From c58b22fbcef91ff485dd085cebb55c51b102fb32 Mon Sep 17 00:00:00 2001 From: Steven Looman Date: Sat, 10 Oct 2026 15:56:14 +0200 Subject: [PATCH 1/3] Add zizmor, fix findings --- .github/dependabot.yml | 4 +++ .github/workflows/ci-cd.yml | 46 ++++++++++++++++++------------ .github/workflows/pr_towncrier.yml | 13 ++++++++- .github/workflows/zizmor.yml | 28 ++++++++++++++++++ 4 files changed, 71 insertions(+), 20 deletions(-) create mode 100644 .github/workflows/zizmor.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml index ba235f0..70d6b5f 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -4,6 +4,8 @@ updates: directory: "/" schedule: interval: "monthly" + cooldown: + default-days: 7 - package-ecosystem: "pip" directories: - "/" @@ -14,3 +16,5 @@ updates: python-dependencies: patterns: - "*" + cooldown: + default-days: 7 diff --git a/.github/workflows/ci-cd.yml b/.github/workflows/ci-cd.yml index 9f12011..1105aa2 100644 --- a/.github/workflows/ci-cd.yml +++ b/.github/workflows/ci-cd.yml @@ -4,6 +4,8 @@ on: - push - pull_request +permissions: {} + concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true @@ -16,19 +18,24 @@ jobs: name: Markdown Lint runs-on: ubuntu-latest steps: - - uses: DavidAnson/markdownlint-cli2-action@v24 + - uses: DavidAnson/markdownlint-cli2-action@21c1be1b93ad9ed58fa840aacc3f279cde2a72ff # v24.2.0 with: globs: "**/*.md" lint_test_build: + name: Lint, test and build runs-on: ubuntu-latest + permissions: + contents: read # Check out the repository strategy: matrix: python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"] steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Set up Python ${{ matrix.python-version }} - uses: actions/setup-python@v7 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: ${{ matrix.python-version }} allow-prereleases: true @@ -43,12 +50,12 @@ jobs: - name: Build package run: python -m build - name: Upload build artifacts - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: python-package-distributions-${{ matrix.python-version }} path: dist/ - name: Upload coverage reports to Codecov - uses: codecov/codecov-action@v7 + uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1 if: ${{ hashFiles('coverage-py312.xml') != '' }} with: files: coverage-py312.xml @@ -66,31 +73,32 @@ jobs: name: pypi url: https://pypi.org/p/python-didl-lite permissions: - id-token: write + id-token: write # Trusted publishing to PyPI via OIDC steps: - name: Download all the dists - uses: actions/download-artifact@v8 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: python-package-distributions-${{ env.publish-python-version }} path: dist/ - name: Publish to PyPI - uses: pypa/gh-action-pypi-publish@release/v1 + uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2 github-release: + name: Create GitHub Release needs: - publish-to-pypi runs-on: ubuntu-latest permissions: - contents: write - id-token: write + contents: write # Create the GitHub Release and upload assets + id-token: write # Sign the dists with Sigstore via OIDC steps: - name: Download all the dists - uses: actions/download-artifact@v8 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: python-package-distributions-${{ env.publish-python-version }} path: dist/ - name: Sign the dists with Sigstore - uses: sigstore/gh-action-sigstore-python@v3.5.0 + uses: sigstore/gh-action-sigstore-python@790bc6befb9d733738f18d8f895854b453640ec9 # v3.5.0 with: inputs: >- ./dist/*.tar.gz @@ -100,16 +108,16 @@ jobs: GITHUB_TOKEN: ${{ github.token }} run: >- gh release create - '${{ github.ref_name }}' - --repo '${{ github.repository }}' + "${GITHUB_REF_NAME}" + --repo "${GITHUB_REPOSITORY}" --notes "" - name: Upload artifact signatures to GitHub Release env: GITHUB_TOKEN: ${{ github.token }} run: >- gh release upload - '${{ github.ref_name }}' dist/** - --repo '${{ github.repository }}' + "${GITHUB_REF_NAME}" dist/** + --repo "${GITHUB_REPOSITORY}" publish-to-testpypi: name: Publish to TestPyPI @@ -122,15 +130,15 @@ jobs: name: testpypi url: https://test.pypi.org/p/python-didl-lite permissions: - id-token: write + id-token: write # Trusted publishing to PyPI via OIDC steps: - name: Download all the dists - uses: actions/download-artifact@v8 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: python-package-distributions-${{ env.publish-python-version }} path: dist/ - name: Publish to TestPyPI - uses: pypa/gh-action-pypi-publish@release/v1 + uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2 with: repository-url: https://test.pypi.org/legacy/ continue-on-error: true diff --git a/.github/workflows/pr_towncrier.yml b/.github/workflows/pr_towncrier.yml index f192341..a050ada 100644 --- a/.github/workflows/pr_towncrier.yml +++ b/.github/workflows/pr_towncrier.yml @@ -3,12 +3,23 @@ name: Pull Request requires towncrier file on: - pull_request +permissions: {} + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + jobs: pr_require_towncrier_file: + name: Require towncrier file + permissions: + contents: read # Check out the repository runs-on: ubuntu-latest if: github.event.pull_request.user.login != 'dependabot[bot]' && github.event.pull_request.user.login != 'pre-commit-ci[bot]' steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Ensure towncrier file exists env: PR_NUMBER: ${{ github.event.number }} diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml new file mode 100644 index 0000000..5d3772b --- /dev/null +++ b/.github/workflows/zizmor.yml @@ -0,0 +1,28 @@ +name: GitHub Actions Security Analysis with zizmor + +on: + push: + branches: + - development + pull_request: + +permissions: {} + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +jobs: + zizmor: + name: Run zizmor + runs-on: ubuntu-latest + permissions: + security-events: write # Upload findings to GitHub code scanning + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + - name: Run zizmor + uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4 + with: + persona: pedantic From 99ff4b55ea821177bd7329015402f07123b065f0 Mon Sep 17 00:00:00 2001 From: Steven Looman Date: Sat, 10 Oct 2026 16:08:41 +0200 Subject: [PATCH 2/3] Add Towncrier fragment --- changes/71.misc.rst | 1 + 1 file changed, 1 insertion(+) create mode 100644 changes/71.misc.rst diff --git a/changes/71.misc.rst b/changes/71.misc.rst new file mode 100644 index 0000000..ba91bdc --- /dev/null +++ b/changes/71.misc.rst @@ -0,0 +1 @@ +Add zizmor to the GitHub Actions workflow for security analysis From 9c87c8f9b6fee7385b16aaf116d191a14172dd08 Mon Sep 17 00:00:00 2001 From: Steven Looman Date: Sat, 10 Oct 2026 16:12:22 +0200 Subject: [PATCH 3/3] Prevent duplicate build jobs --- .github/workflows/ci-cd.yml | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/.github/workflows/ci-cd.yml b/.github/workflows/ci-cd.yml index 1105aa2..f3b1571 100644 --- a/.github/workflows/ci-cd.yml +++ b/.github/workflows/ci-cd.yml @@ -1,8 +1,12 @@ name: Build on: - - push - - pull_request + push: + branches: + - master + tags: + - "*" + pull_request: permissions: {} @@ -39,7 +43,6 @@ jobs: with: python-version: ${{ matrix.python-version }} allow-prereleases: true - cache: 'pip' - name: Install dependencies run: | python -m pip install --upgrade pip