polars-yahoo 0.2.0__tar.gz

polars_yahoo-0.2.0/.bandit

@@ -0,0 +1,19 @@
+# Bandit configuration. This file — not the pre-commit hook's args — is the
+# single source of truth for bandit's scope, because it is the only part any
+# other runner can see. CodeFactor, IDE plugins and a contributor typing
+# `bandit -r .` all read `.bandit` and none of them read our hook args, so
+# scope kept in the args made every external analyser disagree with CI (#1493).
+#
+# Both spellings of each path are listed deliberately. Bandit matches an
+# exclude entry against the path string it is handed, and that string depends on
+# how it was invoked: a recursive `bandit -r .` discovers `./tests/foo.py`,
+# whereas pre-commit passes `tests/foo.py`. So `./tests` alone silently covers
+# only the recursive case and `tests` alone only the pre-commit case — a
+# one-spelling list looks correct and half-works. Verified in
+# tests/security/test_security_patterns.py, which runs bandit both ways.
+#
+# Note these are *added* to bandit's own defaults (.git, __pycache__, .tox,
+# .eggs, …), so those need no repeating here.
+[bandit]
+exclude = tests,./tests,.venv,./.venv
+skips = B101

polars_yahoo-0.2.0/.editorconfig

@@ -0,0 +1,41 @@
+# This file is part of the jebel-quant/rhiza repository
+# (https://github.com/jebel-quant/rhiza).
+#
+root = true
+
+# Default settings for all files
+[*]
+end_of_line = lf
+trim_trailing_whitespace = true
+insert_final_newline = true
+charset = utf-8
+
+# Python, reStructuredText, and text files
+[*.{py,rst,txt}]
+indent_style = space
+indent_size = 4
+
+# YAML, JSON, and other config files
+[*.{yml,yaml,json}]
+indent_style = space
+indent_size = 2
+
+# Markdown files
+# [*.{md,markdown}]
+# trim_trailing_whitespace = false
+
+# Makefiles require tabs
+[{Makefile,*.mk,*.make}]
+indent_style = tab
+indent_size = 4
+
+# Don't apply editorconfig rules to vendor/ resources
+# This is a "defensive" rule for the day we may have
+# the vendor folder
+[vendor/**]
+charset = unset
+end_of_line = unset
+indent_size = unset
+indent_style = unset
+insert_final_newline = unset
+trim_trailing_whitespace = unset

polars_yahoo-0.2.0/.github/CONFIG.md

@@ -0,0 +1,187 @@
+# GitHub Actions Configuration
+
+This document describes the secrets used by the Rhiza-provided GitHub Actions workflows
+(`.github/workflows/rhiza_*.yml`) and how to configure them.
+
+## PAT_TOKEN
+
+Some workflows may need to push changes to files under `.github/workflows/`. The
+automatic `github.token` **cannot** do that — GitHub rejects such pushes unless
+the token carries the `workflow` scope. If you need it, create a Personal Access
+Token (PAT) with the `workflow` scope and store it as a repository secret named
+`PAT_TOKEN`.
+
+If `PAT_TOKEN` is not configured, workflows fall back to `github.token`.
+
+### Creating the token
+
+**Fine-grained PAT** (recommended):
+
+1. Go to **Settings → Developer settings → Fine-grained tokens → Generate new token**
+   (<https://github.com/settings/personal-access-tokens/new>).
+2. Restrict **Repository access** to the repository (or repositories) using Rhiza.
+3. Under **Repository permissions**, grant:
+   - **Contents**: Read and write
+   - **Workflows**: Read and write
+   - **Pull requests**: Read and write (needed for the scheduled sync-PR mode)
+4. Generate the token and copy it.
+
+**Classic PAT** (alternative):
+
+1. Go to **Settings → Developer settings → Tokens (classic) → Generate new token**.
+2. Select the `repo` and `workflow` scopes.
+3. Generate the token and copy it.
+
+### Storing the secret
+
+In the repository that consumes Rhiza:
+
+1. Go to **Settings → Secrets and variables → Actions → New repository secret**.
+2. Name: `PAT_TOKEN`
+3. Value: the token created above.
+
+Or with the GitHub CLI:
+
+```bash
+gh secret set PAT_TOKEN
+```
+
+A PAT expires; when sync pushes start failing with a `refusing to allow ... workflow` error,
+regenerate the token and update the secret.
+
+## Daily template sync (`rhiza_sync.yml`)
+
+Every day at 06:00 UTC the sync workflow compares `ref` in `.rhiza/template.yml` with
+the template repository's latest release. When the ref is behind, the workflow bumps it,
+syncs the template files with the rhiza-claude scripts that `/rhiza:update` also uses,
+and opens a pull request from `rhiza/sync-<tag>`. The PR stages only paths listed in
+`.rhiza/template.lock`. Merge conflicts resolve to the upstream side. A major bump (for
+example `v1.x` → `v2.0.0`) is never applied automatically; the run warns and you run
+`/rhiza:update` yourself. When the branch for that release already exists, later runs
+skip it, so you get one PR per release.
+
+The workflow reads the `GH_PAT` secret. Give the token the permissions listed above
+(Contents, Workflows and Pull requests: read and write, or classic `repo` + `workflow`).
+Without `GH_PAT` the workflow falls back to `github.token`, which has two limits:
+
+- it cannot push a sync that changes `.github/workflows/*`, and
+- GitHub does not start CI on a pull request opened with it.
+
+To run a check right away: `gh workflow run rhiza_sync.yml`.
+
+## Release workflow secrets (optional)
+
+The release workflow (`.github/workflows/rhiza_release.yml`) supports additional secrets, all
+optional depending on which release features you use:
+
+| Secret | Purpose |
+| --- | --- |
+| `PYPI_TOKEN` | Publish the built package to PyPI. Not needed when using trusted publishing (OIDC). |
+| `RELEASE_PUBLISH_CREDENTIALS` | Optional credentials input for a repository-owned custom publisher. Not needed when the extension uses OIDC. |
+| `GH_PAT` | Git authentication for installing private dependencies during the release build. |
+| `UV_EXTRA_INDEX_URL` | Extra package index URL (with credentials) for private dependencies. |
+
+`GITHUB_TOKEN` is provided automatically by GitHub Actions and needs no configuration.
+
+## Release publisher selection
+
+Set the Actions **variable** `RELEASE_PUBLISHER` to choose package deployment:
+
+| Value | Behaviour |
+| --- | --- |
+| Unset or `pypi` | Existing PyPI Trusted Publishing. `PYPI_REPOSITORY_URL` (variable) and `PYPI_TOKEN` (secret) still support PyPI-compatible custom endpoints. |
+| `custom` | Run your repository-owned composite action at `.github/actions/release-publish/action.yml` (or `action.yaml`). No fallback to public PyPI. |
+| `none` | Skip package publishing, retaining the other release outputs. |
+
+No bundle syncs the custom action path: it remains repository-owned.
+Commit the action before tagging the release;
+it runs from that release revision with the `release` environment, `contents: read` and
+`id-token: write`. It receives `artifacts-dir` (absolute path to the downloaded build
+artifacts), `tag`, `version` (tag without `v`) and the optional `credentials` input.
+It owns provider login, tool setup and upload, and must fail on unsuccessful publication.
+Use the existing distributions rather than rebuilding them; the directory can also
+contain provenance files.
+
+For OIDC-capable feeds, obtain and immediately mask short-lived credentials in this
+action. Otherwise, supply the optional `RELEASE_PUBLISH_CREDENTIALS` secret in the
+format your action expects. Only that explicit secret is forwarded to the extension.
+An optional `artifact-url` output supplies a public HTTPS artifact link for release notes;
+omit it for private destinations and never include credentials or signed access tokens.
+
+The private-package classifier still suppresses built-in PyPI uploads; `custom`
+explicitly permits private distributions. Invalid modes, missing custom actions and
+missing expected distributions fail closed. Failed required uploads prevent release
+finalization. Conda recipes are generated only after successful public PyPI publication
+with no `PYPI_REPOSITORY_URL` override.
+
+This is a GitHub publishing extension, not private dependency-consumption setup or a
+GitLab feature. See the
+[publisher contract](https://jebel-quant.github.io/rhiza/reference/ARCHITECTURE/#repository-owned-publishing-action)
+for details.
+
+## Private dependency secrets in other workflows
+
+`GH_PAT` and `UV_EXTRA_INDEX_URL` are read by the CI, benchmark, CodeQL, marimo, book,
+weekly and docker workflows too. The stubs that call those reusable workflows forward each secret by
+name rather than with `secrets: inherit`, because GitHub only honours `inherit` when the
+caller sits in the same organisation or enterprise as `jebel-quant/rhiza` — from any other
+organisation the secrets simply never arrived, and private dependencies failed to install
+with `could not read Password for 'https://***@github.com'` (#1689). A secret that is not
+defined is forwarded empty and the workflow falls back to `github.token`, so nothing is
+required for a project with no private dependencies. Pull requests from forks never receive
+secrets at all, so a fork PR that needs a private dependency fails at install; that is
+GitHub's rule rather than a rhiza setting.
+
+The docker workflow is the one place the runner's git configuration cannot reach, because
+`uv sync` runs inside the image build. It passes both secrets to `docker buildx build` as
+BuildKit secrets instead, which exist only for that one instruction and are written into no
+layer; a build argument would be readable with `docker history` (#1691). See
+`docs/development/DOCKER.md` for building such an image locally.
+
+## Private dependency setup (opt-in)
+
+Set `RHIZA_SETUP_ENABLED=true` and commit a consumer-owned
+`.github/actions/rhiza-setup/action.yml` (or `action.yaml`). The action receives
+`purpose` and the optional `RHIZA_SETUP_CREDENTIALS` secret as `credentials`.
+Keep provider settings inside that action; no repository variables are forwarded.
+Setup exports through `GITHUB_ENV` survive an unset legacy `UV_EXTRA_INDEX_URL`
+secret. Publication is independent: built-in PyPI remains the default.
+
+For Dependabot PRs, also define `RHIZA_SETUP_CREDENTIALS` as a Dependabot secret
+when setup requires it; Actions secrets are not available to those runs. The same
+applies to `BOOK_SETUP_TOKEN` for deprecated book callers.
+
+In the shipped workflows, OIDC-based setup works only in the release `build` job,
+which already has `id-token: write` for attestations. CI, book, marimo, benchmark
+and weekly setup support token-based authentication only.
+
+Default setup jobs explicitly retain read-only permissions; the book build never
+inherits Pages deployment permissions. A caller-only `id-token: write` grant is
+insufficient for OIDC setup: opt in with a consumer-owned workflow copy granting
+OIDC only to the dependency jobs, plus the matching caller grant. See the setup
+contract below for the procedure. Excluded wrappers no longer receive automatic
+workflow-version updates; bump their references and maintain workflow copies manually.
+Pages deployment and release signing retain their existing separate permissions.
+Fork PRs and `pull_request_target` fail when setup is enabled, before the action runs.
+
+For the CodeArtifact example, IAM/OIDC configuration, workflow coverage, book-hook
+migration and deferred container/AWS validation work, see the
+[setup contract](https://jebel-quant.github.io/rhiza/reference/ARCHITECTURE/#consumer-owned-dependency-setup).
+Rename the former book action to `rhiza-setup`, its `token` input to `credentials`,
+and `BOOK_SETUP_TOKEN` to `RHIZA_SETUP_CREDENTIALS`; remove `with.book-setup` and set
+`RHIZA_SETUP_ENABLED=true` instead. The old input and secret remain deprecated aliases
+until the next major release. `book-setup: true` enables setup for the book job and
+emits a warning. The generic action takes precedence; if absent, the old
+`rhiza-book-setup` action runs with its `token` input. `RHIZA_SETUP_CREDENTIALS`
+takes precedence over `BOOK_SETUP_TOKEN`. Only one action runs.
+
+## CI profiles (prototype)
+
+Select `lean`, `standard` or `comprehensive` with `[tool.rhiza.ci].profile` in the
+consumer's `pyproject.toml`. The default is `comprehensive`. Lean consolidates
+quality checks and runs the primary Python version on ordinary changes; scheduled
+and full manual runs restore the complete compatibility matrix. Standard moves
+lowest-direct dependency testing to those broader runs.
+
+See the [CI profiles guide](https://github.com/Jebel-Quant/rhiza/blob/main/docs/guides/CI_PROFILES.md)
+for scope, migration, branch protection and unreleased-prototype limitations.

polars_yahoo-0.2.0/.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,82 @@
+<!--
+Thanks for contributing!
+
+Every section below is optional guidance, not a form to fill in completely.
+Delete what does not apply; keep the checklist.
+-->
+
+#### Reference issues/PRs
+
+<!--
+Example: Fixes #1234. See also #3456.
+
+Use a closing keyword (Fixes, Closes, Resolves) so the linked issue closes
+automatically when this PR is merged:
+https://docs.github.com/en/issues/tracking-your-work-with-issues/linking-a-pull-request-to-an-issue
+If no issue exists, open one first or explain the motivation below.
+-->
+
+#### What does this implement/fix? Explain your changes.
+
+<!--
+A clear and concise description of what you changed and why. If the change is
+a bug fix, say what the observed behaviour was and what it is now.
+-->
+
+#### Does your contribution introduce a new dependency? If yes, which one?
+
+<!--
+Only relevant if you changed the project manifest (pyproject.toml, Cargo.toml,
+go.mod), a GitHub Actions pin or a pre-commit hook. We try to keep the
+dependency set small; say why the new one is needed and whether it is
+optional.
+-->
+
+#### What should a reviewer concentrate their feedback on?
+
+<!--
+Particularly useful for a PR that is still in development: point reviewers
+at the parts that are ready for comments. Bullets (* or -) and filled
+checkboxes [x] work well here.
+-->
+
+#### Did you add any tests for the change?
+
+<!--
+New behaviour should come with a test that fails without the change, so
+later edits cannot reintroduce the same bug. If the change is not testable,
+say why.
+-->
+
+#### Any other comments?
+
+<!--
+Trade-offs you considered, follow-up work you deliberately left out,
+anything a reviewer would otherwise have to guess.
+-->
+
+#### PR checklist
+
+<!--
+Go through the list below. Remove points that do not apply.
+-->
+
+##### For all contributions
+
+- [ ] The PR title follows [Conventional Commits](https://www.conventionalcommits.org/)
+      (`feat:`, `fix:`, `docs:`, `test:`, `ci:`, `chore:`, `refactor:`, ...). It becomes
+      the squash-merge commit and the changelog entry.
+- [ ] `make fmt` and `make test` pass locally.
+- [ ] No hand edits to template-owned files. Anything listed in
+      `.rhiza/template.lock` is overwritten by the next sync; propose the change
+      upstream in [Jebel-Quant/rhiza](https://github.com/Jebel-Quant/rhiza) or add the
+      path to `exclude:` in `.rhiza/template.yml`.
+
+##### For user-visible changes
+
+- [ ] Documentation (README, docstrings, docs pages) is updated to match.
+- [ ] Breaking changes are marked with `!` in the title or a `BREAKING CHANGE:` footer.
+
+<!--
+Thanks again for contributing!
+-->

polars_yahoo-0.2.0/.github/dependabot.yml

@@ -0,0 +1,86 @@
+# This file is part of the jebel-quant/rhiza repository
+# (https://github.com/jebel-quant/rhiza).
+#
+# Configuration: Dependabot
+#
+# Purpose: Automate dependency updates for Python packages, GitHub Actions, and Docker images.
+#
+# Documentation: https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
+
+version: 2
+updates:
+  # Python dependencies using uv
+  - package-ecosystem: "uv"
+    directory: "/"
+    # Bump uv.lock only; leave pyproject.toml ranges alone unless a new version falls
+    # outside them. Without this, Dependabot's default ("auto") treats any project it
+    # cannot find on PyPI -- private, unpublished, or whose name belongs to another
+    # project -- as an application and rewrites every `>=` floor to the latest version,
+    # which then fails the lowest-direct-dependency CI job.
+    versioning-strategy: "increase-if-necessary"
+    schedule:
+      interval: "weekly"
+      day: "tuesday"
+      time: "09:00"
+      timezone: "Asia/Dubai"
+    ignore:
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
+    open-pull-requests-limit: 10
+    labels:
+      - "dependencies"
+      - "python"
+    groups:
+      python-dependencies:
+        patterns:
+          - "*"
+        update-types:
+          - "patch"
+          - "minor"
+    commit-message:
+      prefix: "chore(deps)"
+      prefix-development: "chore(deps-dev)"
+      include: "scope"
+
+  # GitHub Actions
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "tuesday"
+      time: "09:00"
+      timezone: "Asia/Dubai"
+    ignore:
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
+    open-pull-requests-limit: 10
+    labels:
+      - "dependencies"
+      - "github-actions"
+    groups:
+      github-actions:
+        patterns:
+          - "*"
+        update-types:
+          - "patch"
+          - "minor"
+
+    commit-message:
+      prefix: "chore(deps)"
+      include: "scope"
+
+  # Docker
+  #- package-ecosystem: "docker"
+  #  directory: "/docker"
+  #  schedule:
+  #    interval: "weekly"
+  #    day: "tuesday"
+  #    time: "09:00"
+  #    timezone: "Asia/Dubai"
+  #  open-pull-requests-limit: 10
+  #  labels:
+  #    - "dependencies"
+  #    - "docker"
+  #  commit-message:
+  #    prefix: "chore(deps)"
+  #    include: "scope"

polars_yahoo-0.2.0/.github/release.yml

@@ -0,0 +1,67 @@
+# GitHub Release Notes Configuration
+# This file configures automatic categorization of pull requests in release notes
+# See: https://docs.github.com/en/repositories/releasing-projects-on-github/automatically-generated-release-notes
+
+changelog:
+  exclude:
+    labels:
+      - ignore-for-release
+      - duplicate
+      - question
+      - invalid
+      - wontfix
+    authors:
+      - dependabot
+      - renovate
+  
+  categories:
+    - title: 🚀 Features
+      labels:
+        - feature
+        - enhancement
+    
+    - title: 🐛 Bug Fixes
+      labels:
+        - bug
+        - fix
+    
+    - title: 📚 Documentation
+      labels:
+        - documentation
+        - docs
+    
+    - title: 🔧 Technical Debt
+      labels:
+        - technical-debt
+        - refactor
+        - cleanup
+    
+    - title: 🏗️ Infrastructure
+      labels:
+        - ci
+        - build
+        - infrastructure
+    
+    - title: ⚡ Performance
+      labels:
+        - performance
+        - optimization
+    
+    - title: 🧪 Testing
+      labels:
+        - test
+        - testing
+    
+    - title: 🔒 Security
+      labels:
+        - security
+        - vulnerability
+    
+    - title: 📦 Dependencies
+      labels:
+        - dependencies
+        - deps
+    
+    - title: 🔄 Other Changes
+      labels:
+        - "*"

polars_yahoo-0.2.0/.github/rulesets/main-branch-protection.json

@@ -0,0 +1,47 @@
+{
+  "name": "main-branch-protection",
+  "target": "branch",
+  "enforcement": "active",
+  "conditions": {
+    "ref_name": {
+      "include": ["~DEFAULT_BRANCH"],
+      "exclude": []
+    }
+  },
+  "rules": [
+    { "type": "deletion" },
+    { "type": "non_fast_forward" },
+    {
+      "type": "pull_request",
+      "parameters": {
+        "required_approving_review_count": 1,
+        "dismiss_stale_reviews_on_push": true,
+        "require_code_owner_review": true,
+        "require_last_push_approval": true,
+        "required_review_thread_resolution": false,
+        "allowed_merge_methods": ["squash", "merge", "rebase"]
+      }
+    },
+    {
+      "type": "required_status_checks",
+      "parameters": {
+        "strict_required_status_checks_policy": false,
+        "required_status_checks": [
+          { "context": "ci / Pre-commit hooks", "integration_id": 15368 },
+          { "context": "ci / Check dependencies with deptry", "integration_id": 15368 },
+          { "context": "ci / docs-coverage", "integration_id": 15368 },
+          { "context": "ci / Security scanning", "integration_id": 15368 },
+          { "context": "ci / License compliance scan", "integration_id": 15368 },
+          { "context": "ci / CI gate", "integration_id": 15368 }
+        ]
+      }
+    }
+  ],
+  "bypass_actors": [
+    {
+      "actor_type": "RepositoryRole",
+      "actor_id": 5,
+      "bypass_mode": "always"
+    }
+  ]
+}

polars_yahoo-0.2.0/.github/rulesets/tag-protection.json

@@ -0,0 +1,24 @@
+{
+  "name": "version-tag-protection",
+  "target": "tag",
+  "enforcement": "active",
+  "conditions": {
+    "ref_name": {
+      "include": ["refs/tags/v*"],
+      "exclude": []
+    }
+  },
+  "rules": [
+    { "type": "creation" },
+    { "type": "update" },
+    { "type": "deletion" },
+    { "type": "non_fast_forward" }
+  ],
+  "bypass_actors": [
+    {
+      "actor_type": "RepositoryRole",
+      "actor_id": 5,
+      "bypass_mode": "always"
+    }
+  ]
+}

polars_yahoo-0.2.0/.github/secret_scanning.yml

@@ -0,0 +1,19 @@
+# This file is part of the jebel-quant/rhiza repository
+# (https://github.com/jebel-quant/rhiza).
+#
+# Configuration: GitHub Secret Scanning
+#
+# Purpose: Configure GitHub secret scanning to identify and prevent accidental
+#          exposure of secrets, credentials, and tokens in the repository.
+#
+# Note: Secret scanning must be enabled in repository Settings >
+#       Security > Code security and analysis > Secret scanning.
+#
+# Documentation: https://docs.github.com/en/code-security/secret-scanning/configuring-secret-scanning-for-your-repository
+
+paths-ignore:
+  # Ignore test fixtures that may contain example/fake secrets
+  - "tests/**"
+  # Ignore documentation that references example tokens/keys
+  - "docs/**/*.md"
+  - "book/**"

polars_yahoo-0.2.0/.github/workflows/rhiza_benchmark.yml

@@ -0,0 +1,30 @@
+# This file is part of the jebel-quant/rhiza repository
+# (https://github.com/jebel-quant/rhiza).
+#
+# Workflow: Benchmarks
+#
+# Purpose: Run the benchmark suite on pushes to main to create a measurable
+#          performance baseline over time.
+#
+# Trigger: This workflow runs on pushes to the main branch.
+
+name: "(RHIZA) BENCHMARK"
+
+permissions:
+  contents: read
+
+on:
+  push:
+    branches:
+      - main
+
+jobs:
+  benchmark:
+    uses: jebel-quant/rhiza/.github/workflows/rhiza_benchmark.yml@v1.12.0
+    # Forwarded explicitly: `secrets: inherit` only reaches a reusable workflow in the
+    # caller's own organisation or enterprise (#1689). A secret this repository has not
+    # defined arrives empty and the workflow falls back to `github.token`.
+    secrets:
+      RHIZA_SETUP_CREDENTIALS: ${{ secrets.RHIZA_SETUP_CREDENTIALS }}
+      GH_PAT: ${{ secrets.GH_PAT }}
+      UV_EXTRA_INDEX_URL: ${{ secrets.UV_EXTRA_INDEX_URL }}

polars_yahoo-0.2.0/.github/workflows/rhiza_book.yml

@@ -0,0 +1,51 @@
+# This file is part of the jebel-quant/rhiza repository
+# (https://github.com/jebel-quant/rhiza).
+#
+# Workflow: Book
+# Purpose: This workflow builds and deploys comprehensive documentation for the project.
+#          It combines API documentation, test coverage reports, test results, and
+#          interactive notebooks into a single GitHub Pages site.
+#
+# Trigger: This workflow runs on every push (any branch), so every commit
+#          validates that the book still builds. The reusable workflow deploys
+#          to GitHub Pages only from the repository's default branch and never
+#          from a fork; other branches build and upload an artifact only.
+#
+# Components:
+#   - 📓 Process Marimo notebooks
+#   - 📖 Build documentation site via zensical
+#   - 🧪 Run tests and generate coverage reports
+#   - 🚀 Deploy combined documentation to GitHub Pages
+
+name: "(RHIZA) BOOK"
+
+on:
+  push:
+    branches:
+      - '**'
+
+permissions:
+  contents: read
+
+jobs:
+  book:
+    uses: jebel-quant/rhiza/.github/workflows/rhiza_book.yml@v1.12.0
+    # Forwarded explicitly: `secrets: inherit` only reaches a reusable workflow in the
+    # caller's own organisation or enterprise (#1689). A secret this repository has not
+    # defined arrives empty and the workflow falls back to `github.token`.
+    secrets:
+      BOOK_SETUP_TOKEN: ${{ secrets.BOOK_SETUP_TOKEN }}
+      RHIZA_SETUP_CREDENTIALS: ${{ secrets.RHIZA_SETUP_CREDENTIALS }}
+      GH_PAT: ${{ secrets.GH_PAT }}
+      UV_EXTRA_INDEX_URL: ${{ secrets.UV_EXTRA_INDEX_URL }}
+    permissions:
+      contents: read
+      pages: write
+      id-token: write
+    # Set `deploy-pages: false` for artifact-only mode -- the reusable workflow
+    # still uploads the generic `book` artifact, and a consumer-owned job below
+    # can download it and deploy to Cloudflare Pages, Azure Static Web Apps,
+    # S3/CloudFront, an internal web server, etc. See docs/guides/BOOK.md for a
+    # full Cloudflare Pages example.
+    # with:
+    #   deploy-pages: false