[dsgou]

What and why

Adds more repo health checks.

CI (ci.yml)

• lint: now also runs mypy src. It uses the pydantic plugin and skips the generated gRPC code.
• test-lowest: runs the tests on Python 3.10 with the lowest versions pyproject.toml allows, so those minimums stay true.
• coverage: runs the tests with branch coverage and posts a coverage comment on the PR. It fails if coverage is below 90%. On main, it saves the coverage badge to the python-coverage-comment-action-data branch, which the action creates on its first run.
• build: builds the package and runs twine check --strict.

Release (release.yml)
Publishing a GitHub release builds the package and uploads it to PyPI. It uses trusted publishing, so no API token is stored, and it adds PEP 740 attestations.

Code: fixes the mypy errors. Behavior doesn't change.

• query_params held two different types. .model_dump() is now chained onto it, in 3 places.
• Added # type: ignore[prop-decorator] on the @computed_field properties, as pydantic's docs recommend.

Other

• dev extra: added mypy==2.3.1, pytest-cov, types-grpcio and types-protobuf. uv.lock is updated.
• README: added Coverage and "checked with mypy" badges.
• .gitignore: added .coverage and dist/.
• CONTRIBUTING and the PR template now cover mypy, coverage and how to release.

Actions pinned by commit SHA in both workflows, with the version kept as a comment. A tag can be moved to new code; a SHA can't. This matters most for the release job, which can publish to PyPI. Dependabot updates the SHA and the comment.

Related issue or ticket

ALTO-5546

How it was tested

• CI on this PR: all 8 jobs pass. The coverage action posted its comment: 92.05% for the whole project, and 100% of the lines this PR changed.
• Locally on Python 3.10 and 3.13: uv lock --check, ruff, mypy src and pytest --cov pass (68 tests).
• Lowest versions on 3.10 (grpcio 1.73.1, protobuf 6.31.1, pydantic 2.11.7, pytest 8.0.0, pytest-cov 7.0.0): 68 passed.
• pip path: after pip install -e ".[dev]", mypy and pytest pass.
• coverage report fails when coverage is below the minimum.
• Not tested: the release workflow. It runs only when a GitHub release is published.

Setup needed

• On PyPI, open the project's Publishing settings and add a GitHub trusted publisher:

  • owner: BehavioralSignalTechnologies
  • repo: behavioralsignals-python
  • workflow: release.yml
  • environment: pypi

  This is needed before the 1.0.0 release.

• Check that no branch rule protects python-coverage-comment-action-data.

• The coverage badge shows as broken until the first CI run on main after merge.

• PRs from forks get no coverage comment, because their token is read-only. The 90% check still runs for them.

Checklist

• Ran ruff check, ruff format, mypy src and pytest
• Updated README.md and examples/, if usage changed (usage didn't change; only badges were added)

[github-actions]

Coverage report

Click to see where and how coverage changed

File	Statements	Missing	Coverage	Coverage (new stmts)	Lines missing
src/behavioralsignals
behavioral.py
deepfakes.py
models.py
Project Total

This report was generated by python-coverage-comment-action