[qartik]

Description

Refresh CI and release tooling in response to the eMudhra / emSign CA certificate security incident, and migrate the development simulator to Selene 0.3.

The dependency refresh selected Zig 0.17, which has no Windows artifacts and caused the Windows Python smoke job to fail during installation. Zig 0.17 also has a reported linker-order regression affecting Selene's macOS panic handling. Constrain Zig to the 0.16 series on all platforms and require Windows-compatible artifacts during resolution.

Changes

• Update setup-uv to v10.3.0, cibuildwheel to v4.3 (currently v4.3.3, with patched pip and certifi constraints), and the hugrenv installer to v1.1.1, preserving release-workflow commit pins.
• Update cargo-binstall, Typos, and Ruff, and refresh Python development dependencies.
• Migrate to selene-sim~=0.3.7, resolving selene-core==0.3.3 and selene-formats==0.1.1. Existing runner imports and output handling continue to work without source changes.
• Add ziglang~=0.16.0 as a uv constraint and declare Windows AMD64 as a required resolution environment; regenerate uv.lock.

The lockfile does not contain pip or certifi; its refresh also includes dependency updates unrelated to the incident. These repository changes do not upgrade existing user environments or system CA stores.

Validation

• make test: 235 Rust tests and Python smoke tests passed with Selene 0.3.
• make lint with the project virtual environment activated and LLVM 21 configured.
• uv lock --check and git diff --check.
• Frozen Windows dependency dry runs passed for Python 3.10, 3.12, and 3.14.
• Snyk Python dependency scan after migration: no issues reported. Snyk Code scan passed for the initial tooling refresh; first-party source remains unchanged.
• make audit passed for the initial tooling refresh: no vulnerabilities reported; six existing unic-* unmaintained-crate warnings remain. Rust dependencies are unchanged by the migration.

Cross-platform runtime behavior and wheel builds require hosted CI/release validation. No public API or first-party source behavior changes; new tests and regenerated Python stubs are not applicable.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-21T13:57:28.759579Z	571a3cc	PR opened
🔒 Security Review	✅ Completed 2026-10-21T14:00:05.175773Z	571a3cc	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[mauriziocolosimo-qtm]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Secrets	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 571a3cc94a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Copilot]

🟡 Changes recommended

The locked Zig release lacks Windows installation artifacts, blocking Windows Python smoke tests.

No open issues 🎉

What changed in this PR

Refreshes qir-qis development and release tooling following the emSign CA incident, without changing first-party APIs.

Changes:

• Updates CI actions and release installers, preserving existing installer commit pins.
• Updates Typos and Ruff.
• Refreshes Python development dependencies and lockfile metadata.

File	Description
uv.lock	Refreshes Python dependencies and artifacts.
.pre-commit-config.yaml	Updates Typos and Ruff hooks.
.github/​workflows/​wheels-release.yml	Updates uv, hugrenv, and cibuildwheel.
.github/​workflows/​typos.yml	Aligns CI Typos version with local hooks.
.github/​workflows/​rust-release.yml	Updates pinned hugrenv installer.
.github/​workflows/​robustness.yml	Updates hugrenv and cargo-binstall.
.github/​workflows/​CI.yml	Updates dependency setup actions.

_{Review effort: Balanced}