chore(tooling): improve linting, CI caching, and maintenance automation

.github/dependabot.yml

@@ -3,14 +3,14 @@ updates:
   - package-ecosystem: "uv"
     directory: "/"
     schedule:
-      interval: "daily"
+      interval: "weekly"
       time: "08:00"
     open-pull-requests-limit: 10
 
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
-      interval: "daily"
+      interval: "weekly"
       time: "08:00"
     open-pull-requests-limit: 10
 

.github/workflows/lint.yaml

@@ -20,6 +20,9 @@ jobs:
 
       - name: Install uv
         uses: astral-sh/setup-uv@v7
+        with:
+          enable-cache: true
+          cache-suffix: ${{ matrix.python-version }}
 
       - name: Set up Python ${{ matrix.python-version }}
         uses: actions/setup-python@v6

.github/workflows/release.yml

@@ -30,10 +30,10 @@ jobs:
       - name: Retrieve version from tag name
         id: retrieve-version
         run: |
-            tag=${{ github.event.release.tag_name }}
-            version_number=${tag#?}
-            echo version: $version_number
-            echo "version=$version_number" >> $GITHUB_OUTPUT
+            tag="${{ github.event.release.tag_name }}"
+            version_number="${tag#?}"
+            echo "version: $version_number"
+            echo "version=$version_number" >> "$GITHUB_OUTPUT"
 
       - name: Bump project version in pyproject.toml and commit changes to current branch and tag
         run: |

.github/workflows/test.yml

@@ -20,6 +20,9 @@ jobs:
 
       - name: Install uv
         uses: astral-sh/setup-uv@v7
+        with:
+          enable-cache: true
+          cache-suffix: ${{ matrix.python-version }}
 
       - name: Set up Python ${{ matrix.python-version }}
         uses: actions/setup-python@v6

.pre-commit-config.yaml

@@ -22,6 +22,10 @@ repos:
     -   id: no-commit-to-branch
         stages: [pre-commit]
         args: [--branch, main]
+-   repo: https://github.com/rhysd/actionlint
+    rev: v1.7.7
+    hooks:
+    -   id: actionlint
 -   repo: local
     hooks:
       - id: mypy

pyproject.toml

@@ -29,7 +29,6 @@ repository = "https://github.com/iMicknl/python-overkiz-api"
 
 [dependency-groups]
 dev = [
-    "tox<5.0.0,>=4.17.1",
     "pytest>=8.3.2,<10.0.0",
     "pytest-cov>=5,<8",
     "pre-commit<5.0,>=3.8",
@@ -44,7 +43,7 @@ select = [
     # pydocstyle
     "D",
     # flake8-async
-    # "ASYNC",
+    "ASYNC",
     # pycodestyle
     "E",
     # Pyflakes
@@ -59,9 +58,25 @@ select = [
     "I",
     # ruff
     "RUF",
+    # flake8-bandit (security)
+    "S",
+    # flake8-print
+    "T",
+    # flake8-comprehensions
+    "C4",
 ]
 ignore = ["E501"] # Line too long
 
+[tool.ruff.lint.per-file-ignores]
+# Tests: S101 (assert) is expected, ASYNC230 (blocking open) is acceptable for fixtures
+"tests/**/*.py" = ["S101", "ASYNC230"]
+# S105: OAuth client secrets are public by design (embedded in mobile apps)
+"pyoverkiz/const.py" = ["S105"]
+# S105: Enum values contain "TOKEN" or "PASS" in API names, not passwords
+"pyoverkiz/enums/*.py" = ["S105"]
+# Utility scripts can use print
+"utils/**/*.py" = ["T201"]
+
 [tool.ruff.lint.pydocstyle]
 convention = "google"  # Accepts: "google", "numpy", or "pep257".