Add Scientific Python repo review checks to CI

[matthewfeickert]

• pre-commit

- repo: https://github.com/scientific-python/repo-review
  rev: <version>
  hooks:
    - id: repo-review
      additional_dependencies: ["repo-review[cli]", "sp-repo-review==<version>"]

• GitHub Actions

- uses: scientific-python/repo-review@<version>
  with:
    plugins: sp-repo-review

Originally posted by @matthewfeickert in https://github.com/scikit-hep/pyhf/issues/2623#issuecomment-3409773370

[matthewfeickert]

Post PR https://github.com/scikit-hep/pyhf/pull/2623:

Validate-PyProject

Checks [build-system], [project], [tool.black], [tool.cibuildwheel], [tool.hatch], [tool.maturin], [tool.mypy], [tool.pdm], [tool.poe], [tool.poetry], [tool.pyright], [tool.pytest], [tool.repo-review], [tool.ruff], [tool.scikit-build], [tool.setuptools_scm], [tool.taskipy], [tool.tombi], [tool.tox], [tool.ty], [tool.uv], [tool.setuptools]

?	Name	Description
✅	VPP001	Validate pyproject.toml

General

• Detected build backend: hatchling.build
• SPDX license expression: Apache-2.0

?	Name	Description
✅	PY001	Has a pyproject.toml
✅	PY002	Has a README.(md|rst) file
✅	PY003	Has a LICENSE* file
✅	PY004	Has docs folder
✅	PY005	Has tests folder
✅	PY006	Has pre-commit config
✅	PY007	Supports an easy task runner (nox, tox, pixi, etc.)

PyProject

?	Name	Description
✅	PP002	Has a proper build-system table
✅	PP003	Does not list wheel as a build-dep
✅	PP004	Does not upper cap Python requires
✅	PP005	Using SPDX project.license should not use deprecated trove classifiers
✅	PP301	Has pytest in pyproject
✅	PP302	Sets a minimum pytest to at least 6
✅	PP303	Sets the test paths
✅	PP304	Sets the log level in pytest
✅	PP305	Specifies xfail_strict
✅	PP306	Specifies strict config
✅	PP307	Specifies strict markers
✅	PP308	Specifies useful pytest summary
✅	PP309	Filter warnings specified

GitHub Actions

?	Name	Description
✅	GH100	Has GitHub Actions config
✅	GH101	Has nice names
✅	GH102	Auto-cancel on repeated PRs
✅	GH103	At least one workflow with manual dispatch trigger
✅	GH104	Use unique names for upload-artifact
✅	GH200	Maintained by Dependabot
✅	GH210	Maintains the GitHub action versions with Dependabot
✅	GH211	Do not pin core actions as major versions
✅	GH212	Require GHA update grouping

Pre-commit

?	Name	Description
✅	PC100	Has pre-commit-hooks
✅	PC110	Uses black or ruff-format
✅	PC111	Uses blacken-docs
✅	PC140	Uses a type checker
✅	PC160	Uses a spell checker
✅	PC170	Uses PyGrep hooks (only needed if rST present)
❌	PC180	Uses a markdown formatter Must have one of https://github.com/hukkin/mdformat, https://github.com/rbubley/mirrors-prettier, https://github.com/rvben/rumdl-pre-commit in .pre-commit-config.yaml
✅	PC190	Uses Ruff
✅	PC191	Ruff show fixes if fixes enabled
✅	PC192	Ruff uses `ruff-check` instead of `ruff` (legacy)
✅	PC901	Custom pre-commit CI message

MyPy

?	Name	Description
✅	MY100	Uses MyPy (pyproject config)
✅	MY101	MyPy strict mode
✅	MY102	MyPy show_error_codes deprecated
✅	MY103	MyPy warn unreachable
✅	MY104	MyPy enables ignore-without-code
✅	MY105	MyPy enables redundant-expr
✅	MY106	MyPy enables truthy-bool

Ruff

?	Name	Description
✅	RF001	Has Ruff config
✅	RF002	Target version must be set
✅	RF003	src directory doesn't need to be specified anymore (0.6+)
❌	RF101	Bugbear must be selected Must select the flake8-bugbear B checks. Recommended: [tool.ruff.lint] extend-select = [ "B", # flake8-bugbear ]
❌	RF102	isort must be selected Must select the isort I checks. Recommended: [tool.ruff.lint] extend-select = [ "I", # isort ]
✅	RF103	pyupgrade must be selected
✅	RF201	Avoid using deprecated config settings
✅	RF202	Use (new) lint config section

Documentation

?	Name	Description
✅	RTD100	Uses ReadTheDocs (pyproject config)
✅	RTD101	You have to set the RTD version number to 2
✅	RTD102	You have to set the RTD build image
✅	RTD103	You have to set the RTD python version
✅	RTD104	You have to specify a build configuration now for readthedocs.

Setuptools Config

?	Name	Description
⚠️	SCFG001	Avoid deprecated setup.cfg names