7
+
+  - package-ecosystem: uv
+    directories:
+      - /
+      - packages/*
+    schedule:
+      interval: monthly
+    groups:
+      python-dependencies:
+        patterns:
+          - "*"
+    cooldown:
+      default-days: 7
+
+  - package-ecosystem: pre-commit
+    directory: /
+    schedule:
+      interval: monthly
+    groups:
+      pre-commit-dependencies:
+        patterns:
+          - "*"
+    cooldown:
+      default-days: 7

.github/workflows/python-ci.yaml

@@ -0,0 +1,48 @@
+name: Python lint and test
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        with:
+          enable-cache: true
+
+      - name: Setup Python
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version-file: "pyproject.toml"
+
+      - name: Sync dependencies
+        run: uv sync
+
+      - name: Run prek
+        run: uv run prek run --all-files
+
+      - name: Check formatting
+        run: uv run ruff format --check .
+
+      - name: Run Ruff checks
+        run: uv run ruff check --output-format=github .
+
+      - name: Run mypy
+        run: uv run mypy --strict src/ packages/ tests/
+
+      - name: Run ty
+        run: uv run ty check --output-format=github .

.github/workflows/stdlib-introspect.yaml

@@ -41,6 +41,8 @@ jobs:
         python-version: ["3.10", "3.11", "3.12", "3.13", "3.14", "3.15"]
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
@@ -81,6 +83,8 @@ jobs:
     timeout-minutes: 1
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
@@ -113,6 +117,8 @@ jobs:
       TARGET_VERSION: ${{ github.event.inputs.target_version || '3.14' }}
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:

.pre-commit-config.yaml

@@ -0,0 +1,26 @@
+repos:
+  - repo: meta
+    hooks:
+      - id: check-hooks-apply
+      - id: check-useless-excludes
+
+  - repo: builtin
+    hooks:
+      - id: check-merge-conflict
+      - id: check-toml
+      - id: check-yaml
+      - id: trailing-whitespace
+        args: [ --markdown-linebreak-ext=md ]
+      - id: mixed-line-ending
+        args: [ --fix=lf ]
+      - id: end-of-file-fixer
+
+  - repo: https://github.com/astral-sh/uv-pre-commit
+    rev: b17b79c1cab56c3d1025ad36cb117fe602e570fd  # frozen: 0.11.23
+    hooks:
+      - id: uv-lock
+
+  - repo: https://github.com/zizmorcore/zizmor-pre-commit
+    rev: 9257c6050c0261b8c57e712f632dc4a8010109a9  # frozen: v1.25.2
+    hooks:
+      - id: zizmor

noxfile.py

@@ -0,0 +1,42 @@
+"""Noxfile."""
+
+import shutil
+from pathlib import Path
+
+import nox
+
+nox.options.default_venv_backend = "none"
+nox.options.sessions = ["lints"]
+
+
+CLEANABLE_TARGETS = [
+    # Generated bytecode
+    "./**/__pycache__",
+    "./**/*.pyc",
+    "./**/*.pyo",
+    # Centralized tool cache
+    "./.cache",
+]
+
+
+@nox.session
+def lints(session: nox.Session) -> None:
+    """Run lints."""
+    session.run("prek", "run", "--all-files")
+    session.run("ruff", "format", ".")
+    session.run("ruff", "check", "--fix", ".")
+    session.run("mypy", "--strict", "src/", "packages/", "tests/")
+    session.run("ty", "check", ".")
+
+
+@nox.session
+def clean(_: nox.Session) -> None:
+    """Clean cache, .pyc, .pyo, and test/build artifact files from project."""
+    count = 0
+    for searchpath in CLEANABLE_TARGETS:
+        for filepath in Path().glob(searchpath):
+            if filepath.is_dir():
+                shutil.rmtree(filepath)
+            else:
+                filepath.unlink()
+            count += 1

pyproject.toml

@@ -0,0 +1,46 @@
+[project]
+name = "cpython-docs-compendium"
+version = "2026.06.20"
+authors = [
+    { name = "Bradley Reynolds", email = "bradley.reynolds@tailstory.dev" },
+]
+requires-python = ">=3.14"
+
+[dependency-groups]
+dev = [
+    # DX
+    "nox>=2026.4.10",
+    "prek>=0.4.4",
+    # Linters
+    "ruff>=0.15.17",
+    "mypy>=2.1.0",
+    "ty>=0.0.49",
+]
+
+[tool.uv]
+# Sync with Dependabot's uv version
+required-version = ">=0.11.8"
+exclude-newer = "P7D"
+
+[tool.ruff]
+line-length = 120
+cache-dir = ".cache/ruff"
+
+[tool.ruff.lint]
+select = [
+    "ALL",
+]
+
+[tool.ruff.lint.pydocstyle]
+convention = "numpy"
+
+[tool.mypy]
+pretty = true
+num_workers = 4
+native_parser = true # required by num_workers
+plugins = ["pydantic.mypy"]
+cache_dir = ".cache/mypy"
+
+# Still need to tell Mypy to ignore these
+[tool.ty.rules]
+unused-ignore-comment = "ignore"