Use strict pylint settings

.github/workflows/release.yml

@@ -9,6 +9,17 @@ jobs:
     name: Publish a release
     runs-on: ubuntu-latest
 
+    # Specifying an environment is strongly recommended by PyPI.
+    # See https://github.com/pypa/gh-action-pypi-publish/tree/release/v1/?tab=readme-ov-file#trusted-publishing.
+    environment: release
+
+    permissions:
+      # This is needed for PyPI publishing.
+      # See https://github.com/pypa/gh-action-pypi-publish/tree/release/v1/?tab=readme-ov-file#trusted-publishing.
+      id-token: write
+      # This is needed for https://github.com/stefanzweifel/git-auto-commit-action.
+      contents: write
+
     strategy:
       matrix:
         python-version: ["3.12"]
@@ -83,7 +94,7 @@ jobs:
       - name: Checkout the latest tag - the one we just created
         run: |
           git fetch --tags
-          git checkout $(git describe --tags $(git rev-list --tags --max-count=1))
+          git checkout "$(git describe --tags "$(git rev-list --tags --max-count=1)")"
 
       - name: Create Linux binaries
         run: |

Makefile

@@ -7,6 +7,7 @@ SPHINXOPTS := -W
 
 .PHONY: lint
 lint: \
+    actionlint \
     check-manifest \
     doc8 \
     ruff \

lint.mk

@@ -2,6 +2,10 @@
 
 SHELL := /bin/bash -euxo pipefail
 
+.PHONY: actionlint
+actionlint:
+	actionlint
+
 .PHONY: ruff
 ruff:
 	ruff .
@@ -12,6 +16,10 @@ fix-ruff:
 	ruff --fix .
 	ruff format .
 
+.PHONY: actionlint
+actionlint:
+	actionlint
+
 .PHONY: mypy
 mypy:
 	mypy .

pyproject.toml

@@ -10,9 +10,28 @@
 
     # List of plugins (as comma separated values of python modules names) to load,
     # usually to register additional checkers.
+    # See https://chezsoi.org/lucas/blog/pylint-strict-base-configuration.html.
+    # We do not use the plugins:
+    # - pylint.extensions.code_style
+    # - pylint.extensions.magic_value
+    # - pylint.extensions.while_used
+    # as they seemed to get in the way.
     load-plugins = [
+        'pylint.extensions.bad_builtin',
+        'pylint.extensions.comparison_placement',
+        'pylint.extensions.consider_refactoring_into_while_condition',
         'pylint.extensions.docparams',
+        'pylint.extensions.dunder',
+        'pylint.extensions.eq_without_hash',
+        'pylint.extensions.for_any_all',
+        'pylint.extensions.mccabe',
         'pylint.extensions.no_self_use',
+        'pylint.extensions.overlapping_exceptions',
+        'pylint.extensions.private_import',
+        'pylint.extensions.redefined_loop_name',
+        'pylint.extensions.redefined_variable_type',
+        'pylint.extensions.set_membership',
+        'pylint.extensions.typing',
     ]
 
     # Allow loading of arbitrary C extensions. Extensions are imported into the
@@ -28,7 +47,11 @@
     # multiple time (only on the command line, not in the configuration file where
     # it should appear only once). See also the "--disable" option for examples.
     enable = [
+        'bad-inline-option',
+        'deprecated-pragma',
+        'file-ignored',
         'spelling',
+        'use-symbolic-message-instead',
         'useless-suppression',
     ]
 
@@ -181,6 +204,7 @@ dependencies = [
 ]
 [project.optional-dependencies]
 dev = [
+    "actionlint-py==1.6.26.11",
     "check-manifest==0.49",
     "doc8==1.1.1",
     "docker==7.0.0",