Python maintenance

[reweeden]

• Update Actions versions
• Update project build to use uv / pyproject.toml
• Add ruff formatting
• Update type annotations

Pull Request Checklist

I have:

• performed a self review of my code I&A code style
  • Resources and Data Structures are sorted by ABC or a defined sorting pattern
• updated the documentation accordingly
• verified required action checks are passing
• deployed my code and all new and existing E2E/Integration tests passed
• bumped the version number as appropriate

In general, the fix is to explicitly declare the minimal required GITHUB_TOKEN permissions in the workflow, either at the workflow root (applied to all jobs) or per job. Since both jobs only require read access to repository contents, we can set permissions: contents: read at the top level so both flake8 and ruff-format jobs inherit it.

The best fix without changing functionality is to add a root-level permissions block right after the on: section in .github/workflows/lint.yml. This will constrain the GITHUB_TOKEN for all jobs to read-only repository contents, matching the CodeQL suggestion. No imports or additional methods are needed; this is purely a YAML configuration change.

Concretely, in .github/workflows/lint.yml, after line 3 (pull_request:) and before line 5 (jobs:), insert:

permissions:
  contents: read

This documents and enforces least-privilege permissions for the workflow.

[gjclark]

Doesn't it though? >.<

permissions:
  contents: read

[Cameronsplaze]

Why only 3.10? It's almost EoL

[Cameronsplaze]

Same here