Bundle follow-up hardening improvements

Author: philippemnoel

.github/workflows/assign-github-issue.yml

@@ -11,6 +11,7 @@ on:
 
 # Required to assign the issue to the commenter
 permissions:
+  contents: read
   issues: write
 
 concurrency:

.github/workflows/check-typo.yml

@@ -10,6 +10,9 @@ on:
     types: [opened, synchronize, reopened, ready_for_review]
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 concurrency:
   group: check-typo-${{ github.head_ref || github.ref }}
   cancel-in-progress: true

.github/workflows/ci.yml

@@ -2,17 +2,24 @@ name: CI
 
 on:
   push:
-    branches: ["**"]
+    branches: [main]
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   lint-type-unit:
     runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.10", "3.11", "3.12"]
     steps:
       - uses: actions/checkout@v6
       - uses: actions/setup-python@v6
         with:
-          python-version: "3.11"
+          python-version: ${{ matrix.python-version }}
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip
@@ -26,9 +33,13 @@ jobs:
 
   integration:
     runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.10", "3.11", "3.12"]
     services:
       paradedb:
-        image: paradedb/paradedb:latest
+        image: paradedb/paradedb:0.21.10-pg18
         ports:
           - 5432:5432
         env:
@@ -44,7 +55,7 @@ jobs:
       - uses: actions/checkout@v6
       - uses: actions/setup-python@v6
         with:
-          python-version: "3.11"
+          python-version: ${{ matrix.python-version }}
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip
@@ -63,7 +74,7 @@ jobs:
           exit 1
       - name: Integration tests
         env:
-          PARADEDB_TEST_DSN: postgres://postgres:postgres@localhost:5432/postgres
+          PARADEDB_TEST_DSN: postgresql+psycopg://postgres:postgres@localhost:5432/postgres
         run: python -m pytest -m integration
       - name: Run examples
         env:

.github/workflows/lint-bash.yml

@@ -13,6 +13,9 @@ on:
       - ".github/workflows/lint-bash.yml"
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 concurrency:
   group: lint-bash-${{ github.head_ref || github.ref }}
   cancel-in-progress: true

.github/workflows/lint-format.yml

@@ -10,6 +10,9 @@ on:
     types: [opened, synchronize, reopened, ready_for_review]
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 concurrency:
   group: lint-format-${{ github.head_ref || github.ref }}
   cancel-in-progress: true

.github/workflows/lint-markdown.yml

@@ -14,6 +14,9 @@ on:
       - ".github/workflows/lint-markdown.yml"
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 concurrency:
   group: lint-markdown-${{ github.head_ref || github.ref }}
   cancel-in-progress: true

.github/workflows/lint-pr-title.yml

@@ -10,6 +10,7 @@ on:
     types: [opened, synchronize, reopened, ready_for_review, edited]
 
 permissions:
+  contents: read
   pull-requests: read
 
 concurrency:

.github/workflows/lint-yaml.yml

@@ -14,6 +14,9 @@ on:
       - ".github/workflows/lint-yaml.yml"
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 concurrency:
   group: lint-yaml-${{ github.head_ref || github.ref }}
   cancel-in-progress: true

CHANGELOG.md

@@ -2,6 +2,12 @@
 
 ## Unreleased
 
+### Changed
+
+- Hardened BM25 index introspection, validation, and CI/workflow configuration.
+
+## 0.1.0 - 2026-03-01
+
 ### Added
 
 - Full BM25 search/query helper set with advanced operators.

codecov.yml

@@ -8,12 +8,12 @@ coverage:
       default:
         target: auto
         threshold: 5%
-        informational: true
+        informational: false
     patch:
       default:
         target: 80%
         threshold: 5%
-        informational: true
+        informational: false
 
 comment:
   layout: "reach, diff, flags, files"