Add functionality for MAP estimation of parameters

.github/dependabot.yml

@@ -10,6 +10,11 @@ updates:
       day: "monday"
       time: "04:00"
       timezone: "Europe/Amsterdam"
+    # Wait a week after a release before proposing it: fresh releases are where
+    # compromised or yanked packages show up, and nothing here is urgent.
+    # Security updates are exempt from the cooldown by Dependabot itself.
+    cooldown:
+      default-days: 7
     open-pull-requests-limit: 10
     assignees:
       - "thomaspinder"
@@ -46,6 +51,8 @@ updates:
       day: "monday"
       time: "04:00"
       timezone: "Europe/Amsterdam"
+    cooldown:
+      default-days: 7
     open-pull-requests-limit: 5
     commit-message:
       prefix: "ci"

.github/workflows/auto-label.yml

@@ -1,6 +1,12 @@
 name: "Automatic Labeling"
 
-on:
+# `pull_request_target` is required, not incidental: labelling a PR needs write
+# access to the pull request, and the `pull_request` token is read-only for
+# fork PRs, which is most of them. The standard danger of this trigger is
+# running fork code with a privileged token, so this workflow never checks the
+# PR out and never executes anything from it — every step below talks to the
+# API only.
+on: # zizmor: ignore[dangerous-triggers]
   pull_request_target:
     types: [opened, synchronize, reopened]
   issues:
@@ -14,20 +20,19 @@
       issues: write
       pull-requests: write
 
+    # No checkout: `actions/labeler` reads .github/labeler.yml through the API,
+    # and nothing else here touches the working tree.
     steps:
-      - name: Checkout repository
-        uses: actions/checkout@v7
-
       - name: Auto-label based on files changed
-        if: github.event_name == 'pull_request'
-        uses: actions/labeler@v7
+        if: github.event_name == 'pull_request_target'
+        uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13 # v7.0.0
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           configuration-path: .github/labeler.yml
 
       - name: Size labeling for PRs
-        if: github.event_name == 'pull_request'
-        uses: codelytv/pr-size-labeler@v1
+        if: github.event_name == 'pull_request_target'
+        uses: codelytv/pr-size-labeler@095a41fca88b8764fd9e008ad269bcdb82bb38b9 # v1
         with:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           xs_label: 'size/xs'
@@ -45,7 +50,7 @@
 
       - name: Label ML-specific issues
         if: github.event_name == 'issues'
-        uses: actions/github-script@v9
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const title = context.payload.issue.title.toLowerCase();
@@ -143,8 +148,8 @@
             }
 
       - name: Label PRs based on content
-        if: github.event_name == 'pull_request'
-        uses: actions/github-script@v9
+        if: github.event_name == 'pull_request_target'
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const title = context.payload.pull_request.title.toLowerCase();
@@ -203,4 +208,4 @@
                 issue_number: context.payload.pull_request.number,
                 labels: labels
               });
-            }
+            }

.github/workflows/build_docs.yml

@@ -15,10 +15,10 @@ on:
       - main
   workflow_dispatch:
 
-permissions:
-  contents: read
-  pages: write
-  id-token: write
+# Pages publication is confined to `deploy-docs`; the build job only reads the
+# repository. Keeping `pages`/`id-token` off the workflow level means the
+# notebook execution step never runs with a deployment-capable token.
+permissions: {}
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -30,19 +30,21 @@ jobs:
     # Full render on main executes every example notebook for real.
     timeout-minutes: 120
     runs-on: ubuntu-latest
+    permissions:
+      contents: read # checkout, including the asv-results branch
     steps:
       - name: Check out the code
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
       - name: Set up Python
-        uses: actions/setup-python@v7
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
         with:
           python-version: "3.11"
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
         with:
           version: "latest"
           enable-cache: true
@@ -58,7 +60,7 @@ jobs:
         # refuses to overwrite an existing key). Combined with jupyter-cache's
         # own content-hash invalidation, this makes the cache accumulate every
         # successfully executed notebook instead of freezing partial progress.
-        uses: actions/cache@v6
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: |
             docs/_build/.jupyter_cache
@@ -83,15 +85,15 @@ jobs:
         # traceback of any failed notebook to <outdir>/reports/<docname>.err.log
         # rather than aborting. Nothing else in the deploy log carries it.
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: notebook-error-logs
           path: docs/_build/html/reports
           if-no-files-found: ignore
           retention-days: 14
 
       - name: Checkout benchmark results
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: asv-results
           path: .asv-results
@@ -110,7 +112,7 @@ jobs:
         continue-on-error: true
 
       - name: Upload Pages artifact
-        uses: actions/upload-pages-artifact@v5
+        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
         with:
           path: docs/_build/html
 
@@ -123,6 +125,9 @@ jobs:
     if: github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
     timeout-minutes: 15
+    permissions:
+      pages: write # deploy to GitHub Pages
+      id-token: write # OIDC verification of the deployment
     concurrency:
       group: pages
       cancel-in-progress: false
@@ -132,4 +137,4 @@ jobs:
     steps:
       - name: Deploy documentation
         id: deployment
-        uses: actions/deploy-pages@v5
+        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5

.github/workflows/commit-lint.yml

@@ -13,9 +13,10 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Check commit message format
         run: |
@@ -51,4 +52,4 @@ jobs:
             echo "::warning::This is a warning only - PR can still be merged"
           else
             echo "All commit messages follow conventional commit format ✅"
-          fi
+          fi

.github/workflows/full_render_notebooks.yml

@@ -11,30 +11,39 @@ on:
   release:
     types: [published]
 
-permissions:
-  contents: read
-  issues: write
+# Only the failure-reporting job files an issue. The render job itself, which
+# executes every example notebook, runs with a read-only token.
+permissions: {}
 
 jobs:
   full-render:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read # checkout
     timeout-minutes: 90
     steps:
       - name: Check out the code
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
       - name: Set up Python
-        uses: actions/setup-python@v7
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
         with:
           python-version: "3.11"
 
+      # The three cache steps below carry `zizmor: ignore[cache-poisoning]`.
+      # zizmor flags them because `release: published` makes this a publishing
+      # workflow, and a cache written under a publishing event can be restored
+      # by later runs. That is exactly what the guards prevent: caching is
+      # switched off whenever the run was triggered by a release, so only the
+      # scheduled and manual runs read or write the cache. zizmor evaluates the
+      # workflow statically and cannot see through the expression.
       - name: Install uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7 # zizmor: ignore[cache-poisoning]
         with:
           version: "latest"
-          enable-cache: true
+          enable-cache: ${{ github.event_name != 'release' }}
 
       - name: Install docs dependencies
         run: uv sync --frozen --extra docs
@@ -46,7 +55,8 @@ jobs:
         # Same accumulate-always cache as build_docs.yml: the Sunday full render
         # warms `.jupyter_cache`, so the next production deploy reuses real
         # figures instead of re-executing every notebook (or erroring out).
-        uses: actions/cache@v6
+        if: github.event_name != 'release' # see the enable-cache note above
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 # zizmor: ignore[cache-poisoning]
         with:
           path: |
             docs/_build/.jupyter_cache
@@ -64,7 +74,8 @@ jobs:
           echo "version=$(uv run --extra docs python -c 'from importlib.metadata import version; print(version("playwright"))')" >> "$GITHUB_OUTPUT"
 
       - name: Restore the Playwright browser cache
-        uses: actions/cache@v6
+        if: github.event_name != 'release' # see the enable-cache note above
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 # zizmor: ignore[cache-poisoning]
         with:
           path: ~/.cache/ms-playwright
           key: playwright-${{ runner.os }}-${{ steps.playwright.outputs.version }}
@@ -92,7 +103,7 @@ jobs:
 
       - name: Upload the link-check report
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: docs-linkcheck
           path: docs/_build/linkcheck
@@ -101,10 +112,12 @@ jobs:
   open-issue-on-failure:
     runs-on: ubuntu-latest
     needs: full-render
+    permissions:
+      issues: write # open the failure report
     if: failure()
     steps:
       - name: Open GitHub issue
-        uses: actions/github-script@v9
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const title = `Notebook full render failed (${context.runNumber})`;

.github/workflows/integration.yml

@@ -9,6 +9,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+# The job only reads the checkout and runs the integration script.
+permissions: {}
+
 jobs:
   integration-tests:
     name: Run Integration Tests
@@ -22,17 +25,18 @@ jobs:
       fail-fast: true
     steps:
       - name: Check out the code
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 1
+          persist-credentials: false
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v7
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
         with:
           python-version: ${{ matrix.python-version }}
 
       # Install uv
       - name: Install uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
         with:
           version: "latest"
           enable-cache: true