Introduce CI/CD

[javihern98]

Adds GitHub Actions workflows adapted from vtlengine, plus the code changes mdmint needs to pass them.

Workflows

Workflow	Runs on	What it does
testing.yml (Testing)	PRs to master, merge queue, manual runs	Checks formatting (ruff format), lint (ruff check) and strict mypy, then runs pytest with an 80% coverage minimum. Runs on Ubuntu, macOS and Windows with Python 3.10–3.14.
version.yml (Version Consistency Check)	Pushes and PRs to master, merge queue	Installs the package and fails if the version in its metadata (from pyproject.toml) differs from mdmint.__version__.
create-release.yml (Create Release)	Manual runs	vtlengine's flow: creates a v<version> tag from pyproject.toml, writes release notes grouped by the type of issue each PR closes, then starts release.yml. The only change from vtlengine is that it no longer starts a docs workflow.
release.yml (Publish package)	A published release, a start from Create Release, or a manual run	Builds the sdist and a single py3-none-any wheel. mdmint is pure Python, so it needs no per-platform wheel builds. It runs twine check --strict, runs the tests against the installed wheel, then publishes to PyPI through trusted publishing, with attestations.

Actions are pinned to the same commit SHAs as in vtlengine.

Code changes

Each step is a separate commit:

1. Settings: a Poetry dev group (PEP 735), poetry.lock, and vtlengine's ruff, mypy and pytest settings. The dev extra is gone; dev tools now come from poetry install.
2. ruff format: a mechanical reformat. Ruff also formats Python code blocks in Markdown, which is why one line in docs/template-specimen.md changed.
3. Lint fixes: some security warnings don't apply here. Those are silenced with a short reason: yaml.load with a SafeLoader subclass, the mmdc subprocess call, and image downloads. The SHA-1 hashes used as cache keys are marked usedforsecurity=False.
4. Type hints: added so that mypy --strict passes. Runtime behaviour is unchanged except for two cases:
   • The importlib.resources fallback for Python < 3.9 is removed. It was dead code, since requires-python is >=3.9.
   • A missing page size or margin now counts as 0 instead of raising TypeError.
5. poetry.toml sets installer.re-resolve = true. Some packages (numpy, matplotlib, contourpy, fonttools, soupsieve) dropped Python 3.10 in their latest releases, so the lock holds two versions of each. Poetry 2.5 writes overlapping markers for those versions on Python 3.13+, triggered by the weasyprint extra. Installing straight from those markers puts both versions into the environment, which broke the first CI run (SyntaxError in fontTools on Ubuntu, Python 3.13). Re-resolving against the lock installs a single version of each.

Notes:

• The coverage minimum is 80%; vtlengine uses 85%, and mdmint is at 84% today.
• As in vtlengine, Poetry resolves dependencies for Python >= 3.10 only, so CI doesn't test 3.9, even though requires-python still allows it.

Testing

• Locally with Python 3.10, 3.12, 3.13 and 3.14 (poetry install --no-root --all-extras): formatting, lint and mypy are clean; 35 tests passed and 1 was skipped on each. The skipped test needs the Meaningful Data Word template, which isn't in the repo. Coverage is 84%.
• The poetry.toml fix: on Python 3.13, the default install puts two versions of five packages into the environment; with re-resolve, it installs one version of each.
• release.yml build job on Python 3.13: the build and twine check --strict pass. The tests pass against the installed wheel, and I checked that they import mdmint from site-packages, not the source tree.
• Version check step: passes with matching versions, and exits 1 when only pyproject.toml is bumped.

Before the first release

• PyPI: add a trusted publisher for mdmint: owner Meaningful-Data, repository mdmint, workflow release.yml, environment pypi.
• GitHub: create a pypi environment in the repository settings.
• Version bumps: change version in pyproject.toml and __version__ in mdmint/__init__.py together. The version check now enforces this.