[SLA] Find Plasma Potential via dI/dV

.github/SECURITY.md

@@ -0,0 +1,46 @@
+# PlasmaPy Security Policy
+
+<!-- This sets up the security policy on GitHub. Changes to security practices may need to be made in the GitHub settings for the project. -->
+
+## Supported versions
+
+Security updates will only be provided for the most recent release of PlasmaPy.
+
+| Version | Supported |
+| ------- | --------- |
+| latest  | ✅        |
+| older   | ❌        |
+
+## Reporting security vulnerabilities
+
+Please use this link to [privately report a security vulnerability].
+
+## Finding security vulnerabilities via continuous integration
+
+PlasmaPy has an extensive suite of continuous integration checks,
+including several that identify and flag common security vulnerabilities.
+
+- [`zizmor`] finds security vulnerabilities in the GitHub workflows.
+- [`ruff`] has several [rule sets] that find security vulnerabilities,
+  including the [`flake8-bandit` rule set].
+
+The checks are usually either run as [`pre-commit`] hooks
+(defined in [`.pre-commit-config.yaml`])
+or as [Nox] sessions (defined in [`noxfile.py`])
+invoked during GitHub workflows (located in [`.github/workflows/`]).
+The configurations for most of these tools are located in [`pyproject.toml`],
+but some have a dedicated configuration file
+(for `zizmor`, this would be at [`.github/zizmor.yml`])
+
+[nox]: https://nox.thea.codes
+[privately report a security vulnerability]: https://github.com/plasmapy/plasmapy/security/advisories/new
+[rule sets]: https://docs.astral.sh/ruff/rules
+[`.github/workflows/`]: https://github.com/PlasmaPy/PlasmaPy/tree/main/.github/workflows
+[`.github/zizmor.yml`]: https://github.com/PlasmaPy/PlasmaPy/blob/main/.github/zizmor.yml
+[`.pre-commit-config.yaml`]: https://github.com/PlasmaPy/PlasmaPy/blob/main/.pre-commit-config.yaml
+[`flake8-bandit` rule set]: https://docs.astral.sh/ruff/rules/#flake8-bandit-s
+[`noxfile.py`]: https://github.com/PlasmaPy/PlasmaPy/blob/main/noxfile.py
+[`pre-commit`]: https://pre-commit.com/
+[`pyproject.toml`]: https://github.com/PlasmaPy/PlasmaPy/blob/main/pyproject.toml
+[`ruff`]: https://docs.astral.sh/ruff
+[`zizmor`]: https://github.com/woodruffw/zizmor

.github/labeler.yml

@@ -104,6 +104,14 @@ maintenance:
       'licenses/**',
     ]
 
+security:
+  - changed-files:
+    - any-glob-to-any-file: [
+      '**/*security*',
+      '**/*SECURITY*',
+      '**/*zizmor*',
+    ]
+
 notebooks:
   - changed-files:
     - any-glob-to-any-file: [
@@ -189,8 +197,6 @@ release:
   - changed-files:
     - any-glob-to-any-file: [
       '.github/workflows/*weekly*.yml',
-      'docs/conf.py',
-      'noxfile.py',
     ]
 
 'static type checking':

.github/scripts/citation_updater.py

@@ -1,3 +1,8 @@
+# /// script
+# requires-python = ">=3.13"
+# dependencies = [ "ruamel.yaml" ]
+# ///
+
 """Functionality to update citation information prior to making a release."""
 
 import argparse

.github/workflows/changelog.yml

@@ -25,7 +25,7 @@ jobs:
     steps:
 
     - name: Add no changelog label
-      uses: actions/github-script@v7
+      uses: actions/github-script@v8
       with:
         github-token: ${{ secrets.GITHUB_TOKEN }}
         script: |

.github/workflows/check-author-included.yml

@@ -13,12 +13,12 @@ jobs:
     steps:
 
     - name: Checkout code
-      uses: actions/checkout@v4
+      uses: actions/checkout@v5
       with:
         persist-credentials: false
 
     - name: Install uv
-      uses: astral-sh/setup-uv@v6
+      uses: astral-sh/setup-uv@v7
       with:
         enable-cache: true
         cache-suffix: author-cff

.github/workflows/ci.yml

@@ -49,9 +49,9 @@ jobs:
           python: '3.11'
           nox_session: tests-3.11(lowest-direct-skipslow)
 
-        - name: Documentation, Python 3.12, Ubuntu
+        - name: Documentation, Python 3.13, Ubuntu
           os: ubuntu-latest
-          python: '3.12'
+          python: '3.13'
           nox_session: docs
 
         - name: Static type checking with mypy, Python 3.13, Ubuntu
@@ -82,7 +82,7 @@ jobs:
     steps:
 
     - name: Checkout code
-      uses: actions/checkout@v4
+      uses: actions/checkout@v5
       with:
         persist-credentials: false
 
@@ -98,14 +98,14 @@ jobs:
         sudo apt-get install -y pandoc
 
     - name: Install uv
-      uses: astral-sh/setup-uv@v6
+      uses: astral-sh/setup-uv@v7
       with:
         python-version: ${{ matrix.python }}
-        enable-cache: true
+        enable-cache: true  # zizmor: ignore[cache-poisoning]
         cache-suffix: ${{ matrix.nox_session }}-${{ matrix.python }}-${{ runner.os }}
 
     - name: Run the check
-      run: uv run --with nox --frozen nox -s '${{ matrix.nox_session }}'
+      run: uvx nox -s '${{ matrix.nox_session }}'
 
     - name: Upload coverage reports to Codecov
       if: ${{ contains(matrix.nox_session, 'cov') }}

.github/workflows/comment-on-pr.yml

@@ -13,7 +13,7 @@ jobs:
 
     steps:
 
-    - uses: actions/github-script@v7
+    - uses: actions/github-script@v8
       with:
         script: |
           github.rest.issues.createComment({

.github/workflows/create-release-issue.yml

@@ -14,7 +14,7 @@ jobs:
 
     steps:
     - name: Checkout code
-      uses: actions/checkout@v4
+      uses: actions/checkout@v5
       with:
         persist-credentials: false
 

.github/workflows/labeler.yml

@@ -11,6 +11,6 @@ jobs:
       pull-requests: write
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/labeler@v5
+    - uses: actions/labeler@v6
       with:
         configuration-path: .github/labeler.yml

.github/workflows/linkcheck.yml

@@ -27,7 +27,7 @@ jobs:
     steps:
 
     - name: Checkout code
-      uses: actions/checkout@v4
+      uses: actions/checkout@v5
       with:
         persist-credentials: false
 
@@ -41,12 +41,12 @@ jobs:
         sudo apt-get install -y pandoc
 
     - name: Install uv
-      uses: astral-sh/setup-uv@v6
+      uses: astral-sh/setup-uv@v7
       with:
-        python: 3.12
+        python-version: 3.12
 
     - name: Install graphviz & pandoc
       run: sudo apt-get install graphviz pandoc
 
     - name: Check hyperlinks
-      run: uv run --with nox --frozen nox -s linkcheck
+      run: uvx nox -s linkcheck

.github/workflows/prepare-release-pr.yml

@@ -0,0 +1,83 @@
+name: Prepare a release
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: Version
+        required: true
+        default: 2025.8.0
+      doi:
+        description: Reserved DOI from Zenodo
+        required: true
+        default: 10.5281/zenodo.16747747
+
+jobs:
+  create-pull-request:
+    name: Create pull request
+    runs-on: ubuntu-latest
+
+    steps:
+
+    - name: Validate version input
+      run: |
+        if [[ ! ${VERSION} =~ ^2[0-9]{3}\.[0-9]+\.[0-9]+$ ]]; then
+        echo "::error ::Provide a calendar version like `2025.8.0`"
+        exit 1
+        fi
+      env:
+        VERSION: ${{ github.event.inputs.version }}
+
+    - name: Validate DOI input
+      run: |
+        if [[ ! ${DOI} =~ ^10\.[0-9]{4,9}/.*$ ]]; then
+        echo "::error ::Provide a valid DOI reserved from Zenodo."
+        exit 1
+        fi
+      env:
+        DOI: ${{ github.event.inputs.doi }}
+
+    - name: Checkout code
+      uses: actions/checkout@v5
+      with:
+        persist-credentials: false
+
+    - name: Install uv
+      uses: astral-sh/setup-uv@v7
+
+    - name: Update version and DOI in CITATION.cff and docs/about/citation.rst
+      run: |
+        uv run .github/scripts/citation_updater.py CITATION.cff docs/about/citation.rst docs/changelog/index.rst --version=$VERSION --doi=$DOI
+      env:
+        VERSION: ${{ github.event.inputs.version }}
+        DOI: ${{ github.event.inputs.doi }}
+
+    - name: Build the changelog with towncrier
+      run: |
+        uvx nox -s "changelog(final)" -- $VERSION
+      env:
+        VERSION: ${{ github.event.inputs.version }}
+
+    # When a PR is created by a GitHub Action, normally the checks will
+    # not be run. While the simplest workaround would have been to open
+    # and close the PR, an alternative is to authenticate with GitHub
+    # App generated tokens (as done below). The instructions for how to
+    # do this are in the documentation for the create-pull-request
+    # action.
+
+    - name: Generate token
+      uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a # v2.1.0
+      id: generate_token
+      with:
+        app_id: ${{ secrets.APP_ID }}
+        private_key: ${{ secrets.APP_PRIVATE_KEY }}
+
+    - name: Create pull request
+      uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8
+      with:
+        title: Build changelog and update package metadata prior to a release
+        commit-message: Build changelog & update citation info
+        body: This automated pull request builds the changelog with towncrier and updates package metadata prior to a forthcoming release. Merge this pull request prior to drafting the release.
+        labels: skip changelog checks
+        delete-branch: true
+        token: ${{ steps.generate_token.outputs.token }}

.github/workflows/publish-to-pypi.yml

@@ -15,12 +15,12 @@ jobs:
     steps:
 
     - name: Checkout code
-      uses: actions/checkout@v4
+      uses: actions/checkout@v5
       with:
         persist-credentials: false
 
     - name: Set up Python
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@v6
       with:
         python-version: 3.13
 
@@ -33,7 +33,7 @@ jobs:
       run: python -m build
 
     - name: Upload package to PyPI
-      uses: pypa/gh-action-pypi-publish@v1.12.4
+      uses: pypa/gh-action-pypi-publish@v1.13.0
       with:
         user: __token__
         password: ${{ secrets.PYPI_API_TOKEN }}

.github/workflows/stale.yml

@@ -16,7 +16,7 @@ jobs:
 
     steps:
 
-    - uses: actions/stale@v9
+    - uses: actions/stale@v10
       with:
         repo-token: ${{ secrets.GITHUB_TOKEN }}
         stale-issue-message: This issue will be closed in 90 days due to five years of inactivity unless the stale label or comment is removed.

.github/workflows/unlabel-pr-after-merge.yml

@@ -11,7 +11,7 @@ jobs:
     steps:
 
     - name: Remove specific labels
-      uses: actions/github-script@v7
+      uses: actions/github-script@v8
       with:
         github-token: ${{secrets.GITHUB_TOKEN}}
         script: |