Use renovate instead of dependabot

.github/linters/.megalinter.yml

@@ -7,7 +7,6 @@ DISABLE:
   - SPELL
 DISABLE_ERRORS_LINTERS:
   - COPYPASTE_JSCPD
-  - REPOSITORY_KICS
 
 FLAVOR_SUGGESTIONS: false
 GITHUB_COMMENT_REPORTER: true

.github/renovate.json5

@@ -0,0 +1,71 @@
+{
+  $schema: "https://docs.renovatebot.com/renovate-schema.json",
+  extends: [
+    // See: https://docs.renovatebot.com/presets-config/#configbest-practices
+    "config:recommended",
+    "helpers:pinGitHubActionDigests",
+    ":configMigration",
+    ":pinDevDependencies",
+    "abandonments:recommended",
+    ":maintainLockFilesWeekly",
+  ],
+
+  enabledManagers: ["github-actions", "pep621", "pre-commit"],
+  "pre-commit": {
+    enabled: true,
+  },
+
+  timezone: "Europe/Copenhagen",
+  schedule: ["* 0-5 1 * *"], // First day of the month before 6am.
+
+  minimumReleaseAge: "7 days",
+  internalChecksFilter: "strict",
+
+  prHourlyLimit: 0,
+  prConcurrentLimit: 0,
+
+  labels: ["dependencies"],
+  semanticCommits: "disabled",
+  separateMajorMinor: false,
+
+  suppressNotifications: ["prEditedNotification"],
+
+  packageRules: [
+    // Pin github-actions to immutable SHAs.
+    {
+      matchDepTypes: ["action"],
+      pinDigests: true,
+    },
+    // Annotate github-actions SHAs with a SemVer version.
+    {
+      extends: ["helpers:pinGitHubActionDigests"],
+      extractVersion: "^(?<version>v?\\d+\\.\\d+\\.\\d+)$",
+      versioning: "regex:^v?(?<major>\\d+)(\\.(?<minor>\\d+)\\.(?<patch>\\d+))?$",
+    },
+    // Disable github-actions minimum release age for our own actions.
+    {
+      matchManagers: ["github-actions"],
+      matchPackageNames: ["daniel-mizsak/workflows"],
+      minimumReleaseAge: null,
+    },
+    // Group github-actions dependencies in a single PR.
+    {
+      groupName: "Dependencies for github-actions",
+      matchManagers: ["github-actions"],
+    },
+    // Group pep621 dependencies in a single PR.
+    {
+      groupName: "Dependencies for pep621",
+      matchManagers: ["pep621"],
+    },
+    // Group pre-commit dependencies in a single PR.
+    {
+      groupName: "Dependencies for pre-commit",
+      matchManagers: ["pre-commit"],
+    },
+  ],
+
+  vulnerabilityAlerts: {
+    labels: ["dependencies", "security"],
+  },
+}

.github/workflows/cd.yml

@@ -15,7 +15,6 @@ jobs:
     permissions:
       contents: read
       pull-requests: write
-      actions: write
       id-token: write
 
   github-pages-publish:
@@ -30,7 +29,7 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v5.0.0
+        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0
         with:
           artifact_name: site
 
@@ -43,10 +42,10 @@ jobs:
       id-token: write
     steps:
       - name: Download build artifacts
-        uses: actions/download-artifact@v8.0.1
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: dist
           path: dist
 
       - name: Publish build artifacts to PyPI
-        uses: pypa/gh-action-pypi-publish@v1.13.0
+        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0

.github/workflows/ci.yml

@@ -21,20 +21,24 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  prek:
+    permissions:
+      contents: read
+    uses: daniel-mizsak/workflows/.github/workflows/prek.yml@1a10f29ef1289f7f1c82e896f9307e701b6c7a77 # v2.1.0
+
   lint:
     permissions:
       contents: read
       pull-requests: write
-    uses: daniel-mizsak/workflows/.github/workflows/lint.yml@v1
+    uses: daniel-mizsak/workflows/.github/workflows/lint.yml@1a10f29ef1289f7f1c82e896f9307e701b6c7a77 # v2.1.0
     with:
       megalinter-config: "./.github/linters/.megalinter.yml"
 
   ci:
     permissions:
-      contents: read # checkout
-      actions: write # upload-artifact
-      id-token: write # codecov-action
-    uses: daniel-mizsak/workflows/.github/workflows/python-ci.yml@v1
+      contents: read
+      id-token: write
+    uses: daniel-mizsak/workflows/.github/workflows/python-ci.yml@1a10f29ef1289f7f1c82e896f9307e701b6c7a77 # v2.1.0
     with:
       package-version: ${{ inputs.package-version }}
       python-version: "3.12"

.github/workflows/stale.yml

@@ -14,7 +14,7 @@ jobs:
       issues: write
       pull-requests: write
     steps:
-      - uses: actions/stale@v10.2.0
+      - uses: actions/stale@b5d41d4e1d5dceea10e7104786b73624c18a190f # v10.2.0
         with:
           stale-issue-message: "This issue is stale because it has been open 30 days with no activity. Remove stale label or comment or this will be closed in 5 days."
           stale-pr-message: "This PR is stale because it has been open 45 days with no activity. Remove stale label or comment or this will be closed in 10 days."

.pre-commit-config.yaml

@@ -2,16 +2,14 @@
 # See https://pre-commit.com for more information
 # See https://pre-commit.com/hooks.html for more hooks
 
-# exclude: ""
+# See https://prek.j178.dev to learn about prek
 
-# pre-commit ci
-ci:
-  autoupdate_schedule: monthly
+# exclude: ""
 
 # pre-commit
 repos:
   - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v6.0.0
+    rev: 3e8a8703264a2f4a69428a0aa4dcb512790b2c8c # frozen: v6.0.0
     hooks:
       - id: check-added-large-files
         args: [--maxkb=2000, --enforce-all]
@@ -29,32 +27,38 @@ repos:
 
   # actionlint
   - repo: https://github.com/rhysd/actionlint
-    rev: v1.7.12
+    rev: 914e7df21a07ef503a81201c76d2b11c789d3fca # frozen: v1.7.12
     hooks:
       - id: actionlint
 
+  # zizmor
+  - repo: https://github.com/zizmorcore/zizmor-pre-commit
+    rev: a4727cbbcd26d7098e96b9cb738169b59711ae51 # frozen: v1.24.1
+    hooks:
+      - id: zizmor
+
   # yamllint
   - repo: https://github.com/adrienverge/yamllint.git
-    rev: v1.38.0
+    rev: cba56bcde1fdd01c1deb3f945e69764c291a6530 # frozen: v1.38.0
     hooks:
       - id: yamllint
         args: [--config-file=.github/linters/.yamllint.yml, --strict]
 
   # gitleaks
   - repo: https://github.com/gitleaks/gitleaks
-    rev: v8.30.0
+    rev: 83d9cd684c87d95d656c1458ef04895a7f1cbd8e # frozen: v8.30.1
     hooks:
       - id: gitleaks
 
   # codespell
   - repo: https://github.com/codespell-project/codespell
-    rev: v2.4.2
+    rev: 2ccb47ff45ad361a21071a7eedda4c37e6ae8c5a # frozen: v2.4.2
     hooks:
       - id: codespell
 
   # ruff
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.15.9
+    rev: b831c3dc5d27d9da294ae4e915773b99aa24a7c5 # frozen: v0.15.10
     hooks:
       - id: ruff-check
       - id: ruff-format

Justfile

@@ -64,7 +64,7 @@ megalinter:
 
 [group("qa-extra")]
 pre-commit:
-    uv run pre-commit run --all-files
+    uv run prek run --all-files
 
 [group("build")]
 build-documentation:

pyproject.toml

@@ -1,6 +1,6 @@
 # Build System
 [build-system]
-  requires = ["uv_build"]
+  requires = ["uv_build>=0.11.3,<0.12"]
   build-backend = "uv_build"
 
 # Project Metadata
@@ -19,16 +19,23 @@
     "Programming Language :: Python :: 3.14",
   ]
   requires-python = ">=3.12"
-  dependencies = ["numpy==2.4.4"]
+  dependencies = ["numpy>=2.4.4"]
 
   [project.urls]
     Repository = "https://github.com/daniel-mizsak/python-package-template/"
     Documentation = "https://daniel-mizsak.github.io/python-package-template/"
     Issues = "https://github.com/daniel-mizsak/python-package-template/issues/"
 
 [dependency-groups]
-  dev = ["coverage", "nox", "pre-commit", "pytest", "ruff", "ty"]
-  docs = ["zensical", "mkdocstrings-python"]
+  dev = [
+    "coverage==7.13.5",
+    "nox==2026.4.10",
+    "prek==0.3.9",
+    "pytest==9.0.3",
+    "ruff==0.15.10",
+    "ty==0.0.31",
+  ]
+  docs = ["zensical==0.0.33", "mkdocstrings-python==2.0.3"]
 
 # Tools
 # Uv