From ccad047768f2faba3ce8a46f3d5161644ed7dd7b Mon Sep 17 00:00:00 2001
From: RNKuhns <RNKuhns@gmail.com>
Date: Sat, 4 Jul 2026 14:23:54 -0400
Subject: [PATCH 01/26] Add Dependabot config for pip and github-actions
 ecosystems

Weekly updates with minor/patch changes grouped into a single PR per
ecosystem; major bumps stay ungrouped so each gets individual review.
---
 .github/dependabot.yml | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)
 create mode 100644 .github/dependabot.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..195c4e6
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,21 @@
+version: 2
+updates:
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    groups:
+      python-minor-patch:
+        update-types:
+          - "minor"
+          - "patch"
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    groups:
+      actions-minor-patch:
+        update-types:
+          - "minor"
+          - "patch"

From 61c48ce8aead0ea3a5a588e4346b804624aa35a9 Mon Sep 17 00:00:00 2001
From: RNKuhns <RNKuhns@gmail.com>
Date: Sat, 4 Jul 2026 14:24:14 -0400
Subject: [PATCH 02/26] Add pre-commit CI workflow

Runs pre-commit/action on push to main and on pull requests, with an
explicit cache for ~/.cache/pre-commit keyed on the hash of
.pre-commit-config.yaml.
---
 .github/workflows/pre-commit.yml | 32 ++++++++++++++++++++++++++++++++
 1 file changed, 32 insertions(+)
 create mode 100644 .github/workflows/pre-commit.yml

diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml
new file mode 100644
index 0000000..15fa819
--- /dev/null
+++ b/.github/workflows/pre-commit.yml
@@ -0,0 +1,32 @@
+name: pre-commit
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  pre-commit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+
+      - uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
+
+      - name: Cache pre-commit environments
+        uses: actions/cache@v6
+        with:
+          path: ~/.cache/pre-commit
+          key: pre-commit-${{ runner.os }}-py3.12-${{ hashFiles('.pre-commit-config.yaml') }}
+          restore-keys: |
+            pre-commit-${{ runner.os }}-py3.12-
+
+      - uses: pre-commit/action@v3.0.1

From bd882fe838591d685b6e56e18524c564381731ac Mon Sep 17 00:00:00 2001
From: RNKuhns <RNKuhns@gmail.com>
Date: Sat, 4 Jul 2026 14:24:37 -0400
Subject: [PATCH 03/26] Add cross-platform test matrix workflow

Runs pytest via an editable dev install across ubuntu/macos/windows and
Python 3.10-3.12, with fail-fast disabled so one failing combination
doesn't cancel the others.
---
 .github/workflows/test.yml | 33 +++++++++++++++++++++++++++++++++
 1 file changed, 33 insertions(+)
 create mode 100644 .github/workflows/test.yml

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
new file mode 100644
index 0000000..098f697
--- /dev/null
+++ b/.github/workflows/test.yml
@@ -0,0 +1,33 @@
+name: test
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+        python-version: ["3.10", "3.11", "3.12"]
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+
+      - uses: actions/setup-python@v6
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: Install package with dev dependencies
+        run: pip install -e ".[dev]"
+
+      - name: Run tests
+        run: pytest

From bd7ebd8895a6b7f0c639fb7e42e2340e7eda4bee Mon Sep 17 00:00:00 2001
From: RNKuhns <RNKuhns@gmail.com>
Date: Sat, 4 Jul 2026 14:28:09 -0400
Subject: [PATCH 04/26] Add dependency vulnerability scanning workflow

Runs pip-audit against the resolved dependency set on push, pull
request, and a weekly schedule (to catch newly-disclosed CVEs against
unchanged code). Kept separate from test.yml's 9-way OS/Python matrix
to avoid running the same scan redundantly nine times.
---
 .github/workflows/security.yml | 29 +++++++++++++++++++++++++++++
 1 file changed, 29 insertions(+)
 create mode 100644 .github/workflows/security.yml

diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
new file mode 100644
index 0000000..39e5e05
--- /dev/null
+++ b/.github/workflows/security.yml
@@ -0,0 +1,29 @@
+name: security
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: "0 6 * * 1"
+
+permissions:
+  contents: read
+
+jobs:
+  pip-audit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+
+      - uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
+
+      - name: Audit dependencies for known vulnerabilities
+        uses: pypa/gh-action-pip-audit@v1.1.0
+        with:
+          inputs: .

From 451f7251a28d036baa9d45ea8858b6537da3ce59 Mon Sep 17 00:00:00 2001
From: RNKuhns <RNKuhns@gmail.com>
Date: Sat, 4 Jul 2026 14:37:14 -0400
Subject: [PATCH 05/26] Add CodeQL static analysis workflow

Single-language Python analysis on push, pull request, and a weekly
schedule so newly-disclosed vulnerability patterns get caught against
unchanged code too.
---
 .github/workflows/codeql.yml | 37 ++++++++++++++++++++++++++++++++++++
 1 file changed, 37 insertions(+)
 create mode 100644 .github/workflows/codeql.yml

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
new file mode 100644
index 0000000..613ca01
--- /dev/null
+++ b/.github/workflows/codeql.yml
@@ -0,0 +1,37 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: "0 6 * * 1"
+
+permissions:
+  contents: read
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      packages: read
+      actions: read
+      contents: read
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v4
+        with:
+          languages: python
+          build-mode: none
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v4
+        with:
+          category: "/language:python"

From c95c7851b12abbc816e8cc999d177cc3caf74dff Mon Sep 17 00:00:00 2001
From: RNKuhns <RNKuhns@gmail.com>
Date: Sat, 4 Jul 2026 14:38:00 -0400
Subject: [PATCH 06/26] Add CONTRIBUTORS.md via all-contributors spec

Seeds .all-contributorsrc with the initial contributor and generates
CONTRIBUTORS.md in the standard all-contributors-cli table format. The
file is kept in sync going forward by the update-contributors workflow
(added next), which regenerates it from .all-contributorsrc using the
real CLI whenever that config changes.
---
 .all-contributorsrc | 25 +++++++++++++++++++++++++
 CONTRIBUTORS.md     | 23 +++++++++++++++++++++++
 2 files changed, 48 insertions(+)
 create mode 100644 .all-contributorsrc
 create mode 100644 CONTRIBUTORS.md

diff --git a/.all-contributorsrc b/.all-contributorsrc
new file mode 100644
index 0000000..6ce638a
--- /dev/null
+++ b/.all-contributorsrc
@@ -0,0 +1,25 @@
+{
+  "projectName": "call-report",
+  "projectOwner": "RNKuhns",
+  "repoType": "github",
+  "repoHost": "https://github.com",
+  "files": [
+    "CONTRIBUTORS.md"
+  ],
+  "imageSize": 100,
+  "commit": false,
+  "contributorsPerLine": 7,
+  "contributorsSortAlphabetically": true,
+  "skipCi": true,
+  "contributors": [
+    {
+      "login": "RNKuhns",
+      "name": "RNKuhns",
+      "avatar_url": "https://avatars.githubusercontent.com/RNKuhns",
+      "profile": "https://github.com/RNKuhns",
+      "contributions": [
+        "code"
+      ]
+    }
+  ]
+}
diff --git a/CONTRIBUTORS.md b/CONTRIBUTORS.md
new file mode 100644
index 0000000..3f506be
--- /dev/null
+++ b/CONTRIBUTORS.md
@@ -0,0 +1,23 @@
+# Contributors
+
+Thanks goes to these wonderful people ([emoji key](https://allcontributors.org/docs/en/emoji-key)):
+
+<!-- ALL-CONTRIBUTORS-LIST:START - Do not remove or modify this section -->
+<!-- prettier-ignore-start -->
+<!-- markdownlint-disable -->
+<table>
+  <tbody>
+    <tr>
+      <td align="center" valign="top" width="14.28%"><a href="https://github.com/RNKuhns"><img src="https://avatars.githubusercontent.com/RNKuhns?s=100" width="100px;" alt="RNKuhns"/><br /><sub><b>RNKuhns</b></sub></a><br /><a href="https://github.com/RNKuhns/call-report/commits?author=RNKuhns" title="Code">💻</a></td>
+    </tr>
+  </tbody>
+</table>
+
+<!-- markdownlint-restore -->
+<!-- prettier-ignore-end -->
+
+<!-- ALL-CONTRIBUTORS-LIST:END -->
+
+This project follows the [all-contributors](https://github.com/all-contributors/all-contributors) specification. Contributions of any kind welcome!
+
+This file is regenerated automatically from [.all-contributorsrc](.all-contributorsrc) by [.github/workflows/update-contributors.yml](.github/workflows/update-contributors.yml) — do not edit it by hand.

From af253ec0c36a191b39c96f1d2e25feb3aac9598c Mon Sep 17 00:00:00 2001
From: RNKuhns <RNKuhns@gmail.com>
Date: Sat, 4 Jul 2026 14:38:34 -0400
Subject: [PATCH 07/26] Add workflow to auto-regenerate CONTRIBUTORS.md

Triggers when .all-contributorsrc changes on main, regenerates
CONTRIBUTORS.md via all-contributors-cli, and opens a PR authenticated
as a GitHub App (requires vars.PR_APP_ID / secrets.PR_APP_KEY to be
configured on the repo).
---
 .github/workflows/update-contributors.yml | 45 +++++++++++++++++++++++
 1 file changed, 45 insertions(+)
 create mode 100644 .github/workflows/update-contributors.yml

diff --git a/.github/workflows/update-contributors.yml b/.github/workflows/update-contributors.yml
new file mode 100644
index 0000000..a6def76
--- /dev/null
+++ b/.github/workflows/update-contributors.yml
@@ -0,0 +1,45 @@
+name: Update contributors
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - .all-contributorsrc
+
+permissions:
+  contents: read
+
+jobs:
+  update-contributors:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+
+      - uses: actions/setup-node@v6
+        with:
+          node-version: "18"
+
+      - name: Regenerate CONTRIBUTORS.md
+        run: |
+          npm install -g all-contributors-cli
+          npx all-contributors generate
+
+      - name: Create GitHub App token
+        id: app-token
+        uses: actions/create-github-app-token@v3
+        with:
+          app-id: ${{ vars.PR_APP_ID }}
+          private-key: ${{ secrets.PR_APP_KEY }}
+
+      - name: Open a PR with regenerated CONTRIBUTORS.md
+        uses: peter-evans/create-pull-request@v8
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+          commit-message: "docs: update CONTRIBUTORS.md"
+          title: "[MNT] Automated CONTRIBUTORS.md update"
+          body: "Automated regeneration of CONTRIBUTORS.md from .all-contributorsrc."
+          branch: chore/update-contributors
+          delete-branch: true
+          labels: maintenance

From a1a1c71b89baad2f98e6126fad4578ae82979065 Mon Sep 17 00:00:00 2001
From: RNKuhns <RNKuhns@gmail.com>
Date: Sat, 4 Jul 2026 14:38:56 -0400
Subject: [PATCH 08/26] Add weekly maintenance workflow

Two scheduled jobs: auto-update pre-commit hook revisions and open a PR
(pre-commit's rev pins aren't covered by Dependabot's pip/github-actions
ecosystems), and run OSSF Scorecard for a supply-chain security score
uploaded to code scanning.
---
 .github/workflows/weekly-maintenance.yml | 65 ++++++++++++++++++++++++
 1 file changed, 65 insertions(+)
 create mode 100644 .github/workflows/weekly-maintenance.yml

diff --git a/.github/workflows/weekly-maintenance.yml b/.github/workflows/weekly-maintenance.yml
new file mode 100644
index 0000000..a8a3aa6
--- /dev/null
+++ b/.github/workflows/weekly-maintenance.yml
@@ -0,0 +1,65 @@
+name: Weekly maintenance
+
+on:
+  schedule:
+    - cron: "0 6 * * 1"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  pre-commit-autoupdate:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+
+      - uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
+
+      - name: Auto-update pre-commit hook revisions
+        uses: browniebroke/pre-commit-autoupdate-action@v1.0.1
+
+      - name: Create GitHub App token
+        id: app-token
+        uses: actions/create-github-app-token@v3
+        with:
+          app-id: ${{ vars.PR_APP_ID }}
+          private-key: ${{ secrets.PR_APP_KEY }}
+
+      - name: Open a PR with updated hooks
+        uses: peter-evans/create-pull-request@v8
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+          commit-message: "chore: update pre-commit hooks"
+          title: "[MNT] Update pre-commit hooks"
+          body: "Automated weekly update of .pre-commit-config.yaml hook revisions."
+          branch: chore/pre-commit-autoupdate
+          delete-branch: true
+          labels: maintenance
+
+  scorecard:
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      id-token: write
+      contents: read
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+
+      - name: Run OSSF Scorecard analysis
+        uses: ossf/scorecard-action@v2.4.3
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          publish_results: false
+
+      - name: Upload SARIF to code scanning
+        uses: github/codeql-action/upload-sarif@v4
+        with:
+          sarif_file: results.sarif

From 69d505d21e2e5f2dfc8611a87a6ed12ec4d5fe5d Mon Sep 17 00:00:00 2001
From: RNKuhns <RNKuhns@gmail.com>
Date: Sat, 4 Jul 2026 14:44:20 -0400
Subject: [PATCH 09/26] Match GitHub App secret/variable names to what was
 actually configured

vars.PR_APP_ID -> vars.APP_ID, secrets.PR_APP_KEY -> secrets.APP_PRIVATE_KEY,
matching the repo variable/secret names set up for the GitHub App.
---
 .github/workflows/update-contributors.yml | 4 ++--
 .github/workflows/weekly-maintenance.yml  | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/update-contributors.yml b/.github/workflows/update-contributors.yml
index a6def76..e6ab7a6 100644
--- a/.github/workflows/update-contributors.yml
+++ b/.github/workflows/update-contributors.yml
@@ -30,8 +30,8 @@ jobs:
         id: app-token
         uses: actions/create-github-app-token@v3
         with:
-          app-id: ${{ vars.PR_APP_ID }}
-          private-key: ${{ secrets.PR_APP_KEY }}
+          app-id: ${{ vars.APP_ID }}
+          private-key: ${{ secrets.APP_PRIVATE_KEY }}
 
       - name: Open a PR with regenerated CONTRIBUTORS.md
         uses: peter-evans/create-pull-request@v8
diff --git a/.github/workflows/weekly-maintenance.yml b/.github/workflows/weekly-maintenance.yml
index a8a3aa6..f9f933e 100644
--- a/.github/workflows/weekly-maintenance.yml
+++ b/.github/workflows/weekly-maintenance.yml
@@ -27,8 +27,8 @@ jobs:
         id: app-token
         uses: actions/create-github-app-token@v3
         with:
-          app-id: ${{ vars.PR_APP_ID }}
-          private-key: ${{ secrets.PR_APP_KEY }}
+          app-id: ${{ vars.APP_ID }}
+          private-key: ${{ secrets.APP_PRIVATE_KEY }}
 
       - name: Open a PR with updated hooks
         uses: peter-evans/create-pull-request@v8

From 73a4fe86c59e4b4cd7dbbf62512e5bd76a2943f1 Mon Sep 17 00:00:00 2001
From: RNKuhns <RNKuhns@gmail.com>
Date: Sat, 4 Jul 2026 14:51:09 -0400
Subject: [PATCH 10/26] Use client-id instead of deprecated app-id for GitHub
 App auth

actions/create-github-app-token@v3 deprecates the app-id input in
favor of client-id. Switches both workflows to read the App's Client
ID from secrets.CLIENT_ID instead of the App ID from vars.APP_ID.
---
 .github/workflows/update-contributors.yml | 2 +-
 .github/workflows/weekly-maintenance.yml  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/update-contributors.yml b/.github/workflows/update-contributors.yml
index e6ab7a6..10b60d7 100644
--- a/.github/workflows/update-contributors.yml
+++ b/.github/workflows/update-contributors.yml
@@ -30,7 +30,7 @@ jobs:
         id: app-token
         uses: actions/create-github-app-token@v3
         with:
-          app-id: ${{ vars.APP_ID }}
+          client-id: ${{ secrets.CLIENT_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
 
       - name: Open a PR with regenerated CONTRIBUTORS.md
diff --git a/.github/workflows/weekly-maintenance.yml b/.github/workflows/weekly-maintenance.yml
index f9f933e..ac89232 100644
--- a/.github/workflows/weekly-maintenance.yml
+++ b/.github/workflows/weekly-maintenance.yml
@@ -27,7 +27,7 @@ jobs:
         id: app-token
         uses: actions/create-github-app-token@v3
         with:
-          app-id: ${{ vars.APP_ID }}
+          client-id: ${{ secrets.CLIENT_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
 
       - name: Open a PR with updated hooks

From 43803e8cd2de4bbaaeee50c422aaebc724602616 Mon Sep 17 00:00:00 2001
From: RNKuhns <RNKuhns@gmail.com>
Date: Sat, 4 Jul 2026 15:24:36 -0400
Subject: [PATCH 11/26] miscellaneous updates to actions

---
 .github/dependabot.yml                    | 14 +++++
 .github/workflows/pre-commit.yml          | 62 +++++++++++++++++++++--
 .github/workflows/security.yml            |  2 +-
 .github/workflows/test.yml                | 24 +++++++--
 .github/workflows/update-contributors.yml | 11 ++--
 .github/workflows/weekly-maintenance.yml  | 18 +++++--
 6 files changed, 114 insertions(+), 17 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 195c4e6..657a9bf 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -4,6 +4,13 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
+      time: "01:43"
+    commit-message:
+      include: scope
+      prefix: "[MNT] "
+    labels:
+      - "maintenance"
+      - "dependencies"
     groups:
       python-minor-patch:
         update-types:
@@ -14,6 +21,13 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
+      time: "01:43"
+    commit-message:
+      include: scope
+      prefix: "[MNT] "
+    labels:
+      - "maintenance"
+      - "dependencies"
     groups:
       actions-minor-patch:
         update-types:
diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml
index 15fa819..c83bd50 100644
--- a/.github/workflows/pre-commit.yml
+++ b/.github/workflows/pre-commit.yml
@@ -5,19 +5,31 @@ on:
     branches: [main]
   pull_request:
     branches: [main]
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - labeled
+      - unlabeled
 
 permissions:
   contents: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 jobs:
   pre-commit:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - name: Checkout
+        uses: actions/checkout@v7
         with:
           persist-credentials: false
 
-      - uses: actions/setup-python@v6
+      - name: Setup Python
+        uses: actions/setup-python@v6
         with:
           python-version: "3.12"
 
@@ -29,4 +41,48 @@ jobs:
           restore-keys: |
             pre-commit-${{ runner.os }}-py3.12-
 
-      - uses: pre-commit/action@v3.0.1
+      - name: Get changed files
+        if: ${{ github.event_name == 'pull_request' }}
+        # uses v47.0.5
+        uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96
+        id: changed-files
+
+      - name: List changed files
+        if: ${{ github.event_name == 'pull_request' }}
+        run: echo '${{ steps.changed-files.outputs.all_changed_files }}'
+
+      # Check the full repository on pushes to main
+      - name: Full pre-commit
+        if: ${{ github.event_name == 'push' }}
+        uses: pre-commit/action@v3.0.1
+        with:
+          extra_args: --all-files
+
+      # Check the full repository on PRs that are explicitly labelled
+      - name: Full pre-commit on labelled PR
+        if: ${{ github.event_name == 'pull_request' && contains(github.event.pull_request.labels.*.name, 'full-pre-commit') }}
+        uses: pre-commit/action@v3.0.1
+        with:
+          extra_args: --all-files
+
+      # Otherwise only check changed files on PRs
+      - name: Local pre-commit
+        if: ${{ github.event_name == 'pull_request' && !contains(github.event.pull_request.labels.*.name, 'full-pre-commit') }}
+        uses: pre-commit/action@v3.0.1
+        with:
+          extra_args: --files ${{ steps.changed-files.outputs.all_changed_files }}
+
+  codespell-annotations:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+
+      - name: Annotate locations with typos
+        uses: codespell-project/codespell-problem-matcher@v1
+
+      - name: Codespell
+        uses: codespell-project/actions-codespell@v2
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index 39e5e05..b805ab5 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -26,4 +26,4 @@ jobs:
       - name: Audit dependencies for known vulnerabilities
         uses: pypa/gh-action-pip-audit@v1.1.0
         with:
-          inputs: .
+          inputs: requirements.txt
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 098f697..e4c8417 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -5,29 +5,45 @@ on:
     branches: [main]
   pull_request:
     branches: [main]
+    paths:
+      - "call_report/**"
+      - ".github/workflows/**"
+      - "pyproject.toml"
 
 permissions:
   contents: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
+  cancel-in-progress: true
+
+
 jobs:
-  test:
+  pytest:
     runs-on: ${{ matrix.os }}
+    
     strategy:
       fail-fast: false
       matrix:
         os: [ubuntu-latest, macos-latest, windows-latest]
-        python-version: ["3.10", "3.11", "3.12"]
+        python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]
+
     steps:
-      - uses: actions/checkout@v7
+      - name: Checkout
+        uses: actions/checkout@v7
         with:
           persist-credentials: false
 
-      - uses: actions/setup-python@v6
+      - name: Setup Python
+        uses: actions/setup-python@v6
         with:
           python-version: ${{ matrix.python-version }}
 
       - name: Install package with dev dependencies
         run: pip install -e ".[dev]"
 
+      - name: Show dependencies
+        run: python -m pip list
+
       - name: Run tests
         run: pytest
diff --git a/.github/workflows/update-contributors.yml b/.github/workflows/update-contributors.yml
index 10b60d7..4db479f 100644
--- a/.github/workflows/update-contributors.yml
+++ b/.github/workflows/update-contributors.yml
@@ -21,9 +21,12 @@ jobs:
         with:
           node-version: "18"
 
-      - name: Regenerate CONTRIBUTORS.md
+      - name: Setup all-contributors-cli
         run: |
           npm install -g all-contributors-cli
+
+      - name: Regenerate CONTRIBUTORS.md
+        run: |
           npx all-contributors generate
 
       - name: Create GitHub App token
@@ -37,9 +40,9 @@ jobs:
         uses: peter-evans/create-pull-request@v8
         with:
           token: ${{ steps.app-token.outputs.token }}
-          commit-message: "docs: update CONTRIBUTORS.md"
+          commit-message: "automatic update of `CONTRIBUTORS.md`"
           title: "[MNT] Automated CONTRIBUTORS.md update"
-          body: "Automated regeneration of CONTRIBUTORS.md from .all-contributorsrc."
+          body: "Automated regeneration of CONTRIBUTORS.md from `.all-contributorsrc`."
           branch: chore/update-contributors
           delete-branch: true
-          labels: maintenance
+          labels: maintenance, no-changelog
diff --git a/.github/workflows/weekly-maintenance.yml b/.github/workflows/weekly-maintenance.yml
index ac89232..5474bd5 100644
--- a/.github/workflows/weekly-maintenance.yml
+++ b/.github/workflows/weekly-maintenance.yml
@@ -34,12 +34,11 @@ jobs:
         uses: peter-evans/create-pull-request@v8
         with:
           token: ${{ steps.app-token.outputs.token }}
-          commit-message: "chore: update pre-commit hooks"
+          commit-message: "Update pre-commit hooks"
           title: "[MNT] Update pre-commit hooks"
-          body: "Automated weekly update of .pre-commit-config.yaml hook revisions."
+          body: "Automated weekly update of `.pre-commit-config.yaml` hook revisions."
           branch: chore/pre-commit-autoupdate
-          delete-branch: true
-          labels: maintenance
+          labels: maintenance, full-pre-commit, no-changelog
 
   scorecard:
     runs-on: ubuntu-latest
@@ -47,8 +46,10 @@ jobs:
       security-events: write
       id-token: write
       contents: read
+
     steps:
-      - uses: actions/checkout@v7
+      - name: Checkout code
+        uses: actions/checkout@v7
         with:
           persist-credentials: false
 
@@ -59,6 +60,13 @@ jobs:
           results_format: sarif
           publish_results: false
 
+      - name: Upload artifact
+        uses: actions/upload-artifact@v7
+        with:
+          name: SARIF file
+          path: results.sarif
+          retention-days: 14
+
       - name: Upload SARIF to code scanning
         uses: github/codeql-action/upload-sarif@v4
         with:

From e6f68dbf54e9ef9822635e3823b637ffde2a5b27 Mon Sep 17 00:00:00 2001
From: RNKuhns <RNKuhns@gmail.com>
Date: Sat, 4 Jul 2026 15:38:48 -0400
Subject: [PATCH 12/26] Add missing step names for consistency across workflows

Audited all workflow steps for a `name:` key; 7 steps across
security.yml, codeql.yml, weekly-maintenance.yml, and
update-contributors.yml were unnamed (checkout/setup-python/setup-node
steps), inconsistent with pre-commit.yml and test.yml which already
name every step.
---
 .github/workflows/codeql.yml              | 3 ++-
 .github/workflows/security.yml            | 6 ++++--
 .github/workflows/update-contributors.yml | 6 ++++--
 .github/workflows/weekly-maintenance.yml  | 6 ++++--
 4 files changed, 14 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 613ca01..6a4d98a 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -21,7 +21,8 @@ jobs:
       actions: read
       contents: read
     steps:
-      - uses: actions/checkout@v7
+      - name: Checkout
+        uses: actions/checkout@v7
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index b805ab5..ccde9de 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -15,11 +15,13 @@ jobs:
   pip-audit:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - name: Checkout
+        uses: actions/checkout@v7
         with:
           persist-credentials: false
 
-      - uses: actions/setup-python@v6
+      - name: Setup Python
+        uses: actions/setup-python@v6
         with:
           python-version: "3.12"
 
diff --git a/.github/workflows/update-contributors.yml b/.github/workflows/update-contributors.yml
index 4db479f..7d8ef4b 100644
--- a/.github/workflows/update-contributors.yml
+++ b/.github/workflows/update-contributors.yml
@@ -13,11 +13,13 @@ jobs:
   update-contributors:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - name: Checkout
+        uses: actions/checkout@v7
         with:
           persist-credentials: false
 
-      - uses: actions/setup-node@v6
+      - name: Setup Node.js
+        uses: actions/setup-node@v6
         with:
           node-version: "18"
 
diff --git a/.github/workflows/weekly-maintenance.yml b/.github/workflows/weekly-maintenance.yml
index 5474bd5..d3552cd 100644
--- a/.github/workflows/weekly-maintenance.yml
+++ b/.github/workflows/weekly-maintenance.yml
@@ -12,11 +12,13 @@ jobs:
   pre-commit-autoupdate:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - name: Checkout
+        uses: actions/checkout@v7
         with:
           persist-credentials: false
 
-      - uses: actions/setup-python@v6
+      - name: Setup Python
+        uses: actions/setup-python@v6
         with:
           python-version: "3.12"
 

From dbda022a46427c5542ba11cd032e2749489ab81f Mon Sep 17 00:00:00 2001
From: RNKuhns <RNKuhns@gmail.com>
Date: Sat, 4 Jul 2026 15:39:34 -0400
Subject: [PATCH 13/26] Add Codecov infrastructure with a 90% coverage minimum

- .codecov.yml: project/patch status checks target 90% coverage
  (1% leeway), posted as required PR checks (codecov/project,
  codecov/patch) and non-informational so they can block merges.
- pyproject.toml: [tool.coverage.run]/[tool.coverage.report] configure
  coverage source and a matching local fail_under = 90.
- test.yml: every matrix leg runs pytest with --cov-fail-under=90;
  coverage.xml is uploaded to Codecov from a single canonical leg
  (ubuntu-latest, Python 3.12) rather than all 15 combinations to
  avoid redundant uploads.

Requires a CODECOV_TOKEN repo secret (link the repo at codecov.io) for
the upload step to authenticate.
---
 .codecov.yml               | 22 ++++++++++++++++++++++
 .github/workflows/test.yml | 10 +++++++++-
 pyproject.toml             | 12 ++++++++++++
 3 files changed, 43 insertions(+), 1 deletion(-)
 create mode 100644 .codecov.yml

diff --git a/.codecov.yml b/.codecov.yml
new file mode 100644
index 0000000..3047c0e
--- /dev/null
+++ b/.codecov.yml
@@ -0,0 +1,22 @@
+coverage:
+  status:
+    project:
+      default:
+        target: 90%
+        threshold: 1%
+        informational: false
+    patch:
+      default:
+        target: 90%
+        threshold: 1%
+        informational: false
+
+comment:
+  require_changes: true
+
+github_checks:
+  annotations: true
+
+ignore:
+  - "docs/"
+  - "tests/"
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index e4c8417..053b74b 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -46,4 +46,12 @@ jobs:
         run: python -m pip list
 
       - name: Run tests
-        run: pytest
+        run: pytest --cov=call_report --cov-report=xml --cov-report=term-missing --cov-fail-under=90
+
+      - name: Upload coverage to Codecov
+        if: matrix.os == 'ubuntu-latest' && matrix.python-version == '3.12'
+        uses: codecov/codecov-action@v7
+        with:
+          token: ${{ secrets.CODECOV_TOKEN }}
+          files: ./coverage.xml
+          fail_ci_if_error: true
diff --git a/pyproject.toml b/pyproject.toml
index d418db9..14accd2 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -69,6 +69,18 @@ indent-style = "space"
 docstring-code-format = true
 docstring-code-line-length = "dynamic"
 
+[tool.coverage.run]
+source = ["call_report"]
+branch = true
+
+[tool.coverage.report]
+fail_under = 90
+show_missing = true
+exclude_lines = [
+    "pragma: no cover",
+    "if TYPE_CHECKING:",
+]
+
 [tool.mypy]
 python_version = "3.10"
 files = ["src", "tests"]

From b6d75630c7b9bb41567437dd1ff8b7e597508d8d Mon Sep 17 00:00:00 2001
From: RNKuhns <RNKuhns@gmail.com>
Date: Sat, 4 Jul 2026 15:40:40 -0400
Subject: [PATCH 14/26] Add Read the Docs infrastructure

- .readthedocs.yaml: builds docs/conf.py with the `docs` extra installed.
- docs/conf.py, docs/index.rst: minimal Sphinx setup using
  pydata-sphinx-theme and the numpydoc extension, consistent with the
  numpydoc docstring convention already enforced via pre-commit.
- docs/Makefile, docs/make.bat: standard local build helpers; output
  goes to docs/_build, matching the ignore_path already configured for
  doc8 in pyproject.toml.
- pyproject.toml: new `docs` optional-dependency group
  (sphinx, pydata-sphinx-theme, numpydoc).

Activating the project on readthedocs.org (connecting this GitHub repo)
is a manual step and still needs to be done.
---
 .readthedocs.yaml | 17 +++++++++++++++++
 docs/Makefile     | 19 +++++++++++++++++++
 docs/conf.py      | 31 +++++++++++++++++++++++++++++++
 docs/index.rst    |  9 +++++++++
 docs/make.bat     | 35 +++++++++++++++++++++++++++++++++++
 pyproject.toml    |  5 +++++
 6 files changed, 116 insertions(+)
 create mode 100644 .readthedocs.yaml
 create mode 100644 docs/Makefile
 create mode 100644 docs/conf.py
 create mode 100644 docs/index.rst
 create mode 100644 docs/make.bat

diff --git a/.readthedocs.yaml b/.readthedocs.yaml
new file mode 100644
index 0000000..a295f25
--- /dev/null
+++ b/.readthedocs.yaml
@@ -0,0 +1,17 @@
+version: 2
+
+build:
+  os: ubuntu-24.04
+  tools:
+    python: "3.12"
+
+python:
+  install:
+    - method: pip
+      path: .
+      extra_requirements:
+        - docs
+
+sphinx:
+  configuration: docs/conf.py
+  fail_on_warning: false
diff --git a/docs/Makefile b/docs/Makefile
new file mode 100644
index 0000000..08835bd
--- /dev/null
+++ b/docs/Makefile
@@ -0,0 +1,19 @@
+# Minimal makefile for Sphinx documentation
+
+# You can set these variables from the command line, and also
+# from the environment for the first two.
+SPHINXOPTS    ?=
+SPHINXBUILD   ?= sphinx-build
+SOURCEDIR     = .
+BUILDDIR      = _build
+
+# Put it first so that "make" without argument is like "make help".
+help:
+	@$(SPHINXBUILD) -M help "$(SOURCEDIR)" "$(BUILDDIR)" $(SPHINXOPTS) $(O)
+
+.PHONY: help Makefile
+
+# Catch-all target: route all unknown targets to Sphinx using the new
+# "make mode" option.  $(O) is meant as a shortcut for $(SPHINXOPTS).
+%: Makefile
+	@$(SPHINXBUILD) -M $@ "$(SOURCEDIR)" "$(BUILDDIR)" $(SPHINXOPTS) $(O)
diff --git a/docs/conf.py b/docs/conf.py
new file mode 100644
index 0000000..90345f3
--- /dev/null
+++ b/docs/conf.py
@@ -0,0 +1,31 @@
+"""Sphinx configuration."""
+
+from __future__ import annotations
+
+from call_report import __version__
+
+project = "call-report"
+copyright = "2026, RNKuhns"
+author = "RNKuhns"
+release = __version__
+version = ".".join(release.split(".")[:2])
+
+extensions = [
+    "sphinx.ext.autodoc",
+    "sphinx.ext.autosummary",
+    "sphinx.ext.intersphinx",
+    "sphinx.ext.viewcode",
+    "numpydoc",
+]
+
+templates_path = ["_templates"]
+exclude_patterns = ["_build", "Thumbs.db", ".DS_Store"]
+
+html_theme = "pydata_sphinx_theme"
+
+numpydoc_show_class_members = False
+autosummary_generate = True
+
+intersphinx_mapping = {
+    "python": ("https://docs.python.org/3", None),
+}
diff --git a/docs/index.rst b/docs/index.rst
new file mode 100644
index 0000000..120299f
--- /dev/null
+++ b/docs/index.rst
@@ -0,0 +1,9 @@
+call-report
+===========
+
+Tools for working with regulatory call report data filed by regulated U.S.
+financial institutions.
+
+.. toctree::
+   :maxdepth: 2
+   :caption: Contents:
diff --git a/docs/make.bat b/docs/make.bat
new file mode 100644
index 0000000..954237b
--- /dev/null
+++ b/docs/make.bat
@@ -0,0 +1,35 @@
+@ECHO OFF
+
+pushd %~dp0
+
+REM Command file for Sphinx documentation
+
+if "%SPHINXBUILD%" == "" (
+	set SPHINXBUILD=sphinx-build
+)
+set SOURCEDIR=.
+set BUILDDIR=_build
+
+%SPHINXBUILD% >NUL 2>NUL
+if errorlevel 9009 (
+	echo.
+	echo.The 'sphinx-build' command was not found. Make sure you have Sphinx
+	echo.installed, then set the SPHINXBUILD environment variable to point
+	echo.to the full path of the 'sphinx-build' executable. Alternatively you
+	echo.may add the Sphinx directory to PATH.
+	echo.
+	echo.If you don't have Sphinx installed, grab it from
+	echo.https://www.sphinx-doc.org/
+	exit /b 1
+)
+
+if "%1" == "" goto help
+
+%SPHINXBUILD% -M %1 %SOURCEDIR% %BUILDDIR% %SPHINXOPTS% %O%
+goto end
+
+:help
+%SPHINXBUILD% -M help %SOURCEDIR% %BUILDDIR% %SPHINXOPTS% %O%
+
+:end
+popd
diff --git a/pyproject.toml b/pyproject.toml
index 14accd2..cbfb04b 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -32,6 +32,11 @@ dev = [
     "pre-commit>=3.7",
     "mypy>=1.10",
 ]
+docs = [
+    "sphinx>=7",
+    "pydata-sphinx-theme>=0.15",
+    "numpydoc>=1.7",
+]
 
 [tool.hatch.build.targets.wheel]
 packages = ["src/call_report"]

From 71565e5b37c9e62e1672be798678f93a3f262c2a Mon Sep 17 00:00:00 2001
From: RNKuhns <RNKuhns@gmail.com>
Date: Sat, 4 Jul 2026 15:48:39 -0400
Subject: [PATCH 15/26] Minor review changes

---
 .codecov.yml   | 1 +
 pyproject.toml | 2 ++
 2 files changed, 3 insertions(+)

diff --git a/.codecov.yml b/.codecov.yml
index 3047c0e..0aaf05a 100644
--- a/.codecov.yml
+++ b/.codecov.yml
@@ -20,3 +20,4 @@ github_checks:
 ignore:
   - "docs/"
   - "tests/"
+  - ".github/"
diff --git a/pyproject.toml b/pyproject.toml
index cbfb04b..895b7f0 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -84,6 +84,8 @@ show_missing = true
 exclude_lines = [
     "pragma: no cover",
     "if TYPE_CHECKING:",
+    "@abstractmethod",
+    "@abc.abstractmethod"
 ]
 
 [tool.mypy]

From b6dbef9e0f8c4ea1a0b664261b2d1eab29e10c1b Mon Sep 17 00:00:00 2001
From: "pre-commit-ci[bot]"
 <66853113+pre-commit-ci[bot]@users.noreply.github.com>
Date: Sat, 4 Jul 2026 19:50:27 +0000
Subject: [PATCH 16/26] [pre-commit.ci] auto fixes from pre-commit.com hooks

for more information, see https://pre-commit.ci
---
 .github/workflows/publish-test.yml | 2 +-
 .github/workflows/test.yml         | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/publish-test.yml b/.github/workflows/publish-test.yml
index c67fbd0..ae2407d 100644
--- a/.github/workflows/publish-test.yml
+++ b/.github/workflows/publish-test.yml
@@ -51,4 +51,4 @@ jobs:
 
       - uses: pypa/gh-action-pypi-publish@release/v1
         with:
-          repository-url: https://test.pypi.org/legacy/
\ No newline at end of file
+          repository-url: https://test.pypi.org/legacy/
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 053b74b..6d91b75 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -21,7 +21,7 @@ concurrency:
 jobs:
   pytest:
     runs-on: ${{ matrix.os }}
-    
+
     strategy:
       fail-fast: false
       matrix:

From 38d40d62488bee94acd401cdb9cb7baa72ad7ef2 Mon Sep 17 00:00:00 2001
From: RNKuhns <RNKuhns@gmail.com>
Date: Sat, 4 Jul 2026 16:07:28 -0400
Subject: [PATCH 17/26] Ignore ruff A001 (builtin shadowing) for docs/conf.py

Sphinx's conf.py conventionally defines a module-level `copyright`
variable, which shadows the builtin - expected and standard practice,
not something to flag.
---
 pyproject.toml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pyproject.toml b/pyproject.toml
index 895b7f0..66d4899 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -58,6 +58,7 @@ ignore = []
 
 [tool.ruff.lint.per-file-ignores]
 "tests/*.py" = ["S101"]
+"docs/conf.py" = ["A001"]
 
 [tool.ruff.lint.isort]
 known-first-party = ["call_report"]

From 7bad121362df6c5f561238e697ba62ed52ab0336 Mon Sep 17 00:00:00 2001
From: RNKuhns <RNKuhns@gmail.com>
Date: Sat, 4 Jul 2026 16:07:35 -0400
Subject: [PATCH 18/26] Add scripts/generate_requirements.sh

Regenerates requirements.txt from pyproject.toml via pip-compile,
including all optional-dependency groups (--all-extras).
---
 scripts/generate_requirements.sh | 13 +++++++++++++
 1 file changed, 13 insertions(+)
 create mode 100644 scripts/generate_requirements.sh

diff --git a/scripts/generate_requirements.sh b/scripts/generate_requirements.sh
new file mode 100644
index 0000000..3232da4
--- /dev/null
+++ b/scripts/generate_requirements.sh
@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$REPO_ROOT"
+
+if ! command -v pip-compile >/dev/null 2>&1; then
+    pip install --quiet pip-tools
+fi
+
+pip-compile pyproject.toml --all-extras --output-file=requirements.txt
+
+echo "Generated requirements.txt from pyproject.toml"

From 5a32b8ba3ec614013c2a07cad8def0ce374c48a1 Mon Sep 17 00:00:00 2001
From: RNKuhns <RNKuhns@gmail.com>
Date: Sat, 4 Jul 2026 16:14:00 -0400
Subject: [PATCH 19/26] bump version test

---
 tests/test_placeholder.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/test_placeholder.py b/tests/test_placeholder.py
index 1bc76ac..338a91b 100644
--- a/tests/test_placeholder.py
+++ b/tests/test_placeholder.py
@@ -5,4 +5,4 @@
 
 def test_version() -> None:
     """Test that the package version is set correctly."""
-    assert call_report.__version__ == "0.1.0"
+    assert call_report.__version__ == "0.1.1"

From 033e730e2583aaa3feb675c33a8bd7a70ecc5a4e Mon Sep 17 00:00:00 2001
From: RNKuhns <RNKuhns@gmail.com>
Date: Sat, 4 Jul 2026 16:21:59 -0400
Subject: [PATCH 20/26] Wire generate_requirements.sh into pre-commit and CI

Add a local pre-commit hook that regenerates requirements.txt whenever
pyproject.toml changes, and a check-requirements workflow that fails
the build if the committed requirements.txt drifts from what the
script produces. Both are scoped to pyproject.toml only, so the
script's own output (requirements.txt) can't retrigger either one.
---
 .github/workflows/check-requirements.yml | 39 ++++++++++++++++++++++++
 .pre-commit-config.yaml                  |  9 ++++++
 2 files changed, 48 insertions(+)
 create mode 100644 .github/workflows/check-requirements.yml

diff --git a/.github/workflows/check-requirements.yml b/.github/workflows/check-requirements.yml
new file mode 100644
index 0000000..a63c117
--- /dev/null
+++ b/.github/workflows/check-requirements.yml
@@ -0,0 +1,39 @@
+name: check-requirements
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "pyproject.toml"
+  pull_request:
+    branches: [main]
+    paths:
+      - "pyproject.toml"
+
+permissions:
+  contents: read
+
+jobs:
+  check-requirements:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+
+      - name: Setup Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
+
+      - name: Regenerate requirements.txt
+        run: scripts/generate_requirements.sh
+
+      - name: Verify requirements.txt is up to date
+        run: |
+          if ! git diff --exit-code requirements.txt; then
+            echo "::error::requirements.txt is out of date with pyproject.toml. Run scripts/generate_requirements.sh locally and commit the updated requirements.txt."
+            exit 1
+          fi
+          echo "requirements.txt is up to date."
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 2201d03..f1c4e3f 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -61,3 +61,12 @@ repos:
     rev: v1.0.2
     hooks:
       - id: sphinx-lint
+
+  - repo: local
+    hooks:
+      - id: generate-requirements
+        name: Regenerate requirements.txt
+        entry: scripts/generate_requirements.sh
+        language: script
+        files: ^pyproject\.toml$
+        pass_filenames: false

From 4b20488184102a31d60b9a3de46ee5402523603e Mon Sep 17 00:00:00 2001
From: RNKuhns <RNKuhns@gmail.com>
Date: Sat, 4 Jul 2026 16:28:31 -0400
Subject: [PATCH 21/26] Fix executable bit lost due to core.fileMode=false

Both scripts were chmod +x'd locally, but core.fileMode=false means
git never recorded the executable bit in the committed tree (both
were 100644). Set it directly via git update-index --chmod=+x so it's
correct regardless of that setting - fixes "permission denied" when
CI checks out generate_requirements.sh on Linux.
---
 scripts/generate_requirements.sh | 0
 scripts/tag_release.sh           | 0
 2 files changed, 0 insertions(+), 0 deletions(-)
 mode change 100644 => 100755 scripts/generate_requirements.sh
 mode change 100644 => 100755 scripts/tag_release.sh

diff --git a/scripts/generate_requirements.sh b/scripts/generate_requirements.sh
old mode 100644
new mode 100755
diff --git a/scripts/tag_release.sh b/scripts/tag_release.sh
old mode 100644
new mode 100755

From 0f628789b5acb0a3f2e469fd6cc842e01b1e6e19 Mon Sep 17 00:00:00 2001
From: RNKuhns <RNKuhns@gmail.com>
Date: Sat, 4 Jul 2026 16:40:42 -0400
Subject: [PATCH 22/26] Get generate_requirements working

---
 .github/workflows/check-requirements.yml | 3 +++
 .pre-commit-config.yaml                  | 9 ---------
 scripts/generate_requirements.sh         | 3 ++-
 3 files changed, 5 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/check-requirements.yml b/.github/workflows/check-requirements.yml
index a63c117..d07e279 100644
--- a/.github/workflows/check-requirements.yml
+++ b/.github/workflows/check-requirements.yml
@@ -27,6 +27,9 @@ jobs:
         with:
           python-version: "3.12"
 
+      - name: Install pip-tools
+        run: pip install pip-tools
+
       - name: Regenerate requirements.txt
         run: scripts/generate_requirements.sh
 
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index f1c4e3f..2201d03 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -61,12 +61,3 @@ repos:
     rev: v1.0.2
     hooks:
       - id: sphinx-lint
-
-  - repo: local
-    hooks:
-      - id: generate-requirements
-        name: Regenerate requirements.txt
-        entry: scripts/generate_requirements.sh
-        language: script
-        files: ^pyproject\.toml$
-        pass_filenames: false
diff --git a/scripts/generate_requirements.sh b/scripts/generate_requirements.sh
index 3232da4..21c2883 100755
--- a/scripts/generate_requirements.sh
+++ b/scripts/generate_requirements.sh
@@ -5,7 +5,8 @@ REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 cd "$REPO_ROOT"
 
 if ! command -v pip-compile >/dev/null 2>&1; then
-    pip install --quiet pip-tools
+    echo "Error: pip-compile not found. Install pip-tools first (pip install pip-tools)." >&2
+    exit 1
 fi
 
 pip-compile pyproject.toml --all-extras --output-file=requirements.txt

From 46aea64fb368d94b034ba17b932413c79bd14c90 Mon Sep 17 00:00:00 2001
From: RNKuhns <RNKuhns@gmail.com>
Date: Sun, 19 Jul 2026 15:26:16 -0400
Subject: [PATCH 23/26] Security file

---
 .github/workflows/security.yml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index ccde9de..54ad387 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -25,6 +25,12 @@ jobs:
         with:
           python-version: "3.12"
 
+      - name: Install pip-tools
+        run: pip install pip-tools
+
+      - name: Regenerate requirements.txt
+        run: scripts/generate_requirements.sh
+
       - name: Audit dependencies for known vulnerabilities
         uses: pypa/gh-action-pip-audit@v1.1.0
         with:

From 70ea19c05c7949749a8ad88effe64268f0dc1698 Mon Sep 17 00:00:00 2001
From: RNKuhns <RNKuhns@gmail.com>
Date: Sun, 19 Jul 2026 15:32:40 -0400
Subject: [PATCH 24/26] Update check-requirements

---
 .github/workflows/check-requirements.yml | 21 +++++++++++++++------
 1 file changed, 15 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/check-requirements.yml b/.github/workflows/check-requirements.yml
index d07e279..5e690fb 100644
--- a/.github/workflows/check-requirements.yml
+++ b/.github/workflows/check-requirements.yml
@@ -14,7 +14,7 @@ permissions:
   contents: read
 
 jobs:
-  check-requirements:
+  check-requirements-in-sync:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
@@ -33,10 +33,19 @@ jobs:
       - name: Regenerate requirements.txt
         run: scripts/generate_requirements.sh
 
-      - name: Verify requirements.txt is up to date
+      - name: Check for drift in requirements.txt and report
         run: |
-          if ! git diff --exit-code requirements.txt; then
-            echo "::error::requirements.txt is out of date with pyproject.toml. Run scripts/generate_requirements.sh locally and commit the updated requirements.txt."
-            exit 1
+          if ! git diff --quiet requirements.txt; then
+            echo "::group::requirements.txt is out of sync — diff below"
+            git diff requirements.txt
+            echo "::endgroup::"
+            echo "::error::requirements.txt is out of sync with pyproject.toml. Fix locally with: ./scripts/generate_requirements.sh && git add requirements.txt && git commit"
+            # Mark that we need to upload the corrected file and fail
+            echo "DRIFT_DETECTED=true" >> "$GITHUB_ENV"
+          else
+            echo "requirements.txt is in sync."
           fi
-          echo "requirements.txt is up to date."
+
+      - name: Fail if drift was detected
+        if: env.DRIFT_DETECTED == 'true'
+        run: exit 1
\ No newline at end of file

From fac3a430771b0ab1e1bf1e390e741cadf4fb0870 Mon Sep 17 00:00:00 2001
From: "pre-commit-ci[bot]"
 <66853113+pre-commit-ci[bot]@users.noreply.github.com>
Date: Sun, 19 Jul 2026 19:32:56 +0000
Subject: [PATCH 25/26] [pre-commit.ci] auto fixes from pre-commit.com hooks

for more information, see https://pre-commit.ci
---
 .github/workflows/check-requirements.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/check-requirements.yml b/.github/workflows/check-requirements.yml
index 5e690fb..7292997 100644
--- a/.github/workflows/check-requirements.yml
+++ b/.github/workflows/check-requirements.yml
@@ -48,4 +48,4 @@ jobs:
 
       - name: Fail if drift was detected
         if: env.DRIFT_DETECTED == 'true'
-        run: exit 1
\ No newline at end of file
+        run: exit 1

From 23c894e77fba2704e30df3cd1c53d314100ae11d Mon Sep 17 00:00:00 2001
From: RNKuhns <RNKuhns@gmail.com>
Date: Sun, 19 Jul 2026 15:48:07 -0400
Subject: [PATCH 26/26] Update codeql

---
 .github/workflows/codeql.yml | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 6a4d98a..ea62826 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -20,6 +20,16 @@ jobs:
       packages: read
       actions: read
       contents: read
+
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+        - language: actions
+          build-mode: none
+        - language: python
+          build-mode: none
+
     steps:
       - name: Checkout
         uses: actions/checkout@v7