feat: return rules in alphabetical order

.github/workflows/github-actionlint.yml

@@ -1,4 +1,4 @@
-# SPDX-FileCopyrightText: © 2025 open-nudge <https://github.com/open-nudge>
+# SPDX-FileCopyrightText: © 2025, 2026 open-nudge <https://github.com/open-nudge>
 # SPDX-FileContributor: szymonmaszke <github@maszke.co>
 #
 # SPDX-License-Identifier: Apache-2.0
@@ -54,7 +54,7 @@ jobs:
           persist-credentials: false
       - name: "Check workflow files"
         # yamllint disable rule:line-length
-        uses: "docker://rhysd/actionlint:1.7.1@sha256:435ecdb63b1169e80ca3e136290072548c07fc4d76a044cf5541021712f8f344" # v1.7.1
+        uses: "docker://rhysd/actionlint:1.7.12@sha256:b1934ee5f1c509618f2508e6eb47ee0d3520686341fec936f3b79331f9315667" # v1.7.12
         # yamllint enable rule:line-length
         with:
           args: "-color"

.github/workflows/pre-commit-config.yml

@@ -1,4 +1,4 @@
-# SPDX-FileCopyrightText: © 2025 open-nudge <https://github.com/open-nudge>
+# SPDX-FileCopyrightText: © 2025, 2026 open-nudge <https://github.com/open-nudge>
 # SPDX-FileContributor: szymonmaszke <github@maszke.co>
 #
 # SPDX-License-Identifier: Apache-2.0
@@ -36,7 +36,7 @@ jobs:
     # yamllint enable rule:line-length
     with:
       check: "pre-commit-config"
-      group: "pre-commit"
+      group: "prek"
       sparse-checkout: |
         .pre-commit-config.yaml
 ...

.github/workflows/pre-commit-hooks.yml

@@ -1,4 +1,4 @@
-# SPDX-FileCopyrightText: © 2025 open-nudge <https://github.com/open-nudge>
+# SPDX-FileCopyrightText: © 2025, 2026 open-nudge <https://github.com/open-nudge>
 # SPDX-FileContributor: szymonmaszke <github@maszke.co>
 #
 # SPDX-License-Identifier: Apache-2.0
@@ -36,7 +36,7 @@ jobs:
     # yamllint enable rule:line-length
     with:
       check: "pre-commit-hooks"
-      group: "pre-commit"
+      group: "prek"
       sparse-checkout: |
         .pre-commit-hooks.yaml
 ...

.github/workflows/release-slsa-provenance-reusable.yml

@@ -1,4 +1,4 @@
-# SPDX-FileCopyrightText: © 2025 open-nudge <https://github.com/open-nudge>
+# SPDX-FileCopyrightText: © 2025, 2026 open-nudge <https://github.com/open-nudge>
 # SPDX-FileContributor: szymonmaszke <github@maszke.co>
 #
 # SPDX-License-Identifier: Apache-2.0
@@ -82,7 +82,7 @@ jobs:
     # yamllint disable rule:line-length
     # Currently this action needs to be referred by tag. More details at:
     # https://github.com/slsa-framework/slsa-github-generator#verification-of-provenance
-    uses: "slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.1.0"
+    uses: "slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.1.0" # zizmor: ignore[unpinned-uses]
     # yamllint enable rule:line-length
     with:
       provenance-name: "slsa-provenance-multiple-${{ github.sha }}.intoto.jsonl"

.github/workflows/release.yml

@@ -1,4 +1,4 @@
-# SPDX-FileCopyrightText: © 2025 open-nudge <https://github.com/open-nudge>
+# SPDX-FileCopyrightText: © 2025, 2026 open-nudge <https://github.com/open-nudge>
 # SPDX-FileContributor: szymonmaszke <github@maszke.co>
 #
 # SPDX-License-Identifier: Apache-2.0
@@ -27,21 +27,27 @@ jobs:
   sboms:
     name: "SBOMs"
     permissions:
-      id-token: "write"
-      attestations: "write"
+      actions: "read" # Required to upload SARIF file to CodeQL.
+      security-events: "write" # Required to upload SARIF file to security tab.
+      id-token: "write" # Required to get GH token to attest.
+      attestations: "write" # Required to upload attestation.
+      artifact-metadata: "write" # Required to create artifact metadata.
       contents: "read"
     # yamllint disable rule:line-length
     uses: "open-nudge/opentemplate/.github/workflows/release-sboms-reusable.yml@main" # zizmor: ignore[unpinned-uses]
     # yamllint enable rule:line-length
+    with:
+      upload-grype-artifact: true
+      upload-grype-sarif: true
 
   sarifs:
     name: "SARIFs"
     permissions:
       # Required to upload SARIF file to CodeQL.
       # See: https://github.com/github/codeql-action/issues/2117
-      actions: "read"
+      actions: "read" # Required to upload SARIF file to CodeQL.
       # Writing security events to upload SARIF file to security tab
-      security-events: "write"
+      security-events: "write" # Required to upload SARIF file to security tab.
       # Only need to read contents
       contents: "read"
     # yamllint disable rule:line-length
@@ -52,13 +58,12 @@ jobs:
     name: "Tests"
     permissions:
       contents: "read"
-    # yamllint disable rule:line-length
-    uses: "open-nudge/opentemplate/.github/workflows/tests-reusable.yml@main" # zizmor: ignore[unpinned-uses]
+    uses: "./.github/workflows/tests-reusable.yml"
 
   docs:
     name: "Docs"
     permissions:
-      contents: "write"
+      contents: "write" # Required to write documentation to gh-pages.
     # yamllint disable rule:line-length
     uses: "open-nudge/opentemplate/.github/workflows/run-reusable.yml@main" # zizmor: ignore[unpinned-uses]
     # yamllint enable rule:line-length
@@ -109,17 +114,18 @@ jobs:
       - "package-create"
     permissions:
       contents: "read"
-      pull-requests: "read"
+      pull-requests: "read" # Required to read PR metadata for changelog.
     # yamllint disable rule:line-length
     uses: "open-nudge/opentemplate/.github/workflows/run-reusable.yml@main" # zizmor: ignore[unpinned-uses]
     # yamllint enable rule:line-length
     with:
       download: true
+      full-checkout: true
       download-name: "dist-${{ github.sha }}"
       # yamllint disable rule:line-length
       command: |
         mkdir -p CHANGELOGS-${{ github.sha }}
-        export PYTHON_PACKAGE_VERSION="$(echo dist-${{ github.sha }}/dist/*.tar.gz | cut -d '-' -f 2 | cut -d '.' -f 1-3)"
+        export PYTHON_PACKAGE_VERSION=$(basename dist-${{ github.sha }}/dist/*.tar.gz | cut -d '-' -f 2)
         pdm run changelog > CHANGELOGS-${{ github.sha }}/CHANGELOG-${{ github.sha }}.md
         pdm run changelog-latest > CHANGELOGS-${{ github.sha }}/LATEST.md
       # yamllint enable rule:line-length
@@ -175,23 +181,23 @@ jobs:
     steps:
       - name: "Harden Runner"
         # yamllint disable rule:line-length
-        uses: "step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0" # v2.12.0
+        uses: "step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450" # v2.19.1
         # yamllint enable rule:line-length
         with:
           disable-sudo: true
           egress-policy: "block"
           allowed-endpoints: "${{ matrix.repository.endpoints }}"
       - name: "Download artifacts"
         # yamllint disable rule:line-length
-        uses: "actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093" # v4.3.0
+        uses: "actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c" # v8.0.1
         with:
           name: "dist-${{ github.sha }}"
           path: "dist"
       - name: "Upload python package"
         if: >
           ! matrix.repository.skip
         # yamllint disable rule:line-length
-        uses: "pypa/gh-action-pypi-publish@76f52bc884231f62b9a034ebfe128415bbaabdfc" # v1.12.4
+        uses: "pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e" # v1.13.0
         # yamllint enable rule:line-length
         with:
           repository-url: "${{ matrix.repository.url }}"
@@ -215,7 +221,7 @@ jobs:
         # yamllint enable rule:indentation
       - name: "Upload artifacts"
         # yamllint disable rule:line-length
-        uses: "actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02" # v4.6.2
+        uses: "actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a" # v7.0.1
         # yamllint enable rule:line-length
         with:
           name: "dist-${{ github.sha }}"
@@ -233,8 +239,8 @@ jobs:
     permissions:
       # Required to upload SARIF file to CodeQL.
       # See: https://github.com/github/codeql-action/issues/2117
-      actions: "read"
-      contents: "write"
+      actions: "read" # Required to read the workflow path.
+      contents: "write" # Required to add assets to the release.
       id-token: "write" # To sign the provenance.
     # yamllint disable rule:line-length
     uses: "open-nudge/opentemplate/.github/workflows/release-slsa-provenance-reusable.yml@main" # zizmor: ignore[unpinned-uses]
@@ -247,7 +253,7 @@ jobs:
     needs:
       - "slsa-provenance"
     permissions:
-      contents: "write"
+      contents: "write" # Required to push release assets and documentation.
     # yamllint disable rule:line-length
     uses: "open-nudge/opentemplate/.github/workflows/release-upload.yml@main" # zizmor: ignore[unpinned-uses]
     # yamllint enable rule:line-length

.github/workflows/run-reusable.yml

@@ -1,4 +1,4 @@
-# SPDX-FileCopyrightText: © 2025 open-nudge <https://github.com/open-nudge>
+# SPDX-FileCopyrightText: © 2025, 2026 open-nudge <https://github.com/open-nudge>
 # SPDX-FileContributor: szymonmaszke <github@maszke.co>
 #
 # SPDX-License-Identifier: Apache-2.0
@@ -113,7 +113,7 @@ jobs:
     permissions:
       contents: "read"
     timeout-minutes: "${{ inputs.timeout-minutes }}"
-    runs-on: "ubuntu-latest"
+    runs-on: "${{ inputs.os }}"
     steps:
       - name: "Harden Runner"
         # yamllint disable rule:line-length
@@ -214,6 +214,7 @@ jobs:
 
       # nosemgrep
       - name: "Run command" # zizmor: ignore[template-injection]
+        shell: "bash"
         env:
           # GH_TOKEN is used by, for example, zizmor
           GH_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
@@ -222,9 +223,6 @@ jobs:
         run: |
           ${{ inputs.command }}
 
-      - name: "Check repository content"
-        run: >
-          ls -la
       - name: "Upload artifacts"
         if: >
           inputs.upload-path != ''

.github/workflows/tests-reusable.yml

@@ -1,4 +1,4 @@
-# SPDX-FileCopyrightText: © 2025 open-nudge <https://github.com/open-nudge>
+# SPDX-FileCopyrightText: © 2025, 2026 open-nudge <https://github.com/open-nudge>
 # SPDX-FileContributor: szymonmaszke <github@maszke.co>
 #
 # SPDX-License-Identifier: Apache-2.0
@@ -48,9 +48,7 @@ jobs:
       Tests | ${{ matrix.os }} | python-${{ matrix.python }}
     permissions:
       contents: "read"
-    # yamllint disable rule:line-length
-    uses: "open-nudge/opentemplate/.github/workflows/run-reusable.yml@main" # zizmor: ignore[unpinned-uses]
-    # yamllint enable rule:line-length
+    uses: "./.github/workflows/run-reusable.yml"
     with:
       # yamllint disable rule:line-length
       command: |
@@ -59,6 +57,7 @@ jobs:
       # yamllint enable rule:line-length
       sparse-checkout: |
         **.py
+        tests/**
       group: "tests"
       core: true
       # yamllint disable rule:line-length
@@ -78,9 +77,7 @@ jobs:
     needs: "tests-reusable"
     permissions:
       contents: "read"
-    # yamllint disable rule:line-length
-    uses: "open-nudge/opentemplate/.github/workflows/run-reusable.yml@main" # zizmor: ignore[unpinned-uses]
-    # yamllint enable rule:line-length
+    uses: "./.github/workflows/run-reusable.yml"
     with:
       # yamllint disable rule:line-length
       command: |

.github/workflows/tests.yml

@@ -1,4 +1,4 @@
-# SPDX-FileCopyrightText: © 2025 open-nudge <https://github.com/open-nudge>
+# SPDX-FileCopyrightText: © 2025, 2026 open-nudge <https://github.com/open-nudge>
 # SPDX-FileContributor: szymonmaszke <github@maszke.co>
 #
 # SPDX-License-Identifier: Apache-2.0
@@ -36,7 +36,5 @@ jobs:
     name: "Tests"
     permissions:
       contents: "read"
-    # yamllint disable rule:line-length
-    uses: "open-nudge/opentemplate/.github/workflows/tests-reusable.yml@main" # zizmor: ignore[unpinned-uses]
-    # yamllint enable rule:line-length
+    uses: "./.github/workflows/tests-reusable.yml"
 ...

.pre-commit-config.yaml

@@ -1,4 +1,4 @@
-# SPDX-FileCopyrightText: © 2025 open-nudge <https://github.com/open-nudge>
+# SPDX-FileCopyrightText: © 2025, 2026 open-nudge <https://github.com/open-nudge>
 # SPDX-FileContributor: szymonmaszke <github@maszke.co>
 #
 # SPDX-License-Identifier: Apache-2.0
@@ -22,7 +22,7 @@ repos:
   #
   ##############################################################################
   - repo: "https://github.com/siderolabs/conform"
-    rev: "e1fdd4c4624bafa674a905595a26c8d0797ddb6c"  # frozen: v0.1.0-alpha.30
+    rev: "cfa5066377ea6a751f2df3979a24a65cdc61974e"  # frozen: v0.1.0-alpha.31
     hooks:
       # pre-push due to PGP signature
       - id: "conform"
@@ -34,14 +34,14 @@ repos:
         entry: "conform enforce"
         pass_filenames: false
   - repo: "https://github.com/trufflesecurity/trufflehog"
-    rev: "f15cb8b37b9b70056bc82a8eb7151f75fad27a71"  # frozen: v3.90.13
+    rev: "6f3c981e7b77f235fd2702dd74af25fc4b72bf11"  # frozen: v3.96.0
     hooks:
       - id: "trufflehog"
         alias: "secrets"
         name: "<<<CHECK>>> Secrets"
         verbose: true
   - repo: "https://github.com/google/osv-scanner/"
-    rev: "8b6727b2c439cdea8bc3a033bf7c76d76cbaee08"  # frozen: v2.2.4
+    rev: "a258868211a57052da6bd323f758b8388dee02bb"  # frozen: v2.5.0
     hooks:
       - id: "osv-scanner"
         name: "<<<CHECK>>> OSV Scanner"
@@ -50,7 +50,7 @@ repos:
           - "--licenses=MIT,Apache-2.0,BSD-2-Clause,BSD-3-Clause,Unlicense,Zlib,OFL-1.1,0BSD,PSF-2.0"
           - "./"
   - repo: "https://github.com/errata-ai/vale"
-    rev: "27593b0e0e7eb8f0c2b7fae0d93fa1cfaabceb2f"  # frozen: v3.13.0
+    rev: "bc78bf3a639f29eef5c6bc3f0680105a82ef46f7"  # frozen: v3.17.1
     hooks:
       - id: "vale"
         alias: "setup-natural-language"
@@ -62,14 +62,14 @@ repos:
         stages:
           - "pre-commit"
   - repo: "https://github.com/errata-ai/vale"
-    rev: "27593b0e0e7eb8f0c2b7fae0d93fa1cfaabceb2f"  # frozen: v3.13.0
+    rev: "bc78bf3a639f29eef5c6bc3f0680105a82ef46f7"  # frozen: v3.17.1
     hooks:
       - id: "vale"
         alias: "natural-language"
         name: "<<<CHECK>>> Natural language"
         verbose: true
   - repo: "https://github.com/rhysd/actionlint"
-    rev: "e7d448ef7507c20fc4c88a95d0c448b848cd6127"  # frozen: v1.7.8
+    rev: "914e7df21a07ef503a81201c76d2b11c789d3fca"  # frozen: v1.7.12
     hooks:
       - id: "actionlint"
         alias: "github-actions-actionlint"
@@ -338,6 +338,7 @@ repos:
         entry: "pdm run -v check-security"
         language: "system"
         require_serial: true
+        exclude: "^pdm.lock$"
       - id: "release"
         name: "<<<CHECK>>> Release"
         entry: "pdm run -v check-release"

.yamllint.yml

@@ -1,4 +1,4 @@
-# SPDX-FileCopyrightText: © 2025 open-nudge <https://github.com/open-nudge>
+# SPDX-FileCopyrightText: © 2025, 2026 open-nudge <https://github.com/open-nudge>
 # SPDX-FileContributor: szymonmaszke <github@maszke.co>
 #
 # SPDX-License-Identifier: Apache-2.0
@@ -45,7 +45,7 @@ rules:
   key-duplicates: "enable"
   key-ordering: "disable"
   line-length:
-    max: 80
+    max: 110
     allow-non-breakable-words: true
     allow-non-breakable-inline-mappings: false
   new-line-at-end-of-file: "enable"

README.md

@@ -1,5 +1,5 @@
 <!--
-SPDX-FileCopyrightText: © 2025 open-nudge <https://github.com/open-nudge>
+SPDX-FileCopyrightText: © 2025, 2026 open-nudge <https://github.com/open-nudge>
 SPDX-FileContributor: szymonmaszke <github@maszke.co>
 
 SPDX-License-Identifier: Apache-2.0
@@ -75,6 +75,7 @@ import lintkit
 # Set the name of the linter
 lintkit.settings.name = "NOUTILS"
 
+
 class _NoUtils(lintkit.check.Regex, lintkit.loader.Python, lintkit.rule.Node):
     def regex(self):
         # Regex to match util(s) variations in function/class name
@@ -89,22 +90,25 @@ class _NoUtils(lintkit.check.Regex, lintkit.loader.Python, lintkit.rule.Node):
     def message(self, _):
         return f"{self.ast_class()} name contains util(s) word"
 
+
 # Concrete rules and their codes
 # Disabling linter using noqas supported out of the box!
 class ClassNoUtils(_NoUtils, code=0):  # noqa: NOUTILS0
     # ast type we want to focus on in this rule
     def ast_class(self):
         return ast.ClassDef
 
+
 class FunctionNoUtils(_NoUtils, code=1):  # noqa: NOUTILS0
     def ast_class(self):
         return ast.FunctionDef
 
+
 lintkit.run(["linter.py", "file1.py", "file2.py"])
 
 # Example output
-#/path/file1.py:23:17 NOUTILS0: ClassDef name contains util(s) word
-#/path/file2.py:73:21 NOUTILS1: FunctionDef name contains util(s) word
+# /path/file1.py:23:17 NOUTILS0: ClassDef name contains util(s) word
+# /path/file2.py:73:21 NOUTILS1: FunctionDef name contains util(s) word
 ```
 
 ## Installation