Modernize the toolchain, drop dead Python versions and close all 16 Dependabot alerts

.github/CONTRIBUTING.md

@@ -18,16 +18,33 @@ We accept contributions via Pull Requests on [Github](https://github.com/devRMA/
 
 - **One pull request per feature** - If you want to do more than one thing, send multiple pull requests.
 
+## Setup
+
+This project targets Python 3.10+ and is managed with [Poetry](https://python-poetry.org/).
+The exact interpreter and Poetry versions are pinned in `.tool-versions` for
+[asdf](https://asdf-vm.com/) users.
+
+```bash
+poetry install
+```
+
 ## Running Tests
 
 ```bash
-poetry run task test
+poetry run pytest --cov=stopwatch --cov-report=term-missing
 ```
 
-## Running Formatters
+## Linting and Formatting
+
+Linting, import sorting and formatting are all handled by [Ruff](https://docs.astral.sh/ruff/),
+and type checking by [mypy](https://mypy-lang.org/):
 
 ```bash
-poetry run task format
+poetry run ruff check --fix . # lint and sort imports
+poetry run ruff format . # format
+poetry run mypy stopwatch # type check
 ```
 
+CI runs the same commands with `--check`, so run them before pushing.
+
 **Happy coding**!

.github/workflows/quality.yml

@@ -0,0 +1,55 @@
+name: Quality
+
+on:
+ push:
+ branches: [main]
+ pull_request:
+
+permissions:
+ contents: read
+
+concurrency:
+ group: quality-${{ github.ref }}
+ cancel-in-progress: true
+
+jobs:
+ quality:
+ name: Lint, format and types
+ runs-on: ubuntu-latest
+ timeout-minutes: 10
+
+ steps:
+ - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+ with:
+ persist-credentials: false
+
+ - name: Set up Python
+ id: setup-python
+ uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+ with:
+ python-version: "3.12"
+
+ - name: Install Poetry
+ run: |
+ pipx install poetry==2.4.1
+ poetry config virtualenvs.in-project true
+
+ - name: Load cached venv
+ id: cached-venv
+ uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+ with:
+ path: .venv
+ key: venv-${{ runner.os }}-py${{ steps.setup-python.outputs.python-version }}-${{ hashFiles('poetry.lock') }}
+
+ - name: Install dependencies
+ if: steps.cached-venv.outputs.cache-hit != 'true'
+ run: poetry install --no-interaction
+
+ - name: Lint
+ run: poetry run ruff check --output-format=github .
+
+ - name: Check formatting
+ run: poetry run ruff format --check --diff .
+
+ - name: Type check
+ run: poetry run mypy stopwatch