chore(ci): sync the toolchain with vramfit and saucier

[Alberto-Codes]

The docvet toolchain had drifted behind vramfit and saucier: pre-commit mirrors pinned their own ruff and uv versions apart from the lockfile, CI had no yamllint or actionlint gate, several action majors were two versions back, and the lockfile still resolved griffe>=1.0,<2 to the hollow 1.15 shim that PyPI now serves, which broke the griffe check on every fresh install. This PR brings the repo to the same lockfile-driven hook line and least-privilege workflow layout the other two repos use, and moves the griffe extra to griffelib 2.x.

• Upgrade ruff to 0.16.5, ty to 0.0.78 and pytest-randomly to 5, and add yamllint to the dev group
• Depend on griffelib>=2.2,<3 in both the griffe extra and the dev group
• Run every pre-commit tool through uv run, add a pre-push stage for coverage and uv audit, and add pre-commit-hooks basics
• Add yamllint, actionlint and workflow-level contents: read to CI; bump checkout, setup-uv, codecov, release-please, pages, setup-python and attest-action majors; replace Renovate with a grouped Dependabot schedule
• Satisfy the ruff 0.16 default rule set (121 mechanical findings) and switch 24 suppressions to ty: ignore[rule] comments

Test: pre-commit run --all-files (all 13 hooks pass), uv run pytest (1820 passed), uv run docvet check --all on a clean tree

fix(griffe): depend on griffelib 2.x instead of the hollow griffe 1.15 shim
chore(ci): run pre-commit tools from the lockfile and bump action majors

---

PR Review

Checklist

• Self-reviewed my code
• Tests pass (uv run pytest)
• Lint passes (uv run ruff check .)
• Types pass (uv run ty check)
• Breaking changes use ! in title and BREAKING CHANGE: in body

Review Focus

• setup-uv@v10.0.1 is beyond what vramfit and saucier run (both v7), and it is a full pin because setup-uv stopped publishing floating major tags at v8. The v8 to v10 breaking changes are the removed custom manifest, prune-cache defaulting to false (CI prunes explicitly already) and .tool-versions support; none apply here, but CI on this PR is the proof.
• The release-please job now fails a release cut without RELEASE_PLEASE_TOKEN, since publish.yml triggers on the tag push and a GITHUB_TOKEN tag never fires it. Confirm the secret is set before merging.
• The style commit skipped the docvet freshness hook: every touched function body is a semantics-preserving rewrite and no docstring became stale. Worth a skim of src/ in that commit.
• The ruff rule set stays at the 0.16 defaults plus E402, E501, I, D. Adopting vramfit's Sonar-adjacent set (B, SIM, PL, TRY, S, ...) surfaces 602 findings and is a separate effort.

Related

• vramfit PR 243 (run pre-commit tools from the lockfile) is the pattern this follows
• Renovate config removed: no Renovate PR ever opened here, while Dependabot has been active since June

[codecov]

Codecov Report

❌ Patch coverage is 97.91667% with 1 line in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
src/docvet/lsp.py	50.00%	1 Missing ⚠️

📢 Thoughts on this report? Let us know!

[Copilot]

🟢 Approval recommended

The changes are primarily toolchain/CI synchronization and mechanical refactors, with only minor maintainability follow-ups noted in comments.

Pull request overview

This PR updates docvet’s development and CI toolchain to match the lockfile-driven, least-privilege patterns used in related repos, while addressing the griffe dependency shim issue by switching the optional extra to griffelib 2.x.

Changes:

• Align pre-commit and CI tooling to uv.lock (run tools via uv run, add yamllint/actionlint/audit gates, and refresh workflow permissions).
• Move the griffe extra/dev dependency from griffe>=1,<2 to griffelib>=2.2,<3 and apply related internal cleanups.
• Replace Renovate with grouped weekly Dependabot updates for uv and GitHub Actions.

File summaries

File	Description
tests/unit/test_mcp.py	Test adjustments for subprocess invocation and unused return values.
tests/unit/test_docs_infrastructure.py	MkDocs nav parsing test tweak (yaml load call site).
tests/unit/test_config.py	Update type suppression comments for ty.
tests/unit/test_cli.py	Update type suppression and minor loop simplification in tests.
tests/unit/test_cli_fix.py	Test variable usage cleanup (avoid unused bindings).
tests/unit/checks/test_undocumented_init_params.py	Avoid unused local in test helper results.
tests/unit/checks/test_trivial_docstring.py	Replace list indexing with next() in symbol selection.
tests/unit/checks/test_reverse_enrichment.py	Replace list indexing with next() and unused tuple unpacking cleanup.
tests/unit/checks/test_presence.py	Avoid unused stats binding in tests.
tests/unit/checks/test_prefer_fenced_code_blocks.py	Replace list indexing with next() in symbol selection.
tests/unit/checks/test_param_agreement.py	Replace list indexing with next() in symbol selection.
tests/unit/checks/test_overload_docstring.py	Update type suppression comment for ty.
tests/unit/checks/test_missing_returns.py	Replace list indexing with next() in symbol selection.
tests/unit/checks/test_missing_deprecation.py	Param formatting and symbol selection cleanup; unused unpacking cleanup.
tests/unit/checks/test_freshness.py	Simplify diff fixture string construction.
tests/unit/checks/test_finding.py	Update type suppression comments for ty.
tests/unit/checks/test_enrichment.py	Replace list indexing with next() and update ty suppression comment.
tests/integration/test_suppression_cli.py	Subprocess invocation made explicit about non-raising behavior.
tests/integration/test_mcp.py	Update type suppression and simplify async context management.
tests/integration/test_fix_cli.py	Subprocess invocation made explicit about non-raising behavior.
tests/fixtures/missing_yields.py	Use yield from in fixture generator.
tests/fixtures/complete_module.py	Use yield from in fixture generator.
src/docvet/reporting.py	Minor loop/conditional refactors for clarity.
src/docvet/lsp.py	Update type suppression comments for ty.
src/docvet/discovery.py	Minor boolean-return refactor in exclusion matcher.
src/docvet/config/init.py	Update type suppression comments for ty.
src/docvet/cli/_suppression.py	Simplify suppression boolean return.
src/docvet/cli/_runners.py	Introduce PEP 695 type params on progressbar context manager.
src/docvet/checks/presence.py	Minor conditional refactor while computing overload lines.
src/docvet/checks/griffe_compat.py	Adjust typing around yielded griffe objects.
src/docvet/checks/freshness.py	Switch to datetime.UTC usage.
src/docvet/checks/enrichment/_forward.py	Minor return expression simplification.
src/docvet/checks/enrichment/_class_module.py	Small conditional refactors and path-suffix simplification.
src/docvet/checks/enrichment/init.py	Minor control-flow simplification and formatting changes.
src/docvet/checks/coverage.py	Deterministic representative selection using min().
src/docvet/ast_utils.py	Use removesuffix() for cleaner path normalization.
renovate.json	Remove Renovate configuration (migrate to Dependabot).
pyproject.toml	Update ruff config, add yamllint, and switch griffe extra/dev dep to griffelib.
docs/site/suppression.md	Preserve formatting of equivalence examples under formatter.
docs/site/rules/stale-signature.md	Formatting-only adjustment in docs example.
docs/site/rules/stale-import.md	Formatting-only adjustment in docs example.
docs/site/rules/overload-has-docstring.md	Update overload example formatting/structure.
docs/site/rules/missing-deprecation.md	Formatting-only adjustment in docs example.
docs/site/cli-reference.md	Formatting-only adjustment in docs example.
CONTRIBUTING.md	Update contributor guidance for new pre-commit stages and uv-run tooling.
CLAUDE.md	Update pinned attest-action version guidance.
action.yml	Bump actions/setup-python major version.
.sonarlint/connectedMode.json	Formatting (newline) normalization.
.pre-commit-config.yaml	Rework hooks to run via uv run, add pre-push gates, and add basic pre-commit-hooks.
.github/workflows/test-publish.yml	Action bumps, Python pinning, and stricter wheel contents checks.
.github/workflows/test-action.yml	Action bumps (checkout).
.github/workflows/release-please.yml	Least-privilege permissions, release token safety check, and action bumps.
.github/workflows/publish.yml	Action bumps, Python pinning, wheel content gate, and attest-action bump.
.github/workflows/docs.yml	Action bumps and uv sync --locked for docs build.
.github/workflows/codeql.yml	Add push trigger, permissions tightening, and checkout bump.
.github/workflows/ci.yml	Add workflow-level permissions, add yamllint/actionlint/audit gates, and bump actions.
.github/ISSUE_TEMPLATE/bug_report.md	Trailing whitespace cleanup.
.github/dependabot.yml	Add grouped weekly Dependabot updates for uv and GitHub Actions.
.claude/rules/pytest.md	Formatting updates to match current style/tooling expectations.

Review details

• Files reviewed: 58/60 changed files
• Comments generated: 2
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Alberto-Codes]

Addressed in latest push — _walk_objects now does cast("GriffeObject", current) after the is_alias guard and yields that, so the ty: ignore[invalid-yield] is gone. String form keeps the griffe import under TYPE_CHECKING.

[Alberto-Codes]

Addressed in latest push — removed the module-level V = TypeVar("V") and the TypeVar import; the PEP 695 parameter is the only declaration now.