build(deps): bump hynek/build-and-inspect-python-package from 2 to 2.18.0

[dependabot]

Bumps hynek/build-and-inspect-python-package from 2 to 2.18.0.

Release notes

Sourced from hynek/build-and-inspect-python-package's releases.

v2.18.0

Added

• New input: skip-sdist to skip building the source distribution. #228

v2.17.0

Fixed

• The action now passes Zizmor in pedantic mode. #212

v2.16.0

Added

• New include-free-threaded input. When set to 'true', free-threaded Python siblings (for example, 3.14t) are included in the version outputs for Python 3.14 and later, inserted inline after each matching version. #208

v2.15.0

Added

• The Python version used to build the package can now be configured using the python-version input. #191

v2.14.0

Changed

• Update tools such that they work on Python 3.14 (which is now 3.x on GitHub Actions). #182

• The action now ignores UV_PYTHON coming from the outside. #184

v2.13.0

Added

• New output: package_name is the name of the built package as stored in metadata. #162

• The package name is now part of the action summary which is helpful when you build more than one package from a repository. #169

Changed

• All GitHub actions are now pinned to exact hashes for better reproducibility and mild security improvements.

  Since chosen prefix SHA-1 hash collision attacks exist, this is but security theater against serious attackers.

v2.12.0

This release only updates our dependencies to support packaging metadata v2.4 (as created, for example, by recent Hatchling releases).

[!NOTE] To upload packages with metadata v2.4 (which is required for PEP 639 license metadata) using the official pypi-publish GitHub Action, you must make sure to use its v1.12.4 or later.

v2.11.0

... (truncated)

Changelog

Sourced from hynek/build-and-inspect-python-package's changelog.

3.0.1 - 2026-07-30

Fixed

• To avoid uv configuration interference with the project that is being built, the installation of our own tools is now ran in a different directory. Additionally, UV_EXCLUDE_NEWER is unset. #240

3.0.0 - 2026-07-30

Security

• Given the increase and supply-chain attacks and advancements in tooling (for example, pinact or GitHub's Dependabot), this action will stop force-tagging minor and micro releases. This means, there will be no @v3 or @v3.0 tag that gets updated and force-pushed with each update. Always tag with the full version and commit hash; use Zizmor to secure your actions if you can.

Changed

• Only updates of actions and build dependencies, notably including Twine 7 that adds support for packaging metadata 2.5 and PEP 794 – Import Name Metadata.

2.18.0 - 2026-05-11

Added

• New input: skip-sdist to skip building the source distribution. #228

2.17.0 - 2026-03-27

Fixed

• The action now passes Zizmor in pedantic mode. #212

2.16.0 - 2026-03-26

Added

• New input: include-free-threaded When set to 'true', free-threaded Python siblings (for example, 3.14t) are included in the version outputs for Python 3.14 and later, inserted inline after each matching version. #208

2.15.0 - 2026-03-19

... (truncated)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 92.58%. Comparing base (10bdb93) to head (6246bdb).

Additional details and impacted files

@@             Coverage Diff             @@
##           develop    #1441      +/-   ##
===========================================
+ Coverage    92.56%   92.58%   +0.01%     
===========================================
  Files          211      211              
  Lines        33224    33224              
===========================================
+ Hits         30755    30760       +5     
+ Misses        2469     2464       -5     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.