Merge branch 'main' into dependabot/uv/ipykernel-7.3.0

Author: Panadestein

.github/workflows/deploy.yml

@@ -19,8 +19,8 @@ on:
     types:
       - opened
       - reopened
-      - synchronize # when new commits are pushed to the PR
-      - ready_for_review # when the PR is un-drafted
+      - synchronize
+      - ready_for_review
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -39,11 +39,15 @@ jobs:
         with:
           fetch-depth: 0  # such that setuptools_scm can do its job correctly
 
+      - name: Install the latest version of uv
+        uses: astral-sh/setup-uv@v7
+        with:
+          enable-cache: true
+
       - name: Build SDist and Wheel
         run: |
-          pipx install uv
-
-          pipx run build --verbose --sdist --wheel --installer=uv
+          # the `build` package's console script is `pyproject-build`, not `build`
+          uvx --from build pyproject-build --verbose --sdist --wheel --installer=uv
 
       - uses: actions/upload-artifact@v7
         with:

.github/workflows/test.yml

@@ -192,6 +192,11 @@ jobs:
     name: "Publish Tests Results"
     needs: test
     runs-on: ubuntu-latest
+
+    # exposed at job level so the scan step can test for its presence in `if`
+    env:
+      SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+
     permissions:
       checks: write
 
@@ -218,10 +223,11 @@ jobs:
           merge-multiple: true
 
       - name: SonarQube Scan
+        # forks and unconfigured checkouts have no token; skip rather than fail
+        if: ${{ env.SONAR_TOKEN != '' }}
         uses: SonarSource/sonarqube-scan-action@v8
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}  # Needed to get PR information, if any
-          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
 
       - name: Publish Test Results
         uses: EnricoMi/publish-unit-test-result-action@v2

CLA.md

@@ -1,10 +1,5 @@
 # Contributor License Agreement
 
-> **Status: draft — must be reviewed and approved by Algorithmiq's legal
-> counsel before the repository is made public.** The text below follows the
-> structure of the Apache Software Foundation Individual CLA v2.2 and is
-> provided as a starting point, not as legal advice.
-
 Thank you for your interest in contributing to `src_method` ("the Project"),
 maintained by Algorithmiq Ltd. ("Algorithmiq"). This Contributor License
 Agreement ("Agreement") documents the rights granted by contributors to