v0.9.0

Added

• Python 3.14 to the classifiers and the CI matrix. The suite passes on
  it, and nothing in the dependencies held it back; it was left out only
  because the classifiers did not already name it.
• Continuous integration on GitHub Actions, which this project had none
  of. Every push and pull request now lints, checks formatting, type
  checks, and runs the suite on 3.12 and 3.13, the versions the
  pyproject.toml classifiers claim. A second job installs the oldest
  numpy, scipy, and matplotlib that pyproject.toml allows, with
  --resolution lowest-direct, so that the version floors are a
  tested promise rather than a hopeful one; the lock file pins the
  newest of each, so nothing else exercises them. A third audits the
  workflows with zizmor, the part of the repository that can mint a
  PyPI credential having otherwise been read by eye alone. That job
  restores the uv cache without saving it, since it installs what the
  3.13 leg installs and the two would otherwise race to write one key.
  Coverage goes to Coveralls from the 3.13 leg.
• Releases publish from a tag rather than from a laptop. just release
  refuses a dirty tree, a branch other than master, a master behind
  its upstream, an empty Unreleased section, or an existing tag; then
  lints and tests; then shows the entries waiting to ship beside the
  version each kind of bump would produce, and asks which to cut. It
  bumps the version, closes out the CHANGELOG, commits, and tags.
  Pushing the tag publishes. just release-check runs the refusals on
  their own.
• The release workflow waits on the whole CI run before it uploads
  anything, confirms the tag sits on master and matches the version
  in pyproject.toml, and authenticates to PyPI with
  trusted publishing, so there is no API token to paste, store, or
  leak. It signs a PEP 740 attestation for each distribution
  against the same identity, and creates a GitHub release carrying the
  CHANGELOG section for that version as its notes.
• Dependabot keeps the pinned actions and the lock file moving. The
  actions in both workflows are pinned to commit SHAs, which a fix
  published upstream does not reach on its own the way a moving tag
  would, so pinning without something to move it would amount to
  staying on one commit forever. Dependabot reads pyproject.toml and
  uv.lock together as well, so a dependency update arrives as a lock
  file change that CI checks with uv sync --locked rather than as a
  resolution done on the runner.
• scripts/smoke_test_wheel.py, which installs the built wheel where
  src/ cannot be reached and without the plotting extra, then
  checks the version, every public name, and py.typed. Every other
  check runs against the source tree with matplotlib installed, so this
  is the only one that can catch a packaging mistake, and the only one
  that can tell whether matplotlib is still optional. just build and
  the release workflow run the same command.
• py.typed, so that the type hints already written reach anyone
  installing the package rather than stopping at this repository.
• A coverage floor of 95%, which is what the suite covers today. Below
  that the run fails, so uncovered code has to arrive with either a
  test or a deliberate edit to the floor.
• just doc, just up-all, and just lint, and a Justfile that is
  otherwise line for line the one in applyaf, so that moving
  between the two projects does not mean learning a second set of
  recipe names.

Changed

• Type checking is done by pyright rather than ty, which is
  still a 0.0.x release, and it runs inside just lint rather than as
  a separate just check that every caller had to remember. Reaching
  it through lint means just build and just release cannot skip
  it. scipy-stubs is a new dev dependency: without it pyright
  cannot see the window functions in scipy.signal.windows.
• plot_spectrogram() and plot_peak_hold() are declared to a type
  checker under TYPE_CHECKING, so an editor offers their real
  signatures instead of names that appear from nowhere. They still
  arrive through the module's __getattr__ at run time, so a plain
  import siganalysis still does not import matplotlib.
• The ruff rule set is selected explicitly in pyproject.toml rather
  than left at the default, so that it is a deliberate choice. The
  handful of places the new rules object to are deliberate, and each
  carries a noqa saying so.
• The license is declared as an SPDX expression with license-files,
  which is what replaced the License :: classifier that used to
  carry it.
• .python-version is tracked rather than ignored. It decides the
  interpreter a contributor's uv sync builds against, and the file
  was being read while being excluded from the repository.

Removed

• just deploy, which published from a laptop against a pasted PyPI
  token, and just test-all, which ran the suite against each
  supported Python locally because there was no CI to do it. The
  release workflow and the CI matrix replace them.
• AUTHORS.md, along with the pointer to it in the copyright notice.
  The repository history is the record of who wrote what.