Fix docs again again

.github/workflows/ci.yml

@@ -6,7 +6,7 @@ on:
   pull_request:
 
 concurrency:
-  group: ci-${{ github.ref }}
+  group: ci-${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
 permissions:
@@ -17,76 +17,77 @@ jobs:
     name: Lint & type-check
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Install uv
         uses: astral-sh/setup-uv@v8.2.0
         with:
+          python-version: "3.12"
           enable-cache: true
 
-      - name: Sync (dev tooling)
-        run: uv sync --all-extras
+      - name: Sync dev environment
+        run: uv sync --all-extras --group dev
 
       - name: Ruff lint
         run: uv run ruff check src/topo
 
       - name: Ruff format check
         run: uv run ruff format --check src/topo
 
-      - name: Mypy
-        run: uv run mypy src/topo
-        continue-on-error: true
-
   docs:
     name: Build docs
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Install uv
         uses: astral-sh/setup-uv@v8.2.0
         with:
+          python-version: "3.12"
           enable-cache: true
 
-      - name: Sync (docs group)
+      - name: Sync docs environment
         run: uv sync --group docs
 
-      - name: Build docs (strict)
-        run: uv run mkdocs build --strict
+      - name: Build docs
+        run: uv run zensical build
 
   test:
-    name: Test (py${{ matrix.python-version }})
+    name: Test py${{ matrix.python-version }}
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
       matrix:
-        python-version: ["3.13"]
+        python-version: ["3.12", "3.13"]
+
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Install uv
         uses: astral-sh/setup-uv@v8.2.0
         with:
+          python-version: ${{ matrix.python-version }}
           enable-cache: true
+          cache-suffix: py${{ matrix.python-version }}
 
-      - name: Sync (all extras)
-        run: uv sync --all-extras --python ${{ matrix.python-version }}
+      - name: Sync test environment
+        run: uv sync --all-extras --group dev
 
       - name: Check UMAP dependency
-        run: uv run --python ${{ matrix.python-version }} python -c "import umap; from umap.umap_ import fuzzy_simplicial_set"
+        run: uv run python -c "import umap; from umap.umap_ import fuzzy_simplicial_set"
 
       - name: Run tests
-        run: uv run --python ${{ matrix.python-version }} pytest -q --cov=topo --cov-report=xml
+        run: uv run pytest --cov=topo --cov-report=xml
 
       - name: Smoke-test minimal-core install
         run: |
           uv venv /tmp/core-env --python ${{ matrix.python-version }}
-          VIRTUAL_ENV=/tmp/core-env uv pip install .
-          VIRTUAL_ENV=/tmp/core-env uv run --no-project python -c "import topo; print('core import OK', topo.__version__)"
+          uv pip install --python /tmp/core-env/bin/python .
+          /tmp/core-env/bin/python -c "import topo; print('core import OK', topo.__version__)"
 
       - name: Upload coverage
         if: matrix.python-version == '3.12'
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v6
         with:
           name: coverage-xml
           path: coverage.xml

.github/workflows/docs.yml

@@ -2,34 +2,50 @@ name: Docs
 
 on:
   push:
-    branches: [main]
+    branches: [master]
   workflow_dispatch:
 
-# Deploy via the GitHub Pages "GitHub Actions" source (set it in repo
-# Settings -> Pages). Zensical has no `gh-deploy`; we build and upload the
-# site as a Pages artifact instead.
+concurrency:
+  group: pages-${{ github.ref }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
   pages: write
   id-token: write
 
 jobs:
   deploy:
+    name: Deploy GitHub Pages
+    runs-on: ubuntu-latest
+
     environment:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
-    runs-on: ubuntu-latest
+
     steps:
-      - uses: actions/configure-pages@v6
       - uses: actions/checkout@v7
-      - uses: astral-sh/setup-uv@v8.2.0
+
+      - name: Configure Pages
+        uses: actions/configure-pages@v6
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v8.2.0
         with:
-          python-version: "3.13"
+          python-version: "3.12"
           enable-cache: true
-      - run: uv sync --dev
-      - run: uv run zensical build
-      - uses: actions/upload-pages-artifact@v6
+
+      - name: Sync docs environment
+        run: uv sync --group docs
+
+      - name: Build site
+        run: uv run zensical build
+
+      - name: Upload Pages artifact
+        uses: actions/upload-pages-artifact@v6
         with:
           path: site
-      - uses: actions/deploy-pages@v6
+
+      - name: Deploy Pages
         id: deployment
+        uses: actions/deploy-pages@v6

.github/workflows/release.yml

@@ -1,10 +1,5 @@
 name: Release
 
-# Builds sdist + wheel on a version tag, uploads them as workflow artifacts
-# and publishes to PyPI via Trusted Publishing (OIDC, no API token required).
-# Requires a trusted publisher on the existing PyPI project configured for
-# this repo, workflow `release.yml` and environment `pypi`.
-
 on:
   push:
     tags:
@@ -18,11 +13,15 @@ jobs:
   build:
     name: Build distributions
     runs-on: ubuntu-latest
+
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Install uv
         uses: astral-sh/setup-uv@v8.2.0
+        with:
+          python-version: "3.12"
+          enable-cache: true
 
       - name: Build sdist + wheel
         run: uv build
@@ -31,7 +30,7 @@ jobs:
         run: uvx twine check dist/*
 
       - name: Upload artifacts
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v6
         with:
           name: dist
           path: dist/*
@@ -41,15 +40,18 @@ jobs:
     needs: build
     runs-on: ubuntu-latest
     environment: pypi
+
     permissions:
-      id-token: write  # OIDC for Trusted Publishing
+      id-token: write
+
     steps:
-      - uses: actions/download-artifact@v8
+      - name: Download artifacts
+        uses: actions/download-artifact@v6
         with:
           name: dist
           path: dist
+
       - name: Publish
         uses: pypa/gh-action-pypi-publish@release/v1
         with:
-          # Tolerate re-runs and overlap with manual `make publish` uploads.
           skip-existing: true

pyproject.toml

@@ -80,7 +80,6 @@ dev = [
     "ipywidgets",
     "jupyterlab>=4.6.0",
     "jupytext>=1.19.3",
-    "mypy>=1.13",
     "nbstripout>=0.9.1",
     "pre-commit>=4.5.1",
     "pyright>=1.1.410",
@@ -146,14 +145,6 @@ convention = "numpy"
 [tool.ruff.lint.per-file-ignores]
 "tests/*" = ["B", "D"]
 
-[tool.mypy]
-python_version = "3.10"
-ignore_missing_imports = true
-warn_redundant_casts = true
-warn_unused_ignores = false
-no_implicit_optional = true
-files = ["src/topo"]
-
 [tool.pyright]
 extraPaths = ["src", "notebooks"]
 
@@ -178,8 +169,9 @@ skip_covered = true
 
 [tool.uv]
 constraint-dependencies = [
-  "jupyterlab-server>=2.20.0",
-  "tornado>=6.5.7",
-  "bleach>=6.4.0",
-
+    # Security floors for Jupyter/JupyterLab transitive dependencies.
+    "jupyter-server>=2.20.0",
+    "jupyterlab-server>=2.28.0",
+    "tornado>=6.5.7",
+    "bleach>=6.4.0",
 ]