AutoAir 0.2.2

Added

• Contributors: pre-commit hooks (uv run pre-commit install) for ruff, the generated
  configuration reference, the hard-coded audit, version agreement, prettier, eslint, the MDX
  check and actionlint, plus mypy before push; pre-commit is in the dev dependencies.

Security

• CI and release workflows pin third-party GitHub Actions (setup-uv, Docker build actions, PyPI
  publish) to full commit SHAs, so a moved tag cannot change what builds and publishes AutoAir
  releases; Dependabot keeps the pins current. astral-sh/setup-uv moves to v10 (Node 24).
• AI prompt-injection shield: removing <untrusted-data> tags from untrusted text now takes
  linear time; a document full of unclosed tags could stall a request for seconds.
• Deploy target dialog: the suggested git provider comes from the remote's parsed hostname,
  matched on whole domain labels, so a look-alike host (bitbucket.org.example.com) or a
  provider name in the URL path no longer selects that provider's API.
• Docker Compose demo (tls profile): the generated server key is readable by its owner
  only (mode 0600 instead of 0640).

Install: pip install autoair==0.2.2 ·
Image: ghcr.io/ctolon/autoair:0.2.2