From d0978c0da251612d243550ada08fa6811cd19f9e Mon Sep 17 00:00:00 2001 From: Daniele Nicolodi Date: Sun, 16 Aug 2026 22:56:20 +0200 Subject: [PATCH 1/2] CI: update actions Pin actions not owned by GitHub via commit hash. For these actions, the commit has seems a more stable and trustworthy identifier than the tag. --- .github/workflows/docs.yml | 8 ++++---- .github/workflows/release.yml | 10 +++++----- .github/workflows/tests.yml | 24 ++++++++++++------------ 3 files changed, 21 insertions(+), 21 deletions(-) diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml index bc293c40a..0687269af 100644 --- a/.github/workflows/docs.yml +++ b/.github/workflows/docs.yml @@ -26,15 +26,15 @@ jobs: build: runs-on: ubuntu-latest steps: - - uses: actions/setup-python@v5 + - uses: actions/setup-python@v7 with: python-version: '3.11' - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 with: ref: ${{ github.event.inputs.tag || github.ref }} - run: python -m pip install --group docs - run: python -m sphinx -W docs/ build/docs/ - - uses: actions/upload-pages-artifact@v3 + - uses: actions/upload-pages-artifact@v5 with: path: build/docs/ @@ -48,4 +48,4 @@ jobs: runs-on: ubuntu-latest if: ${{ github.ref == 'refs/heads/main' }} steps: - - uses: actions/deploy-pages@v4 + - uses: actions/deploy-pages@v5 diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 09737f7bc..ff7e31283 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -17,13 +17,13 @@ jobs: build: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 - - uses: actions/setup-python@v5 + - uses: actions/checkout@v7 + - uses: actions/setup-python@v7 with: python-version: '3.14' - run: python -m pip install build - run: python -m build - - uses: actions/upload-artifact@v4 + - uses: actions/upload-artifact@v7 with: path: dist/* @@ -37,10 +37,10 @@ jobs: permissions: id-token: write steps: - - uses: actions/download-artifact@v4 + - uses: actions/download-artifact@v8 with: merge-multiple: true path: dist - - uses: pypa/gh-action-pypi-publish@release/v1 + - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2 with: print-hash: true diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index 4f837e5af..8c01254c6 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -108,10 +108,10 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@v7 - name: Set up target Python - uses: actions/setup-python@v5 + uses: actions/setup-python@v7 with: python-version: ${{ matrix.python }} allow-prereleases: true @@ -143,7 +143,7 @@ jobs: run: python -m pytest --showlocals -vv --cov --cov-report=xml - name: Upload coverage report - uses: codecov/codecov-action@v4 + uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0 if: ${{ always() }} env: CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} @@ -160,10 +160,10 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@v7 - name: Set up target Python - uses: actions/setup-python@v5 + uses: actions/setup-python@v7 with: python-version: ${{ matrix.python }} @@ -171,7 +171,7 @@ jobs: run: python -m pip install ninja - name: Setup MSVC - uses: bus1/cabuild/action/msdevshell@e22aba57d6e74891d059d66501b6b5aed8123c4d # v1 + uses: bus1/cabuild/action/msdevshell@06ea2833eef61e9b0d0ce0d728416e617e4fb1fe # v1 with: architecture: x64 @@ -197,10 +197,10 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@v7 - name: Setup Cygwin - uses: cygwin/cygwin-install-action@v2 + uses: cygwin/cygwin-install-action@3f0a3f9f988f7e96b8c18098ae05eaec175f5b52 # v6 with: packages: >- python39 @@ -232,7 +232,7 @@ jobs: # Cygwin Python cannot use binary wheels from PyPI. Building # some dependencies takes considerable time. Caching the built # wheels speeds up the CI job quite a bit. - uses: actions/cache@v4 + uses: actions/cache@v6 with: path: ${{ steps.pip-cache-path.outputs.path }} key: cygwin-pip-${{ github.sha }} @@ -273,7 +273,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@v7 - name: Install Homebrew Python run: | @@ -301,10 +301,10 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@v7 - name: Setup Python - uses: actions/setup-python@v5 + uses: actions/setup-python@v7 with: python-version: 3.9 From d3e6f7f07e082fbd8a6156fe6b12404b0274b58b Mon Sep 17 00:00:00 2001 From: Daniele Nicolodi Date: Mon, 17 Aug 2026 00:35:47 +0200 Subject: [PATCH 2/2] CI: tighten setup applying zizmor recommendations --- .github/workflows/docs.yml | 3 +++ .github/workflows/release.yml | 4 ++++ .github/workflows/tests.yml | 13 +++++++++++++ 3 files changed, 20 insertions(+) diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml index 0687269af..c877f2477 100644 --- a/.github/workflows/docs.yml +++ b/.github/workflows/docs.yml @@ -21,6 +21,8 @@ on: - CHANGELOG.rst - README.md +permissions: {} + jobs: build: @@ -32,6 +34,7 @@ jobs: - uses: actions/checkout@v7 with: ref: ${{ github.event.inputs.tag || github.ref }} + persist-credentials: false - run: python -m pip install --group docs - run: python -m sphinx -W docs/ build/docs/ - uses: actions/upload-pages-artifact@v5 diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index ff7e31283..9fb418419 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -12,12 +12,16 @@ on: - main - release-* +permissions: {} + jobs: build: runs-on: ubuntu-latest steps: - uses: actions/checkout@v7 + with: + persist-credentials: false - uses: actions/setup-python@v7 with: python-version: '3.14' diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index 8c01254c6..60e6fe49a 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -25,6 +25,8 @@ on: workflow_dispatch: # Allow to run manually +permissions: {} + env: FORCE_COLOR: 1 PIP_DISABLE_PIP_VERSION_CHECK: 1 @@ -109,6 +111,8 @@ jobs: steps: - name: Checkout uses: actions/checkout@v7 + with: + persist-credentials: false - name: Set up target Python uses: actions/setup-python@v7 @@ -161,6 +165,8 @@ jobs: steps: - name: Checkout uses: actions/checkout@v7 + with: + persist-credentials: false - name: Set up target Python uses: actions/setup-python@v7 @@ -198,6 +204,8 @@ jobs: steps: - name: Checkout uses: actions/checkout@v7 + with: + persist-credentials: false - name: Setup Cygwin uses: cygwin/cygwin-install-action@3f0a3f9f988f7e96b8c18098ae05eaec175f5b52 # v6 @@ -237,6 +245,7 @@ jobs: path: ${{ steps.pip-cache-path.outputs.path }} key: cygwin-pip-${{ github.sha }} restore-keys: cygwin-pip- + lookup-only: true - name: Install Meson run: python -m pip install "meson ${{ matrix.meson }}" @@ -274,6 +283,8 @@ jobs: steps: - name: Checkout uses: actions/checkout@v7 + with: + persist-credentials: false - name: Install Homebrew Python run: | @@ -302,6 +313,8 @@ jobs: steps: - name: Checkout uses: actions/checkout@v7 + with: + persist-credentials: false - name: Setup Python uses: actions/setup-python@v7