Add sum() to the extended stdlib, refresh dependencies and modernise CI

[hardbyte]

Closes #14.

Three related pieces of work: finishing the aggregation functions, refreshing dependencies, and making CI reproducible. Happy to split if you'd rather review them separately.

sum() — closes #14

cel.stdlib's core library now provides sum alongside min/max, following Kubernetes' CEL list library (the implementation the issue asked to match):

ctx = cel.Context()
add_stdlib_to_context(ctx)

cel.evaluate("sum([1, 2, 3])", ctx)                      # 6
cel.evaluate("sum(1, 2, 3.5)", ctx)                      # 6.5
cel.evaluate("items.map(i, i.weight).sum() == 1.0", ctx)  # True
cel.evaluate('sum([duration("1h"), duration("30m")])', ctx)

All numeric types plus duration; sum([]) is 0; booleans are rejected rather than counted as 1/0; numbers and durations cannot be mixed. Both call forms work, since CEL treats x.f() as f(x).

Why fold/reduce are not in this PR

They cannot be implemented in this wrapper:

• A CEL function receives its arguments already evaluated — in cel 0.14, FunctionContext.args is Vec<Cow<dyn Val>>. A fold needs the accumulator expression left unevaluated and re-bound for each element.
• The comprehension macros that do that (has, all, exists, existsOne, map, filter) are expanded by the parser from a fixed match in parser/macros.rs, which isn't extensible from outside the crate.

So fold/reduce have to arrive in cel-rust. This is now documented in the cel.stdlib docstring and in the standard-library reference, and the xfail tracker for it is kept so we notice if upstream adds it.

Upstream check (the "implement it upstream instead" question)

Checked against cel-rust main at v0.14.3 and cel-go, and the answer differs per function:

• Aggregations are not coming upstream. cel-rust 0.14.0 deliberately went the other way — its changelog has "(overloads) No more min or max by default" — and cel-go's math/lists extensions have greatest/least but no sum. None of min/max/sum are in the CEL spec; they're extension-library functions everywhere they exist, which is exactly what cel.stdlib is. cel-rust's own docs even use pub fn sum(Arguments(args): Arguments) as the example of a user-defined variadic function.
• fold/reduce are upstream-only, for the reasons above.

Dependencies

• cargo update inside the existing semver ranges: cel 0.14.0 → 0.14.3, PyO3 0.29.0 → 0.29.2, plus regex 1.13.1, serde 1.0.229, serde_json 1.0.151, thiserror 2.0.20, uuid 1.24.1.
• No security advisories: all 81 locked crates checked against OSV.
• uv.lock is now committed (removed from .gitignore) so CI resolves the same Python dependencies as local development.

CI

• Fixes a latent lint failure on main. Ruff 0.16 began formatting Python code blocks inside Markdown, so with today's ruff ruff format --check . fails on 14 README/docs files even with no Python change — the next push to main would have failed the lint job purely from the unpinned ruff>=0.12.7. Markdown is now excluded from the formatter (docs snippets are still executed by tests/test_docs.py) and ruff is pinned to the 0.16 line.
• Test matrix adds Python 3.13 and 3.14. Verified locally: the extension builds under PyO3 0.29 and the full suite passes on both.
• Security workflow runs uvx safety scan — safety check is retired, and uvx keeps the scanner out of this project's dev dependencies instead of mutating pyproject.toml mid-run.
• Claude workflow moves from the deprecated @beta tag to anthropics/claude-code-action@v1.
• tests/test_docs.py passes a sorted list rather than a generator to pytest.mark.parametrize — deprecated, and a hard error in pytest 10.
• The upstream-watch xfail reasons still cited cel 0.11; they now name 0.14.3 and distinguish real gaps from CEL-spec-mandated behaviour (no implicit numeric coercion).

Verification

cargo fmt --check, cargo clippy --all-targets --all-features -D warnings, cargo test, ruff format --check, ruff check, mypy python/cel, uvx ty check, and the full pytest suite (472 passed, 1 skipped, 6 xfailed) — all clean, on Python 3.11, 3.13 and 3.14.

---

Generated by Claude Code

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 20a90139fe

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".