Additional CI tools and practices

[genedan]

I've read through the Pandas Contributing to the code base. I also did a scan of the other PyData libraries and identified some tools that they use, but we don't use:

pre-commit - seems like a tool to help run all the checks prior to commit/PR
isort - formats the module imports
ruff - linter, already a candidate for adoption
hypothesis - stochastic test case generator - could be useful?
airspeed velocity - performance benchmarking
towncrier - release note checks and automation

Security tools
CodeQL - Codebase vulnerability scanning (we probably should...)
zizmor - Security scanning for CI pipelines
dependency review - some pros over dependabot are that it checks for vulnerabilities before a PR is merged, and also license compliance.

Other tools

• There are some non-package, custom scripts that check whether any new features in a PR also have corresponding updated docs
• Automated deprecation tracking (DIY script)

Well, that's a lot of stuff. From this list, only ruff seems to be close to being adopted. If any of these things piques your interest as a must-have, feel free to chime in.

@hutch3232, is CodeQL enabled on the repo, and if not, could you flip the switch in the settings so that it is?

[kennethshsu]

I just enabled CodeQL, it says the initial scan will take a while, I'll keep an eye out and see what it reports back.