Update build dependencies

.config/ruff.toml

@@ -8,16 +8,21 @@ line-length = 200
 
 exclude = ["docs"]
 
+# corpus_test/generate_report.py only runs on the newest Python in CI,
+# unlike generate_results.py which runs on every supported version
+[per-file-target-version]
+"corpus_test/generate_report.py" = "py314"
+
 [lint]
-# Enable most rules
-select = [
+# The default ruleset is the starting point.
+# extend-select adds rule groups that are not (fully) enabled by default.
+# F (Pyflakes) and YTT (flake8-2020) were previously selected and are now fully enabled by default.
+extend-select = [
     "E",    # pycodestyle errors
     "W",    # pycodestyle warnings
-    "F",    # Pyflakes
     "I",    # isort
     "S",    # flake8-bandit (security)
     "ERA",  # eradicate (commented-out code)
-    "YTT",  # flake8-2020 (sys.version checks)
     "FBT",  # flake8-boolean-trap (boolean positional arguments)
     "A",    # flake8-builtins (shadowing builtins)
     "COM",  # flake8-commas (trailing commas)
@@ -33,16 +38,28 @@ ignore = [
     "S307",  # Use of eval() - intentional and safe in this codebase (constant folding, validation)
     "FBT002",  # Boolean default positional arguments - API design choice throughout codebase
     "COM812",  # Missing trailing comma - we prohibit trailing commas instead
+    "UP",  # pyupgrade suggests Python 3 only syntax - the codebase must remain Python 2.7 compatible
+    "BLE001",  # Catching Exception is intentional - transforms and candidate generation fall back on any error
+    "SIM102",  # Nested if statements separate node-type guards from attribute conditions - deliberate style
+    "SIM103",  # Guard clause chains deliberately end with a constant return rather than returning the last condition
+    "SIM114",  # Exhaustive branches per AST node type are deliberate, keeping dispatch readable and symmetric
 ]
 
 # Per-file ignores for specific compatibility needs
 [lint.per-file-ignores]
-# AST compatibility module needs star imports and shadows Ellipsis builtin for Python version compatibility
-"src/python_minifier/ast_compat.py" = ["F403", "F405", "A001"]
+# AST compatibility module needs star imports, shadows the Ellipsis builtin for Python version
+# compatibility, and forwards constructor arguments after a keyword argument in compat node classes
+"src/python_minifier/ast_compat.py" = ["F403", "F405", "A001", "B026"]
 
 # __init__.py files intentionally re-export for public API
 "*/__init__.py" = ["F401"]
 
+# The documented public API takes an options object as a default argument, evaluated once at import
+"src/python_minifier/__init__.py" = ["B008"]
+
+# A shared sentinel instance as a default argument is intentional
+"src/python_minifier/ast_annotation/__init__.py" = ["B008"]
+
 # Type comparisons needed for Python 2.7 compatibility in specific files
 "src/python_minifier/ast_compare.py" = ["E721"]
 "src/python_minifier/rename/rename_literals.py" = ["E721"]
@@ -51,13 +68,19 @@ ignore = [
 # Compatibility imports in utility modules
 "src/python_minifier/rename/util.py" = ["F401"]
 
+# AssertionError for unreachable AST node types is an internal invariant check, not caller type validation
+"src/python_minifier/rename/binding.py" = ["TRY004"]
+
 # Broad exception handling needed for candidate generation (try different quote styles)
 "src/python_minifier/f_string.py" = ["S112"]
 "src/python_minifier/t_string.py" = ["S112"]
 
 # random.choice() used for variable name generation, not cryptography
 "src/python_minifier/rename/name_generator.py" = ["S311"]
 
+# Standalone CI script that deliberately logs through the root logger
+"corpus_test/generate_results.py" = ["LOG015"]
+
 # Test files need exec() to validate minified code behavior and subprocess calls for integration tests
 "test/**/*.py" = ["S102", "S603"]
 

.github/workflows/create_draft_release.yaml

@@ -29,7 +29,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout
-        uses: actions/checkout@v4.2.2
+        uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 1
           show-progress: false
@@ -65,14 +65,14 @@ jobs:
           echo "wheel=$(find dist -name '*-py3-*.whl' -printf "%f\n")" >> "$GITHUB_OUTPUT"
 
       - name: Upload sdist artifact
-        uses: actions/upload-artifact@v4.4.3
+        uses: actions/upload-artifact@v7.0.1
         with:
           name: dist-sdist
           path: dist/${{ steps.package.outputs.sdist }}
           if-no-files-found: error
 
       - name: Upload Python 3 wheel artifact
-        uses: actions/upload-artifact@v4.4.3
+        uses: actions/upload-artifact@v7.0.1
         with:
           name: dist-py3-wheel
           path: dist/${{ steps.package.outputs.wheel }}
@@ -88,7 +88,7 @@ jobs:
       image: danielflook/python-minifier-build:python2.7-2025-09-26
     steps:
       - name: Download source distribution artifact
-        uses: actions/download-artifact@v4.1.8
+        uses: actions/download-artifact@v7.0.0
         with:
           name: dist-sdist
           path: dist/
@@ -104,7 +104,7 @@ jobs:
           echo "wheel=$(find dist -name '*-py2-*.whl' -printf "%f\n")" >> "$GITHUB_OUTPUT"
 
       - name: Upload Python 2 wheel artifact
-        uses: actions/upload-artifact@v4.4.3
+        uses: actions/upload-artifact@v7.0.1
         with:
           name: dist-py2-wheel
           path: dist/${{ steps.package.outputs.wheel }}
@@ -119,7 +119,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/download-artifact@v4.1.8
+      - uses: actions/download-artifact@v7.0.0
         with:
           name: dist-sdist
           path: dist/
@@ -132,7 +132,7 @@ jobs:
           pyminify --version
 
       - name: Checkout
-        uses: actions/checkout@v4.2.2
+        uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 1
           show-progress: false
@@ -144,7 +144,7 @@ jobs:
           sphinx-build docs/source /tmp/build
 
       - name: Upload documentation artifact
-        uses: actions/upload-pages-artifact@v3.0.1
+        uses: actions/upload-pages-artifact@v5.0.0
         with:
           path: /tmp/build
 
@@ -161,14 +161,14 @@ jobs:
         package_type: [sdist, wheel]
     steps:
       - name: Checkout
-        uses: actions/checkout@v4.2.2
+        uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 1
           show-progress: false
           persist-credentials: false
 
       - name: Download distribution artifacts
-        uses: actions/download-artifact@v4.1.8
+        uses: actions/download-artifact@v7.0.0
         with:
           pattern: dist-*
           path: dist/
@@ -220,7 +220,7 @@ jobs:
       image: danielflook/python-minifier-build:python3.14-2025-09-26
     steps:
       - name: Download distribution artifacts
-        uses: actions/download-artifact@v4.1.8
+        uses: actions/download-artifact@v7.0.0
         with:
           pattern: dist-*
           path: dist/
@@ -238,7 +238,7 @@ jobs:
           fi
 
       - name: Checkout
-        uses: actions/checkout@v4.2.2
+        uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 1
           show-progress: false
@@ -271,7 +271,7 @@ jobs:
       release_id: ${{ steps.create_release.outputs.release_id }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4.2.2
+        uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 1
           show-progress: false
@@ -307,7 +307,7 @@ jobs:
           echo "release_id=$untagged_id" >> "$GITHUB_OUTPUT"
 
       - name: Download distribution artifacts
-        uses: actions/download-artifact@v4.1.8
+        uses: actions/download-artifact@v7.0.0
         with:
           pattern: dist-*
           path: dist/

.github/workflows/release.yaml

@@ -38,7 +38,7 @@ jobs:
       url: https://pypi.org/project/python-minifier/${{ inputs.version }}
     steps:
       - name: Download distribution artifacts
-        uses: actions/download-artifact@v4.1.8
+        uses: actions/download-artifact@v7.0.0
         with:
           pattern: dist-*
           path: dist/
@@ -58,13 +58,14 @@ jobs:
     permissions:
       pages: write
       id-token: write
+      actions: read
     environment:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v4.0.5
+        uses: actions/deploy-pages@v5.0.0
 
   publish_release:
     name: Publish Release

.github/workflows/release_test.yaml

@@ -18,7 +18,7 @@ jobs:
       image: danielflook/python-minifier-build:python3.14-2025-09-26
     steps:
       - name: Checkout
-        uses: actions/checkout@v4.2.2
+        uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 0
           show-progress: false
@@ -41,3 +41,15 @@ jobs:
       contents: write
     with:
       release_version: ${{ needs.determine_version.outputs.release_version }}
+
+  release-tests-passed:
+    # Aggregate gate for branch protection.
+    name: Release Tests Passed
+    runs-on: ubuntu-24.04
+    needs: [determine_version, create_draft_release]
+    if: ${{ always() }}
+    steps:
+      - name: Verify all jobs succeeded
+        if: ${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') || contains(needs.*.result, 'skipped') }}
+        run: |
+          exit 1