🔧 Maintenance round

.github/codecov.yml

@@ -12,8 +12,10 @@ coverage:
   range: 60..90
   precision: 1
   status:
-    project: off
-    patch: off
+    project:
+      default: false
+    patch:
+      default: false
 
 flag_management:
   default_rules:

.github/workflows/cd.yml

@@ -7,10 +7,14 @@ on:
     paths:
       - .github/workflows/cd.yml
 
+permissions: {}
+
 jobs:
   build-sdist:
     name: 🐍 Packaging
     uses: munich-quantum-toolkit/workflows/.github/workflows/reusable-python-packaging-sdist.yml@579203ef22082fa5d5483412f442e50d0c5ff4a7 # v2.2.2
+    permissions:
+      contents: read
 
   # Builds wheels on all supported platforms using cibuildwheel.
   # The wheels are uploaded as GitHub artifacts `dev-cibw-*` or `cibw-*`, depending on whether the workflow is triggered from a PR or a release, respectively.
@@ -31,6 +35,8 @@ jobs:
     uses: munich-quantum-toolkit/workflows/.github/workflows/reusable-python-packaging-wheel-cibuildwheel.yml@579203ef22082fa5d5483412f442e50d0c5ff4a7 # v2.2.2
     with:
       runs-on: ${{ matrix.runs-on }}
+    permissions:
+      contents: read
 
   deploy:
     if: github.event_name == 'release' && github.event.action == 'published'
@@ -39,11 +45,11 @@ jobs:
     environment:
       name: pypi
       url: https://pypi.org/p/mqt.debugger
+    needs: [build-sdist, build-wheel]
     permissions:
-      id-token: write
-      attestations: write
+      attestations: write # Needed to attest the built artifacts
       contents: read
-    needs: [build-sdist, build-wheel]
+      id-token: write # Needed to attest and to publish to PyPI
     steps:
       - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:

.github/workflows/ci.yml

@@ -13,10 +13,14 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   change-detection:
     name: 🔍 Change
     uses: munich-quantum-toolkit/workflows/.github/workflows/reusable-change-detection.yml@579203ef22082fa5d5483412f442e50d0c5ff4a7 # v2.2.2
+    permissions:
+      contents: read
 
   cpp-tests-ubuntu:
     name: 🇨 Test 🐧
@@ -37,6 +41,8 @@ jobs:
       runs-on: ${{ matrix.runs-on }}
       compiler: ${{ matrix.compiler }}
       preset-name: ${{ matrix.preset }}
+    permissions:
+      contents: read
 
   cpp-tests-macos:
     name: 🇨 Test 🍎
@@ -57,6 +63,8 @@ jobs:
       runs-on: ${{ matrix.runs-on }}
       compiler: ${{ matrix.compiler }}
       preset-name: ${{ matrix.preset }}
+    permissions:
+      contents: read
 
   cpp-tests-windows:
     name: 🇨 Test 🏁
@@ -77,6 +85,8 @@ jobs:
       runs-on: ${{ matrix.runs-on }}
       compiler: ${{ matrix.compiler }}
       preset-name: ${{ matrix.preset }}
+    permissions:
+      contents: read
 
   cpp-linter:
     name: 🇨 Lint
@@ -90,6 +100,9 @@ jobs:
       install-pkgs: "nanobind==2.14.0"
       setup-python: true
       cpp-linter-extra-args: "-std=c++20"
+    permissions:
+      contents: read
+      pull-requests: write # Needed to post review comments
 
   python-tests:
     name: 🐍 Test
@@ -109,6 +122,8 @@ jobs:
     uses: munich-quantum-toolkit/workflows/.github/workflows/reusable-python-tests.yml@579203ef22082fa5d5483412f442e50d0c5ff4a7 # v2.2.2
     with:
       runs-on: ${{ matrix.runs-on }}
+    permissions:
+      contents: read
 
   python-coverage:
     name: 🐍 Coverage
@@ -128,12 +143,16 @@ jobs:
       check-stubs: true
       enable-ty: true
       enable-mypy: false
+    permissions:
+      contents: read
 
   build-sdist:
     name: 🚀 CD
     needs: change-detection
     if: fromJSON(needs.change-detection.outputs.run-cd)
     uses: munich-quantum-toolkit/workflows/.github/workflows/reusable-python-packaging-sdist.yml@579203ef22082fa5d5483412f442e50d0c5ff4a7 # v2.2.2
+    permissions:
+      contents: read
 
   build-wheel:
     name: 🚀 CD
@@ -154,6 +173,8 @@ jobs:
     uses: munich-quantum-toolkit/workflows/.github/workflows/reusable-python-packaging-wheel-cibuildwheel.yml@579203ef22082fa5d5483412f442e50d0c5ff4a7 # v2.2.2
     with:
       runs-on: ${{ matrix.runs-on }}
+    permissions:
+      contents: read
 
   # this job does nothing and is only used for branch protection
   required-checks-pass:

.github/workflows/release-drafter.yml

@@ -10,8 +10,8 @@ permissions: {}
 jobs:
   update_release_draft:
     name: Run
+    runs-on: ubuntu-slim
     permissions:
       contents: write
-    runs-on: ubuntu-slim
     steps:
       - uses: release-drafter/release-drafter@34d80673e067bdc0c24568d3af899c216adcfaa9 # v7.7.0

.github/workflows/templating.yml

@@ -8,19 +8,22 @@ on:
       - ".github/workflows/templating.yml"
   workflow_dispatch: # Allow manual triggering
 
+permissions: {}
+
 jobs:
   render-template:
     name: Render template
     runs-on: ubuntu-slim
     permissions:
-      contents: write
-      pull-requests: write
+      contents: read
     steps:
       - id: create-token
         uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         with:
           client-id: ${{ secrets.APP_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
+          permission-contents: write # Needed to push the templating branch
+          permission-pull-requests: write # Needed to open the templating pull request
       - uses: munich-quantum-toolkit/templates@d0c5adb86d19a5095f871cb6184cfdab298e943c # v1.4.2
         with:
           token: ${{ steps.create-token.outputs.token }}

.github/workflows/update-mqt-core.yml

@@ -18,6 +18,8 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   update-mqt-core:
     name: ⬆️ Update MQT Core
@@ -27,3 +29,6 @@ jobs:
     secrets:
       APP_ID: ${{ secrets.APP_ID }}
       APP_PRIVATE_KEY: ${{ secrets.APP_PRIVATE_KEY }}
+    permissions:
+      contents: write # Needed to push the update branch
+      pull-requests: write # Needed to open the update pull request

.github/workflows/upstream.yml

@@ -12,6 +12,8 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   qiskit-upstream-tests:
     name: 🐍⚛️
@@ -23,6 +25,8 @@ jobs:
     with:
       runs-on: ${{ matrix.runs-on }}
       setup-z3: true
+    permissions:
+      contents: read
 
   create-issue-on-failure:
     name: Create issue on failure

.gitignore

@@ -130,7 +130,7 @@ dmypy.json
 # Cython debug symbols
 cython_debug/
 
-# setuptools_scm
+# vcs-versioning
 /python/**/_version.py
 
 # SKBuild cache dir

.pre-commit-config.yaml

@@ -30,14 +30,23 @@ repos:
   - repo: https://github.com/python-jsonschema/check-jsonschema
     rev: 0.38.0
     hooks:
+      - id: check-codecov
+        priority: 0
       - id: check-github-workflows
         priority: 0
       - id: check-readthedocs
         priority: 0
 
+  ## Check for security issues in GitHub Actions workflows
+  - repo: https://github.com/zizmorcore/zizmor-pre-commit
+    rev: v1.29.0
+    hooks:
+      - id: zizmor
+        priority: 0
+
   ## Check best practices for scientific Python code
   - repo: https://github.com/scientific-python/cookie
-    rev: 2026.06.18
+    rev: 2026.08.14
     hooks:
       - id: sp-repo-review
         additional_dependencies: ["repo-review[cli]"]

CMakeLists.txt

@@ -5,7 +5,7 @@
 #
 # Licensed under the MIT License
 
-cmake_minimum_required(VERSION 3.26)
+cmake_minimum_required(VERSION 3.26...4.4)
 cmake_policy(SET CMP0069 NEW)
 set(CMAKE_POLICY_DEFAULT_CMP0069 NEW)
 

docs/conf.py

@@ -10,9 +10,7 @@
 
 from __future__ import annotations
 
-import warnings
 from importlib import metadata
-from pathlib import Path
 from typing import TYPE_CHECKING
 
 import pybtex.plugin
@@ -23,24 +21,12 @@
     from pybtex.database import Entry
     from pybtex.richtext import HRef
 
-ROOT = Path(__file__).parent.parent.resolve()
-
 
 try:
-    from mqt.debugger import __version__ as version
+    version = metadata.version("mqt.debugger")
 except ModuleNotFoundError:
-    try:
-        version = metadata.version("mqt.debugger")
-    except ModuleNotFoundError:
-        msg = (
-            "Package should be installed to produce documentation! "
-            "Assuming a modern git archive was used for version discovery."
-        )
-        warnings.warn(msg, stacklevel=1)
-
-        from setuptools_scm import get_version
-
-        version = get_version(root=str(ROOT), fallback_root=ROOT)
+    msg = "mqt.debugger must be installed to build the documentation"
+    raise ModuleNotFoundError(msg) from None
 
 # Filter git details from version
 release = version.split("+")[0]

docs/references.md

@@ -1,8 +1,8 @@
 # References
 
-_MQT Debugger_ has a strong foundation in peer‑reviewed research. Many of its
+MQT Debugger has a strong foundation in peer‑reviewed research. Many of its
 built‑in algorithms are based on methods published in scientific journals and
-conferences. For an overview of _MQT Debugger_ and its features, see
+conferences. For an overview of MQT Debugger and its features, see
 {cite:p}`rovara2024debugging`. If you want to cite this article, please use the
 following BibTeX entry:
 
@@ -16,7 +16,7 @@ following BibTeX entry:
 }
 ```
 
-_MQT Debugger_ is part of the Munich Quantum Toolkit, which is described in
+MQT Debugger is part of the Munich Quantum Toolkit, which is described in
 {cite:p}`mqt`. If you want to cite the Munich Quantum Toolkit, please use the
 following BibTeX entry:
 

pyproject.toml

@@ -9,8 +9,8 @@
 [build-system]
 requires = [
   "nanobind~=2.14.0",
-  "setuptools-scm>=9.2.2",
-  "scikit-build-core~=1.0.3",
+  "vcs-versioning>=2.3.0",
+  "scikit-build-core>=1.0.3",
 ]
 build-backend = "scikit_build_core.build"
 
@@ -28,6 +28,7 @@ license-files = [ "LICENSE" ]
 
 classifiers = [
     "Development Status :: 5 - Production/Stable",
+    "Intended Audience :: Information Technology",
     "Intended Audience :: Science/Research",
     "Natural Language :: English",
     "Operating System :: MacOS",
@@ -44,6 +45,7 @@ classifiers = [
     "Programming Language :: Python :: 3.14",
     "Programming Language :: Python :: 3.15",
     "Topic :: Scientific/Engineering :: Electronic Design Automation (EDA)",
+    "Topic :: Scientific/Engineering :: Quantum Computing",
     "Typing :: Typed",
 ]
 requires-python = ">=3.10"
@@ -91,8 +93,6 @@ build-dir = "build/{wheel_tag}"
 
 # Only install the Python package component
 install.components = ["mqt-debugger_Python"]
-
-metadata.version.provider = "scikit_build_core.metadata.setuptools_scm"
 sdist.include = ["python/mqt/debugger/_version.py"]
 sdist.exclude = [
     "**/.github",
@@ -104,6 +104,10 @@ sdist.exclude = [
     "**/tests",
 ]
 
+[[tool.dynamic-metadata]]
+provider = "vcs_versioning"
+
+
 [tool.check-sdist]
 sdist-only = ["python/mqt/debugger/_version.py"]
 git-only = [
@@ -117,7 +121,7 @@ BUILD_MQT_DEBUGGER_TESTS = "OFF"
 BUILD_MQT_DEBUGGER_APP = "OFF"
 
 
-[tool.setuptools_scm]
+[tool.vcs-versioning]
 write_to = "python/mqt/debugger/_version.py"
 
 
@@ -255,9 +259,6 @@ mch = "mch"
 
 [tool.repo-review.ignore]
 GH200 = "We use Renovate instead of Dependabot"
-MY100 = "We use ty instead of mypy"
-PC111 = "We use ruff instead of blacken-docs"
-PC140 = "We use ty instead of mypy"
 PC160 = "We use a mirror of crate-ci/typos"
 PC170 = "We do not use rST files anymore"
 
@@ -303,8 +304,8 @@ repair-wheel-command = "delvewheel repair -w {dest_dir} {wheel} --namespace-pkg
 [dependency-groups]
 build = [
     "nanobind~=2.14.0",
-    "setuptools-scm>=9.2.2",
-    "scikit-build-core~=1.0.3",
+    "vcs-versioning>=2.3.0",
+    "scikit-build-core>=1.0.3",
 ]
 test = [
     "pytest>=9.0.1",
@@ -325,7 +326,6 @@ docs = [
     "myst-nb>=1.3.0",
     "openqasm-pygments>=0.2.0",
     "pandas[output-formatting]>=2.1.2",
-    "setuptools-scm>=9.2.2",
     "sphinx>=8.1.3",
     "sphinx>=8.2.3; python_version >= '3.11'",
     "sphinx-copybutton>=0.5.2",