[MartinThoma]

Packaging & release:

• Publish to PyPI via Trusted Publishing (OIDC) with separate build and publish jobs, instead of flit publish with an API token
• Fix release workflow triggers: tag pushes and manual runs were always skipped, and "Create git tag" runs without a REL commit were not
• Pass commit messages via env vars to avoid shell injection
• Remove the unused setup.py and the flit CLI (flit_core stays the backend)
• Raise dependency lower bounds to versions that actually pass the tests: pypdf>=6.6.0, typer>=0.16.0, fpdf2>=2.8.2

Tooling:

• Replace black, flake8, isort and pyupgrade with ruff (check + format)
• Enable pyupgrade rules UP006/UP007, which only need Python 3.10
• Move mypy config into pyproject.toml; delete setup.cfg, mypy.ini, .isort.cfg and the dependabot configs (Renovate handles updates)
• Regenerate pylock.toml

CI:

• Test the minimal dependency versions on Python 3.10 (the old check only ran on 3.8, which was no longer in the matrix)
• Build the docs with warnings as errors
• Define PYTHON_LATEST, cache pip, least-privilege permissions, persist-credentials: false, cancel superseded PR runs
• Make the gitignored-files check actually detect committed ignored files

Docs & misc:

• Read the Docs: install the docs dependency group (it is not an extra)
• Add extract-links to the toctree and fix Sphinx warnings
• Stop test_extract_annotated_pages from writing into resources/
• Makefile: drop upload, make clean portable, use ruff in lint

[stefan6419846]

Isn't this already outdated? Python 3.15 has been released this month.