From c98a507df6fd92cfb8c942ec7dcff0fe0c37677b Mon Sep 17 00:00:00 2001 From: Cadair <1391051+Cadair@users.noreply.github.com> Date: Wed, 12 Aug 2026 10:09:52 +0000 Subject: [PATCH 1/3] Run cruft update from package template --- .cruft.json | 8 ++++---- .github/workflows/ci.yml | 12 ++++++------ 2 files changed, 10 insertions(+), 10 deletions(-) diff --git a/.cruft.json b/.cruft.json index e28c757..b0c4a4b 100644 --- a/.cruft.json +++ b/.cruft.json @@ -1,6 +1,6 @@ { "template": "https://github.com/sunpy/package-template", - "commit": "9810f983b63cad4d9abfb6088a40617578a6d965", + "commit": "dce4f87cccac0059526182851a3b3e0b069b7a47", "checkout": null, "context": { "cookiecutter": { @@ -22,6 +22,7 @@ "enable_dynamic_dev_versions": "y", "include_example_code": "n", "include_cruft_update_github_workflow": "n", + "use_pat_in_cruft_update_workflow": "y", "use_extended_ruff_linting": "n", "matrix_room_id": "", "extra_ci_jobs": "", @@ -30,11 +31,10 @@ "_install_requires": "", "_copy_without_render": [ "docs/_templates", - "docs/_static", - ".github/workflows/sub_package_update.yml" + "docs/_static" ], "_template": "https://github.com/sunpy/package-template", - "_commit": "9810f983b63cad4d9abfb6088a40617578a6d965" + "_commit": "dce4f87cccac0059526182851a3b3e0b069b7a47" } }, "directory": null diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 1d3d813..a4d2982 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -32,15 +32,15 @@ permissions: {} jobs: core: uses: OpenAstronomy/github-actions-workflows/.github/workflows/tox.yml@8c8bb6c6c962542921f993d47d26df38dccd50b1 # v3.0.2 + permissions: + id-token: write with: submodules: false - coverage: codecov + coverage: codecov-oidc toxdeps: tox-pypi-filter posargs: -n auto envs: | - linux: py313 - secrets: - CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} sdist_verify: runs-on: ubuntu-latest @@ -59,9 +59,11 @@ jobs: test: needs: [core, sdist_verify] uses: OpenAstronomy/github-actions-workflows/.github/workflows/tox.yml@8c8bb6c6c962542921f993d47d26df38dccd50b1 # v3.0.2 + permissions: + id-token: write with: submodules: false - coverage: codecov + coverage: codecov-oidc toxdeps: tox-pypi-filter posargs: -n auto envs: | @@ -70,8 +72,6 @@ jobs: - macos: py312 - linux: py312-oldestdeps - linux: py314-devdeps - secrets: - CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} docs: needs: [core] From c38824591c4292a105d2a8bf194513235b9c2666 Mon Sep 17 00:00:00 2001 From: SunPyBot Date: Wed, 12 Aug 2026 10:45:45 +0000 Subject: [PATCH 2/3] Run cruft update from package template --- .cruft.json | 7 ++++--- .github/workflows/zizmor.yml | 24 ++++++++++++++++++++++++ .pre-commit-config.yaml | 4 ---- 3 files changed, 28 insertions(+), 7 deletions(-) create mode 100644 .github/workflows/zizmor.yml diff --git a/.cruft.json b/.cruft.json index b0c4a4b..e2c561b 100644 --- a/.cruft.json +++ b/.cruft.json @@ -1,6 +1,6 @@ { "template": "https://github.com/sunpy/package-template", - "commit": "dce4f87cccac0059526182851a3b3e0b069b7a47", + "commit": "a01979d4c0ca04d0f41cbb062c767b6a400f5556", "checkout": null, "context": { "cookiecutter": { @@ -31,10 +31,11 @@ "_install_requires": "", "_copy_without_render": [ "docs/_templates", - "docs/_static" + "docs/_static", + ".github/workflows/zizmor.yml" ], "_template": "https://github.com/sunpy/package-template", - "_commit": "dce4f87cccac0059526182851a3b3e0b069b7a47" + "_commit": "a01979d4c0ca04d0f41cbb062c767b6a400f5556" } }, "directory": null diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml new file mode 100644 index 0000000..b7eced8 --- /dev/null +++ b/.github/workflows/zizmor.yml @@ -0,0 +1,24 @@ +name: GitHub Actions Security Analysis with zizmor + +on: + push: + branches: ["main"] + pull_request: + branches: ["**"] + +permissions: {} + +jobs: + zizmor: + runs-on: ubuntu-latest + permissions: + security-events: write + + steps: + - name: Checkout repository + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + + - name: Run zizmor 🌈 + uses: zizmorcore/zizmor-action@6fc4b006235f201fdab3722e17240ab420d580e5 # v0.6.1 diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index 73e97e7..141a102 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -1,8 +1,4 @@ repos: - - repo: https://github.com/zizmorcore/zizmor-pre-commit - rev: v1.28.0 - hooks: - - id: zizmor # This should be before any formatting hooks like isort - repo: https://github.com/astral-sh/ruff-pre-commit rev: "v0.16.1" From ea1c2e9a41661e34a73434ae0ecb944427dfa1d0 Mon Sep 17 00:00:00 2001 From: SunPyBot Date: Wed, 12 Aug 2026 12:02:39 +0000 Subject: [PATCH 3/3] Run cruft update from package template --- .cruft.json | 4 ++-- .github/workflows/zizmor.yml | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.cruft.json b/.cruft.json index e2c561b..be72948 100644 --- a/.cruft.json +++ b/.cruft.json @@ -1,6 +1,6 @@ { "template": "https://github.com/sunpy/package-template", - "commit": "a01979d4c0ca04d0f41cbb062c767b6a400f5556", + "commit": "9fff6e66fecd5ab2ed7fefbc0687791e83f46a8a", "checkout": null, "context": { "cookiecutter": { @@ -35,7 +35,7 @@ ".github/workflows/zizmor.yml" ], "_template": "https://github.com/sunpy/package-template", - "_commit": "a01979d4c0ca04d0f41cbb062c767b6a400f5556" + "_commit": "9fff6e66fecd5ab2ed7fefbc0687791e83f46a8a" } }, "directory": null diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml index b7eced8..777801f 100644 --- a/.github/workflows/zizmor.yml +++ b/.github/workflows/zizmor.yml @@ -21,4 +21,4 @@ jobs: persist-credentials: false - name: Run zizmor 🌈 - uses: zizmorcore/zizmor-action@6fc4b006235f201fdab3722e17240ab420d580e5 # v0.6.1 + uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2