GH Actions Readiness

.build-constraints.txt

@@ -0,0 +1,10 @@
+packaging==26.2 \
+    --hash=sha256:5fc45236b9446107ff2415ce77c807cee2862cb6fac22b8a73826d0693b0980e \
+    --hash=sha256:ff452ff5a3e828ce110190feff1178bb1f2ea2281fa2075aadb987c2fb221661
+    # via wheel
+setuptools==82.0.1 \
+    --hash=sha256:7d872682c5d01cfde07da7bccc7b65469d3dca203318515ada1de5eda35efbf9 \
+    --hash=sha256:a59e362652f08dcd477c78bb6e7bd9d80a7995bc73ce773050228a348ce2e5bb
+wheel==0.47.0 \
+    --hash=sha256:212281cab4dff978f6cedd499cd893e1f620791ca6ff7107cf270781e587eced \
+    --hash=sha256:cc72bd1009ba0cf63922e28f94d9d83b920aa2bb28f798a31d0691b02fa3c9b3

.github/dependabot.yml

@@ -1,11 +1,23 @@
 version: 2
 updates:
-  - package-ecosystem: "github-actions"
+  - package-ecosystem: "uv"
     directory: "/"
+    cooldown:
+      default-days: 7
+      exclude:
+        - "databricks*"
     schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 5
-    groups:
-      actions-all:
-        patterns:
-          - "*"
+      interval: "daily"
+
+  - package-ecosystem: "npm"
+    directory: "/docs/impulse"
+    cooldown:
+      default-days: 7
+    schedule:
+      interval: "daily"
+
+  # Disabled for now, pending guidance on how GHA-updates need to be handled.
+  #- package-ecosystem: "github-actions"
+  #  directory: "/"
+  #  schedule:
+  #    interval: "daily"

.github/workflows/acceptance.yml

@@ -10,75 +10,59 @@ on:
       - main
 
 permissions:
-  id-token: write
   contents: read
-  pull-requests: write
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
 jobs:
-  fmt:
-    name: Format check
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6
-
-      - name: Install UV
-        uses: astral-sh/setup-uv@v7
-
-      - name: Check formatting with Black
-        run: |
-          uv run black --check src/ tests/ --diff -v
-
   lint:
-    name: Lint check
+    name: Lint and format check
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Install UV
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@5a095e7a2014a4212f075830d4f7277575a9d098 # v7.3.1
+        with:
+          version: "0.11.2"
+          checksum: "7ac2ca0449c8d68dae9b99e635cd3bc9b22a4cb1de64b7c43716398447d42981"
 
       - name: Install dependencies
-        run: uv sync
+        run: make dev
 
-      - name: Lint with Ruff
-        run: uv run ruff check src/ tests/
+      - name: Lint and format check
+        run: make lint
 
   test:
     name: Testing
     runs-on: ubuntu-latest
-    needs: [ fmt, lint ]
+    needs: [ lint ]
+    permissions:
+      id-token: write
     strategy:
       matrix:
         python-version: [ '3.12' ]
 
     steps:
-      - uses: actions/checkout@v6
-
-      - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v6
-        with:
-          python-version: ${{ matrix.python-version }}
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Install UV
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@5a095e7a2014a4212f075830d4f7277575a9d098 # v7.3.1
         with:
           enable-cache: false
+          version: "0.11.2"
+          checksum: "7ac2ca0449c8d68dae9b99e635cd3bc9b22a4cb1de64b7c43716398447d42981"
 
-      - name: Set UV Python version
-        run: uv python pin ${{ matrix.python-version }}
-
-      - name: Install package and dependencies
-        run: uv sync
+      - name: Install dependencies
+        run: make dev
 
       - name: Run unit tests with coverage
-        run: uv run pytest tests/ --cov=src --cov-branch --cov-report=xml
+        run: make test
 
       - name: Upload coverage to Codecov
         if: matrix.python-version == '3.12'
-        uses: codecov/codecov-action@v6
+        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
         with:
-          use_oidc: true
+          use_oidc: true

.github/workflows/release.yml

@@ -7,29 +7,26 @@ on:
       - 'v[0-9]+.[0-9]+.[0-9]+-*'
 
 permissions:
-  contents: write
-  id-token: write
+  contents: read
 
 jobs:
   build:
     name: Build distribution
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-
-      - name: Set up Python
-        uses: actions/setup-python@v6
-        with:
-          python-version: '3.12'
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Install UV
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@5a095e7a2014a4212f075830d4f7277575a9d098 # v7.3.1
+        with:
+          version: "0.11.2"
+          checksum: "7ac2ca0449c8d68dae9b99e635cd3bc9b22a4cb1de64b7c43716398447d42981"
 
       - name: Build package
-        run: uv build
+        run: make build
 
       - name: Upload distribution artifacts
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: dist
           path: dist/
@@ -38,17 +35,21 @@ jobs:
     name: Create GitHub Release
     needs: build
     runs-on: ubuntu-latest
+    environment:
+      name: release
+    permissions:
+      contents: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Download distribution artifacts
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
         with:
           name: dist
           path: dist/
 
       - name: Create GitHub Release
-        uses: softprops/action-gh-release@v3
+        uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2.5.0
         with:
           generate_release_notes: true
           files: dist/*

.gitignore

@@ -18,7 +18,6 @@ env/
 .env/
 .venv/
 ENV/
-uv.lock
 
 # PyCharm files
 .idea/
@@ -52,7 +51,6 @@ logs/
 # Local development settings
 .env
 .env.local
-.python-version
 
 # macOS specific
 .DS_Store

.python-version

@@ -0,0 +1 @@
+3.12

CONTRIBUTING.md

@@ -27,17 +27,17 @@ a pull request directly.
 ```bash
 git clone https://github.com/databrickslabs/impulse.git
 cd impulse
-uv sync
+make dev
 ```
 
-`uv sync` creates a `.venv/` in the repo with all runtime and development dependencies
-(pytest, ruff, black, etc.).
+`make dev` runs `uv sync --all-extras`, which creates a `.venv/` in the repo with all
+runtime and development dependencies (pytest, ruff, black, plus pyspark/pandas/etc.
+declared as `local-dev` extras for use outside Databricks runtimes).
 
 ## Running tests
 
 ```bash
-uv run pytest                         # full suite
-uv run pytest --cov                   # with coverage report
+make test                             # full suite with coverage
 uv run pytest tests/path/to/test.py   # a single test file
 ```
 
@@ -53,36 +53,34 @@ Notes specific to Impulse:
 We use **black** for formatting and **ruff** for linting. Both are configured in
 [pyproject.toml](pyproject.toml) (line length 99, target Python 3.12).
 
-The repo includes a helper script that runs both:
+To format your code and apply ruff auto-fixes:
 
 ```bash
-./format_code.sh
+make fmt
 ```
 
-Or run them manually:
+To check formatting and lint without modifying files (what CI runs):
 
 ```bash
-uv run black src/ tests/
-uv run ruff check src/ tests/ --fix
+make lint
 ```
 
-CI ([`.github/workflows/acceptance.yml`](.github/workflows/acceptance.yml)) runs `black --check`
-and `ruff check` on every pull request, so please run `./format_code.sh` before pushing to avoid
-CI failures.
+CI ([`.github/workflows/acceptance.yml`](.github/workflows/acceptance.yml)) runs `make lint`
+on every pull request, so please run `make fmt` before pushing to avoid CI failures.
 
 ## Submitting a pull request
 
 1. Fork the repository and create a feature branch.
 2. Make your changes; add or update tests covering the new behavior.
-3. Run `./format_code.sh` and `uv run pytest` locally.
+3. Run `make fmt` and `make test` locally.
 4. Open a pull request. The [PR template](.github/pull_request_template.md) walks you through
    the summary, changes, and test plan.
 5. CI must pass (format, lint, tests). A maintainer will review the PR.
 
 ## Definition of done
 
 - [ ] New or changed behavior is covered by tests
-- [ ] `./format_code.sh` and `uv run pytest` pass locally
+- [ ] `make lint` and `make test` pass locally
 - [ ] Public APIs have NumPy-style docstrings (see ruff config in [pyproject.toml](pyproject.toml))
 - [ ] User-facing changes are reflected in [README.md](README.md) and/or `docs/impulse/`
 - [ ] PR description follows the [template](.github/pull_request_template.md)

Makefile

@@ -0,0 +1,46 @@
+all: clean lint fmt test coverage
+
+# Ensure that all uv commands don't automatically update the lock file. If UV_FROZEN=1 (from the environment)
+# then UV_LOCKED should _not_ be set, but otherwise it needs to be set to ensure the lock-file is only ever
+# deliberately updated.
+ifneq ($(UV_FROZEN),1)
+export UV_LOCKED := 1
+endif
+
+# Ensure that build-system requires are hash-verified when building.
+export UV_BUILD_CONSTRAINT := .build-constraints.txt
+
+UV_RUN := uv run --exact --all-extras
+
+clean:
+	rm -fr .venv htmlcov .pytest_cache .ruff_cache .coverage coverage.xml test-results.xml
+	find . -name '__pycache__' -print0 | xargs -0 rm -fr
+
+dev:
+	uv sync --all-extras
+
+lint:
+	$(UV_RUN) black --check src/ tests/
+	$(UV_RUN) ruff check src/ tests/
+
+fmt:
+	$(UV_RUN) black src/ tests/
+	$(UV_RUN) ruff check src/ tests/ --fix
+
+test:
+	$(UV_RUN) pytest tests/ --cov=src --cov-branch --cov-report=xml
+
+coverage:
+	$(UV_RUN) pytest tests/ --cov=src --cov-branch --cov-report=html
+	open htmlcov/index.html
+
+build:
+	uv build --require-hashes --build-constraints=.build-constraints.txt
+
+lock-dependencies: UV_LOCKED := 0
+lock-dependencies:
+	uv lock
+	printf 'setuptools>=61.0\nwheel\n' | uv pip compile --generate-hashes --universal --no-header --quiet - > .build-constraints.txt
+
+.DEFAULT: all
+.PHONY: all clean dev lint fmt test coverage build lock-dependencies

docs/impulse/package.json

@@ -17,24 +17,24 @@
   "dependencies": {
     "@docusaurus/core": "3.9.2",
     "@docusaurus/preset-classic": "3.9.2",
-    "@docusaurus/theme-mermaid": "^3.9.2",
-    "@mdx-js/react": "^3.0.0",
-    "clsx": "^2.0.0",
-    "docusaurus-lunr-search": "^3.6.1",
-    "lucide-react": "^0.471.1",
-    "prism-react-renderer": "^2.3.0",
-    "react": "^19.0.0",
-    "react-dom": "^19.0.0"
+    "@docusaurus/theme-mermaid": "3.9.2",
+    "@mdx-js/react": "3.1.1",
+    "clsx": "2.1.1",
+    "docusaurus-lunr-search": "3.6.1",
+    "lucide-react": "0.471.2",
+    "prism-react-renderer": "2.4.1",
+    "react": "19.2.4",
+    "react-dom": "19.2.4"
   },
   "devDependencies": {
     "@docusaurus/module-type-aliases": "3.9.2",
     "@docusaurus/tsconfig": "3.9.2",
     "@docusaurus/types": "3.9.2",
-    "@tailwindcss/typography": "^0.5.16",
-    "autoprefixer": "^10.4.20",
-    "postcss": "^8.5.1",
-    "tailwindcss": "^3.4.17",
-    "typescript": "~5.6.2"
+    "@tailwindcss/typography": "0.5.19",
+    "autoprefixer": "10.4.24",
+    "postcss": "8.5.6",
+    "tailwindcss": "3.4.19",
+    "typescript": "5.6.3"
   },
   "browserslist": {
     "production": [