sillybos 0.1.0__tar.gz

sillybos-0.1.0/.editorconfig

@@ -0,0 +1,18 @@
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+insert_final_newline = true
+trim_trailing_whitespace = true
+indent_style = space
+indent_size = 4
+
+[*.{yml,yaml,toml,md,cff}]
+indent_size = 2
+
+[*.md]
+trim_trailing_whitespace = false
+
+[*.tsv]
+indent_style = tab

sillybos-0.1.0/.githooks/commit-msg

@@ -0,0 +1,92 @@
+#!/bin/sh
+# commit-msg hook — enforce Conventional Commits across all projects.
+#
+# Dependency-free POSIX sh; the identical script lives in every repo under
+# .githooks/ and is shared via `git config core.hooksPath .githooks`.
+#
+# Format:  <type>[(scope)][!]: <description>
+#   type ....... feat fix docs style refactor perf test build ci chore revert
+#   scope ...... optional, e.g. feat(nav): ...
+#   !  ......... optional, marks a breaking change
+#
+# Rules (header = first line):
+#   - matches the format above with an allowed, lower-case type
+#   - description is non-empty and has no trailing full stop
+#   - header is 100 characters or fewer (72 or fewer preferred)
+#   - a blank line separates the header from any body
+#
+# Skipped for merge, revert, fixup!/squash! and reapply commits. Note the hook
+# runs on local commits only — dependabot and GitHub web-UI commits bypass it.
+# Activate in a fresh clone with: git config core.hooksPath .githooks
+
+msg_file="$1"
+commit_source="$2"
+
+# Skip auto-generated merge/squash messages.
+case "$commit_source" in
+  merge | squash) exit 0 ;;
+esac
+
+# Header = first non-comment, non-blank line.
+header=$(grep -v '^#' "$msg_file" | sed '/^[[:space:]]*$/d' | head -n 1)
+
+# Skip special commit kinds that have their own conventions.
+case "$header" in
+  "Merge "* | "Revert "* | "Reapply "* | "fixup! "* | "squash! "*) exit 0 ;;
+esac
+
+if [ -z "$header" ]; then
+  echo "✖ commit-msg: empty commit message" >&2
+  exit 1
+fi
+
+types='feat|fix|docs|style|refactor|perf|test|build|ci|chore|revert'
+errors=0
+fail() {
+  echo "✖ commit-msg: $1" >&2
+  errors=$((errors + 1))
+}
+
+# Conventional Commits header: type(scope)!: description
+if printf '%s' "$header" | grep -Eq "^(${types})(\([a-z0-9._/-]+\))?(!)?: .+"; then
+  # Description must not end with a full stop.
+  desc=$(printf '%s' "$header" | sed -E 's/^[^:]+: //')
+  case "$desc" in
+    *.) fail "do not end the description with a full stop" ;;
+  esac
+else
+  fail "header must follow Conventional Commits: <type>[(scope)][!]: <description>"
+  echo "  allowed types: feat fix docs style refactor perf test build ci chore revert" >&2
+  echo "  e.g. feat(nav): add mobile menu   |   fix: correct hero lede fallback" >&2
+fi
+
+# Length: hard limit 100 (commitlint default), recommend 72.
+len=$(printf '%s' "$header" | wc -m | tr -d ' ')
+if [ "$len" -gt 100 ]; then
+  fail "header is $len characters; keep it to 100 or fewer"
+elif [ "$len" -gt 72 ]; then
+  echo "⚠ commit-msg: header is $len characters; 72 or fewer is preferred" >&2
+fi
+
+# A body, if present, must be separated from the header by a blank line.
+line2=$(sed -n '2p' "$msg_file")
+if [ -n "$line2" ] && [ "${line2#\#}" = "$line2" ]; then
+  fail "leave a blank line between the header and the body"
+fi
+
+# Warn (do not block) on over-long lines of prose in the body.
+sed -n '3,$p' "$msg_file" | grep -v '^#' | while IFS= read -r line; do
+  case "$line" in
+    *" "*)
+      bl=$(printf '%s' "$line" | wc -m | tr -d ' ')
+      [ "$bl" -gt 72 ] && echo "⚠ commit-msg: body line over 72 characters: $line" >&2
+      ;;
+  esac
+done
+
+if [ "$errors" -gt 0 ]; then
+  echo "" >&2
+  echo "Commit rejected. Fix the message above and try again." >&2
+  exit 1
+fi
+exit 0

sillybos-0.1.0/.github/dependabot.yml

@@ -0,0 +1,20 @@
+# Dependabot keeps uv.lock and the workflow actions current. Commit-message
+# prefixes are set so its PRs satisfy the Conventional Commits hook that
+# local commits go through (Dependabot commits on GitHub's side bypass it).
+version: 2
+updates:
+  - package-ecosystem: "uv"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    commit-message:
+      prefix: "build"
+      include: "scope"
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    commit-message:
+      prefix: "ci"
+      include: "scope"

sillybos-0.1.0/.github/workflows/ci.yml

@@ -0,0 +1,187 @@
+# Lint, type-check and test on every push and pull request.
+#
+# The package has no runtime dependencies, so the matrix is cheap: every
+# supported Python, the full test suite with the coverage floor from
+# pyproject.toml, and a wheel smoke test on one of them. poppler is
+# installed so the PDF tests run rather than skip.
+#
+#   Test (Python X)              ruff, mypy, pytest with coverage, the wheel
+#   Lockfile is current          uv.lock matches pyproject.toml
+#   Trivy scan                   HIGH/CRITICAL fixed vulnerabilities in what
+#                                uv.lock resolves
+#   Security                     zizmor on the workflows, gitleaks on the
+#                                whole history
+#   Shared templates are current cliff.toml and .githooks/commit-msg match
+#                                scattercode/release-pipelines
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    name: Test (Python ${{ matrix.python }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python: ["3.11", "3.12", "3.13", "3.14"]
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          # hatch-vcs derives the version from `git describe --tags`; a
+          # shallow clone has no tags reachable and the package would
+          # report 0.1.dev1+g<sha>.
+          fetch-depth: 0
+          persist-credentials: false
+
+      - uses: actions/setup-python@v7
+        with:
+          python-version: ${{ matrix.python }}
+          cache: pip
+
+      - name: Install poppler, for the PDF tests
+        run: sudo apt-get install -y --no-install-recommends poppler-utils
+
+      - name: Install the package with the development extra
+        run: pip install -e '.[dev]'
+
+      - name: Lint
+        run: |
+          ruff check .
+          ruff format --check .
+
+      - name: Type-check
+        run: mypy
+
+      - name: Test
+        run: pytest --cov --cov-report=term-missing
+
+      # The wheel, not the editable install: catches files that work from
+      # `pip install -e .` but were left out of the wheel.
+      - name: Build and smoke-test the wheel
+        if: matrix.python == '3.12'
+        run: |
+          pip install --quiet build twine
+          python -m build
+          twine check --strict dist/*
+          python -m venv /tmp/smoke
+          /tmp/smoke/bin/pip install --quiet dist/*.whl
+          printf '%%!PS-Adobe-3.0 EPSF-3.0\n' > /tmp/page.png
+          if /tmp/smoke/bin/sillybos /tmp/page.png; then echo "::error::a PostScript file passed"; exit 1; fi
+          /tmp/smoke/bin/python -c "import sillybos; print(sillybos.__version__)"
+
+  lockfile:
+    name: Lockfile is current
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      # uv.lock pins the resolved development tooling so scanners see real
+      # versions, not ranges. Regenerate with `uv lock` after any
+      # pyproject.toml change.
+      - uses: astral-sh/setup-uv@v7
+      - run: uv lock --check
+
+  # Same arrangement as the sibling repositories. The committed uv.lock is
+  # what makes the scan worthwhile for Python: pyproject.toml declares
+  # ranges, but the lock carries every resolved version.
+  trivy:
+    name: Trivy scan
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+
+      - name: Scan for vulnerabilities
+        uses: aquasecurity/trivy-action@v0.36.0
+        with:
+          scan-type: fs
+          scan-ref: .
+          format: table
+          exit-code: "1"
+          ignore-unfixed: true
+          vuln-type: library
+          severity: HIGH,CRITICAL
+
+      - name: Generate SBOM
+        uses: aquasecurity/trivy-action@v0.36.0
+        if: always()
+        with:
+          scan-type: fs
+          scan-ref: .
+          format: cyclonedx
+          output: sbom.cdx.json
+          exit-code: "0"
+
+      - name: Upload SBOM
+        uses: actions/upload-artifact@v7
+        if: always()
+        with:
+          name: sbom-source-tree
+          path: sbom.cdx.json
+          retention-days: 90
+
+  # Static analysis of the workflows (zizmor: injection, unpinned actions,
+  # over-broad permissions) and a scan of the whole history for secrets
+  # (gitleaks). Both run before push and commit through lefthook too; this
+  # is the backstop for a laptop without the hooks.
+  security:
+    name: Security
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - uses: astral-sh/setup-uv@v7
+
+      - name: Workflows
+        run: uvx zizmor --min-severity medium .github/workflows
+
+      # The gitleaks binary rather than gitleaks/gitleaks-action, which
+      # needs a licence key (GITLEAKS_LICENSE) in a repository owned by an
+      # organisation. Pinned to a release and its checksum.
+      - name: Secrets in the history
+        env:
+          GITLEAKS_VERSION: 8.30.1
+          GITLEAKS_SHA256: 551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb
+        run: |
+          set -euo pipefail
+          tarball="gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz"
+          curl -fsSLO "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/${tarball}"
+          echo "${GITLEAKS_SHA256}  ${tarball}" | sha256sum --check -
+          tar -xzf "$tarball" gitleaks
+          ./gitleaks git --no-banner --redact --verbose .
+
+  # cliff.toml and .githooks/commit-msg are copies of the shared templates in
+  # scattercode/release-pipelines. They have to be real files here -- git-cliff
+  # reads one from the repository root and git runs the other from the checkout
+  # -- so they cannot be referenced remotely the way the next-version action
+  # is. This is what stops a copy drifting unnoticed.
+  templates:
+    name: Shared templates are current
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+
+      - name: Check out the shared templates
+        uses: actions/checkout@v7
+        with:
+          repository: scattercode/release-pipelines
+          ref: v1
+          path: .release-pipelines
+          persist-credentials: false
+
+      - name: Compare
+        run: ./.release-pipelines/sync.sh --check .

sillybos-0.1.0/.github/workflows/pr-title.yml

@@ -0,0 +1,52 @@
+# The pull request title must be a Conventional Commit.
+#
+# Why this exists as its own workflow, and not as a job in ci.yml.
+#
+# Pull requests here are squash-merged, so the PR *title* becomes the commit
+# message on main -- and that message is what git-cliff reads to compute the
+# next version. A prose title is not a Conventional Commit, so it parses as
+# nothing releasable: Release runs, finds no feat or fix since the last tag,
+# exits successfully in ten seconds, and cuts nothing. Nothing fails. The
+# first visible symptom is unrelated -- the published Sphinx docs reporting a
+# dev version, because main is sitting untagged.
+#
+# That is exactly how #79 shipped ten conventional commits behind the title
+# "Close brief 012, measure the vision-language backends, and stop
+# transcribing benchmark tables", and released none of them.
+#
+# The check reuses .githooks/commit-msg, the same script the local hook runs,
+# rather than a second definition of "conventional" that would drift from it
+# -- the reason that script is shared from scattercode/release-pipelines in
+# the first place. The hook's own comment names this gap: it "runs on local
+# commits only -- dependabot and GitHub web-UI commits bypass it", and a
+# squash-merge is a web-UI commit.
+#
+# Separate from ci.yml so it reports in seconds, whatever the pull request
+# touches, and fails on its own line rather than inside a test run.
+name: PR title
+
+on:
+  pull_request:
+    types: [opened, edited, reopened, synchronize]
+
+permissions:
+  contents: read
+
+jobs:
+  conventional:
+    name: PR title is a Conventional Commit
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+
+      # Through the environment, never interpolated into the shell. A pull
+      # request title is attacker-controlled text, and `run: ... ${{ ... }}`
+      # would substitute it into the script before bash ever sees it.
+      - name: Check the title
+        env:
+          TITLE: ${{ github.event.pull_request.title }}
+        run: |
+          printf '%s\n' "$TITLE" > "$RUNNER_TEMP/pr-title"
+          ./.githooks/commit-msg "$RUNNER_TEMP/pr-title"

sillybos-0.1.0/.github/workflows/release.yml

@@ -0,0 +1,247 @@
+# Automated release: the workspace pattern, shared with the sibling repositories.
+#
+# On every push/merge to main, the shared next-version action computes the next
+# semantic version from the Conventional Commit history since the last tag,
+# git-cliff prepends that version's section to CHANGELOG.md, the commit is
+# tagged, and a GitHub Release is published whose notes are that section.
+# The wheel is then built from the tag and published to PyPI with a Trusted
+# Publisher.
+#
+# The release commit is pushed by the `scattercode-release` App, the only
+# actor the main ruleset lets bypass it. That token is a real identity, so
+# unlike GITHUB_TOKEN its pushes *do* trigger workflows -- the `chore(release):`
+# guard on the job below is what stops this looping, not the token. If there
+# are no releasable commits since the last tag, the job is a no-op.
+#
+# A re-run by hand, for a tag whose build or publish failed after the tag
+# and GitHub Release already existed:
+#
+#   gh workflow run release.yml --ref main -f tag=0.2.0
+#
+# The release job is skipped and the rest runs for that tag.
+name: Release
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: An existing release tag to build and publish (for example 0.2.0)
+        required: true
+        type: string
+
+# Granted per job below, not here: a workflow-level grant reaches every job,
+# and only the release job pushes.
+permissions: {}
+
+concurrency:
+  group: release
+  cancel-in-progress: false
+
+jobs:
+  release:
+    # Belt and braces: never react to our own release commit. A dispatch
+    # names a tag that already exists, so there is nothing to compute.
+    if: ${{ github.event_name == 'push' && !startsWith(github.event.head_commit.message, 'chore(release):') }}
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    outputs:
+      released: ${{ steps.version.outputs.release }}
+      version: ${{ steps.version.outputs.next }}
+    steps:
+      # A token for the `scattercode-release` GitHub App, which is the only
+      # actor allowed to bypass main's ruleset. GITHUB_TOKEN cannot be given
+      # that permission -- GitHub Actions is not an installable app, so it has
+      # no identity a ruleset can name. The App holds Contents: write and
+      # nothing else, so the worst it can do is commit and tag.
+      - name: Mint a release token
+        id: app_token
+        uses: actions/create-github-app-token@v3
+        with:
+          app-id: ${{ secrets.RELEASE_CLIENT_ID }}
+          private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
+          # Scoped to what the job uses, even though the installation grants
+          # no more: a token minted without this inherits whatever the App
+          # is later given.
+          permission-contents: write
+
+      # The committer line needs the App's bot *user* id, which is not any of
+      # the ids the token action returns -- `installation-id` is a different
+      # number, and a commit carrying it is attributed to nobody.
+      - name: Identify the App's bot user
+        id: bot
+        env:
+          GH_TOKEN: ${{ steps.app_token.outputs.token }}
+          SLUG: ${{ steps.app_token.outputs.app-slug }}
+        run: |
+          set -euo pipefail
+          echo "id=$(gh api "/users/${SLUG}[bot]" --jq .id)" >> "$GITHUB_OUTPUT"
+
+      - name: Check out full history
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+          # Persisted so the push below goes out as the App rather than as
+          # GITHUB_TOKEN, which the ruleset would refuse.
+          token: ${{ steps.app_token.outputs.token }}
+
+      - name: Install git-cliff
+        uses: taiki-e/install-action@v2
+        with:
+          tool: git-cliff
+
+      # Shared with every other repository whose releases are automated.
+      - name: Compute next version
+        id: version
+        uses: scattercode/release-pipelines/actions/next-version@v1
+
+      - name: Guard against a silently skipped release
+        if: steps.version.outputs.release != 'true'
+        run: |
+          latest="$(git describe --tags --abbrev=0 2>/dev/null || echo '')"
+          echo "No releasable change since ${latest:-repo start}."
+          # A merge to main carrying a feat or fix must produce a release. If
+          # one does not, that is the failure this job exists to catch.
+          if git log --no-merges --format='%s' "${latest:+$latest..}HEAD" \
+               | grep -qE '^(feat|fix|perf|revert)(\([^)]*\))?!?:'; then
+            echo "::error::Releasable commits are present but no version was computed."
+            exit 1
+          fi
+
+      - name: Update changelog, tag and release
+        if: steps.version.outputs.release == 'true'
+        env:
+          VERSION: ${{ steps.version.outputs.next }}
+          GH_TOKEN: ${{ github.token }}
+          # Passed through the environment rather than expanded into the
+          # script: an expression inside `run:` is pasted into the shell
+          # before it runs, which is how workflow injection happens.
+          BRANCH: ${{ github.ref_name }}
+          APP_SLUG: ${{ steps.app_token.outputs.app-slug }}
+          BOT_ID: ${{ steps.bot.outputs.id }}
+        run: |
+          set -euo pipefail
+
+          # The very first release predates the changelog: git-cliff's
+          # --prepend errors on a missing file but handles an empty one
+          # correctly (header, then the new section).
+          touch CHANGELOG.md
+
+          # --prepend, not --output: regenerating the whole changelog re-runs
+          # git-cliff's release bucketing over the entire history, which is
+          # exactly what is unreliable on merge topology.
+          git cliff --tag "$VERSION" --unreleased --prepend CHANGELOG.md
+          git cliff --tag "$VERSION" --unreleased --strip all --output RELEASE_NOTES.md
+
+          git config user.name  "${APP_SLUG}[bot]"
+          git config user.email "${BOT_ID}+${APP_SLUG}[bot]@users.noreply.github.com"
+
+          git add CHANGELOG.md
+          git commit -m "chore(release): ${VERSION#v}"
+          git tag -a "$VERSION" -m "$VERSION"
+
+          # One atomic push, so the branch and the tag land together. A pull
+          # request merged into main while this job is running makes this
+          # push non-fast-forward and the job fails here; because nothing
+          # after it has run, re-running the job is a clean redo.
+          git push --atomic origin "HEAD:${BRANCH}" "$VERSION"
+
+          gh release create "$VERSION" --title "$VERSION" --notes-file RELEASE_NOTES.md
+
+  # One place that says which tag, if any, the rest of the workflow ships:
+  # the tag the release job just pushed, or the one a dispatch named.
+  tag:
+    needs: release
+    if: ${{ always() && !cancelled() }}
+    runs-on: ubuntu-latest
+    outputs:
+      released: ${{ steps.pick.outputs.released }}
+      version: ${{ steps.pick.outputs.version }}
+    steps:
+      - id: pick
+        env:
+          DISPATCHED_TAG: ${{ inputs.tag }}
+          RELEASED: ${{ needs.release.outputs.released }}
+          VERSION: ${{ needs.release.outputs.version }}
+        run: |
+          if [ -n "$DISPATCHED_TAG" ]; then
+            echo "released=true" >> "$GITHUB_OUTPUT"
+            echo "version=$DISPATCHED_TAG" >> "$GITHUB_OUTPUT"
+          else
+            echo "released=${RELEASED:-false}" >> "$GITHUB_OUTPUT"
+            echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          fi
+
+  # Build the sdist and wheel from the exact tag. A fresh checkout at the
+  # tag is what makes hatch-vcs produce a clean X.Y.Z. `!cancelled()` on
+  # this and the next gate, not a bare output check: a job whose `if` names
+  # no status function gets an implicit success(), which is false when the
+  # release job was skipped, as it is on every dispatch.
+  build:
+    needs: tag
+    if: ${{ !cancelled() && needs.tag.outputs.released == 'true' }}
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          ref: ${{ needs.tag.outputs.version }}
+          fetch-depth: 0
+          persist-credentials: false
+
+      # A dispatched tag could be a branch name or a typo, and
+      # actions/checkout would check either out without complaint.
+      - name: Check the ref is a tag
+        run: git describe --exact-match --tags HEAD
+
+      - uses: actions/setup-python@v7
+        with:
+          python-version: "3.12"
+
+      - name: Build sdist and wheel
+        run: |
+          python -m pip install --upgrade build twine
+          python -m build
+
+      # Fails on a README that will not render on PyPI, or missing metadata.
+      - name: Check distribution metadata
+        run: twine check --strict dist/*
+
+      # Install the *wheel* into a clean interpreter and run it. This catches
+      # files that work from `pip install -e .` but were left out of the wheel.
+      - name: Smoke-test the wheel
+        env:
+          VERSION: ${{ needs.tag.outputs.version }}
+        run: |
+          python -m venv /tmp/smoke
+          /tmp/smoke/bin/pip install --quiet dist/*.whl
+          /tmp/smoke/bin/python -c "import os, sillybos; v = os.environ['VERSION'].removeprefix('v'); assert sillybos.__version__ == v, (sillybos.__version__, v); print(sillybos.__version__)"
+          printf '%%!PS-Adobe-3.0 EPSF-3.0\n' > /tmp/page.png
+          if /tmp/smoke/bin/sillybos /tmp/page.png; then echo "::error::a PostScript file passed"; exit 1; fi
+
+      - uses: actions/upload-artifact@v7
+        with:
+          name: dist
+          path: dist/
+
+  # Upload with a Trusted Publisher. No token is stored anywhere: the job
+  # proves its identity to PyPI with a short-lived OIDC token, which is why
+  # id-token: write is the only permission it needs. Attestations (PEP 740)
+  # are generated and uploaded by the action automatically.
+  publish:
+    needs: [tag, build]
+    if: ${{ !cancelled() && needs.tag.outputs.released == 'true' && needs.build.result == 'success' }}
+    runs-on: ubuntu-latest
+    environment: pypi          # must match the name registered on PyPI
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@v8
+        with:
+          name: dist
+          path: dist/
+
+      - uses: pypa/gh-action-pypi-publish@release/v1

sillybos-0.1.0/.github/workflows/security.yml

@@ -0,0 +1,65 @@
+# Weekly security scans -- the same checks CI runs on every push, repeated
+# on a schedule so that CVEs disclosed *between* pushes are caught while
+# the repository is quiet:
+#
+#   Trivy       fixed HIGH/CRITICAL vulnerabilities in what uv.lock resolves
+#   zizmor      the workflows themselves
+#   gitleaks    secrets anywhere in the history
+name: Security
+
+on:
+  schedule:
+    - cron: "0 6 * * 1" # Mondays 06:00 UTC
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  trivy:
+    name: Trivy scan
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+
+      - name: Scan for vulnerabilities
+        uses: aquasecurity/trivy-action@v0.36.0
+        with:
+          scan-type: fs
+          scan-ref: .
+          format: table
+          exit-code: "1"
+          ignore-unfixed: true
+          vuln-type: library
+          severity: HIGH,CRITICAL
+
+  security:
+    name: Workflows and secrets
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - uses: astral-sh/setup-uv@v7
+
+      - name: Workflows
+        run: uvx zizmor --min-severity medium .github/workflows
+
+      # The gitleaks binary rather than gitleaks/gitleaks-action, which
+      # needs a licence key (GITLEAKS_LICENSE) in a repository owned by an
+      # organisation. Pinned to a release and its checksum.
+      - name: Secrets in the history
+        env:
+          GITLEAKS_VERSION: 8.30.1
+          GITLEAKS_SHA256: 551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb
+        run: |
+          set -euo pipefail
+          tarball="gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz"
+          curl -fsSLO "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/${tarball}"
+          echo "${GITLEAKS_SHA256}  ${tarball}" | sha256sum --check -
+          tar -xzf "$tarball" gitleaks
+          ./gitleaks git --no-banner --redact --verbose .