v0.1.2 - uv, hatchling, ruff, and CI

Toolchain and packaging release. No change to the tool surface.

uv + hatchling + ruff, Python 3.11+

• Build backend — setuptools to hatchling. The version stays a single source of truth in src/bigfix_root_mcp/__init__.py, read via [tool.hatch.version]. The old package-data rule is gone: hatchling ships everything inside the package directory, so the MCP resource markdown (loaded at runtime via importlib.resources) is included without one.
• Environment — uv, with a committed uv.lock. uv sync replaces pip install -e ".[dev]"; dev dependencies moved to a PEP 735 [dependency-groups] group. Resolution is delayed 7 days via exclude-newer, so a release published minutes ago — the likeliest to be a compromised one — is not picked up immediately.
• Python floor — now 3.11+ (was 3.10).
• Lint and format — ruff replaces black, flake8, and pydocstringformatter, with 22 rule families enabled. There is deliberately no pylint hook: ruff's PL* families are a port of pylint and report the same findings on this codebase, and pylint's one unique finding here is a false positive on a load-bearing except ToolError: raise.
• Types — mypy now runs over src/.

Two real defects, found by the new checks

• _snippet() in errors.py was annotated as taking str but is called with exception objects throughout the error-translation decorator. Its body already coerced with str(text), so this was a lie in the signature rather than a crash — now typed as object.
• build_target_xml() in clientquery.py ended in an implicit fallthrough, so it could have returned None instead of a (str, int | None) tuple if the exactly-one-targeting-mode guard above it were ever changed. The final branch is now explicit.

Also fixed: lxml, pydantic, and requests are imported directly by src/ but were only arriving transitively through besapi and fastmcp. They are now declared dependencies.

Continuous integration

New test and pre-commit workflows, plus a Dependabot configuration covering the uv, github-actions, and pre-commit ecosystems on a weekly schedule with a 7-day cooldown.

The test workflow installs the built wheel into a throwaway environment and reads the packaged MCP resources back out of it, so a packaging change that drops them fails CI rather than silently breaking the server at runtime.

Every action is pinned to a full commit SHA, checkouts run with persist-credentials: false, and the workflows are audited by zizmor in CI. The pre-commit stack also gained bandit, slyp, pyupgrade, pygrep-hooks, pyroma, check-jsonschema, and the uv lock/audit/build hooks. Hook revisions are SHA-pinned with the tag in a trailing comment.

Dependency resolution fix

[tool.uv] constraint-dependencies pinned fastmcp-slim==4.0.0b1 while [project.dependencies] separately pinned fastmcp==4.0.0b1. Since fastmcp pins its own matching fastmcp-slim[client] at the same version, the two could never be bumped together — the first Dependabot PR to try (4.0.0b1 to 4.0.0b3) failed with dependency_file_not_resolvable. The constraint exists only to name fastmcp-slim, because uv permits prereleases just for explicitly named packages, so it is now >=4.0.0b1 and the exact version follows the fastmcp== pin.

Documentation

The README now recommends the official BigFix Platform MCP server and states plainly that this server's capabilities are intentionally limited where the official one's are not.

191 tests, still running entirely offline.