Skip to content

Commit 93bd02b

Browse files
bjhargravebjhargrave
committed
Updates to dependabot for grouped updates
Also other workflow updates. Signed-off-by: BJ Hargrave <hargrave@us.ibm.com>
1 parent 57e1bb3 commit 93bd02b

13 files changed

Lines changed: 314 additions & 2 deletions

‎.github/actions/python_setup/action.yaml‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
name: 'python_setup'
2+
description: 'Setup for Python and uv'
3+
4+
inputs:
5+
python-version:
6+
description: 'Python version, supporting MAJOR.MINOR only'
7+
required: true
8+
type: string
9+
uv-version:
10+
description: 'uv version, default latest'
11+
required: false
12+
type: string
13+
default: 'latest'
14+
enable-cache:
15+
description: 'Enable caching uv cache, default true'
16+
required: false
17+
type: boolean
18+
default: true
19+
save-cache:
20+
description: 'Save the uv cache, false if pull_request'
21+
required: false
22+
type: boolean
23+
default: ${{ github.event_name != 'pull_request' }}
24+
25+
runs:
26+
using: "composite"
27+
steps:
28+
- name: 'Setup Python ${{ inputs.python-version }}'
29+
id: setup-python
30+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
31+
with:
32+
python-version: ${{ inputs.python-version }}
33+
34+
- name: 'Setup uv ${{ inputs.uv-version }}'
35+
id: setup-uv
36+
uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
37+
with:
38+
python-version: ${{ steps.setup-python.outputs.python-version }}
39+
version: ${{ inputs.uv-version }}
40+
enable-cache: ${{ inputs.enable-cache }}
41+
save-cache: ${{ inputs.save-cache }}

‎.github/dependabot.yml‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,15 @@ updates:
77
- package-ecosystem: "github-actions"
88
directories:
99
- "/"
10-
- ".github/actions/ollama-setup"
10+
- ".github/actions"
1111
schedule:
1212
interval: "daily"
1313
cooldown:
1414
default-days: 7
15+
groups:
16+
github-actions:
17+
patterns:
18+
- "*"
19+
labels:
20+
- "dependencies"
21+
- "github_actions"

‎.github/pinact.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
# SPDX-License-Identifier: Apache-2.0
2+
3+
version: 3
4+
min_age: # cooldown
5+
value: 7
6+
ignore_actions:
7+
- name: ibm-granite-community/utils/.github/workflows/test_notebook.yaml
8+
ref: main

‎.github/workflows/actionlint.yaml‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
# SPDX-License-Identifier: Apache-2.0
2+
3+
name: Lint GitHub Actions workflows
4+
on:
5+
push:
6+
branches:
7+
- "main"
8+
paths:
9+
- '.github/workflows/*.ya?ml'
10+
- '.github/zizmor.ya?ml'
11+
- '.poutine.ya?ml'
12+
pull_request:
13+
branches:
14+
- "main"
15+
paths:
16+
- '.github/workflows/*.ya?ml'
17+
- '.github/zizmor.ya?ml'
18+
- '.poutine.ya?ml'
19+
20+
env:
21+
LC_ALL: en_US.UTF-8
22+
23+
defaults:
24+
run:
25+
shell: bash
26+
27+
permissions:
28+
contents: read
29+
30+
jobs:
31+
actionlint:
32+
permissions:
33+
security-events: write # Required for upload-sarif to upload SARIF files.
34+
runs-on: ubuntu-latest
35+
steps:
36+
- name: "Harden Runner"
37+
uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
38+
with:
39+
egress-policy: block
40+
allowed-endpoints: >
41+
api.github.com:443
42+
ghcr.io:443
43+
github.com:443
44+
pkg-containers.githubusercontent.com:443
45+
46+
- name: "Checkout"
47+
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
48+
with:
49+
persist-credentials: false
50+
51+
- name: "Check workflow files with zizmor"
52+
uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6
53+
54+
- name: "Check workflow files with poutine"
55+
uses: boostsecurityio/poutine-action@e240ebd3eff8b2db5a8e5f6b28f58739d7db2247 # v1.1.4
56+
with:
57+
output: ${{ runner.temp }}/poutine.sarif
58+
59+
- name: "Upload poutine SARIF file"
60+
uses: github/codeql-action/upload-sarif@87557b9c84dde89fdd9b10e88954ac2f4248e463 # v4.36.1
61+
with:
62+
sarif_file: ${{ runner.temp }}/poutine.sarif
63+
category: poutine

‎.github/workflows/lint.yml‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
# SPDX-License-Identifier: Apache-2.0
2+
3+
name: Lint
4+
5+
on:
6+
pull_request:
7+
branches:
8+
- main
9+
paths:
10+
- '**.md'
11+
- '.markdownlint-cli2.yaml'
12+
- '.github/workflows/lint.yml' # This workflow
13+
14+
env:
15+
LC_ALL: en_US.UTF-8
16+
17+
defaults:
18+
run:
19+
shell: bash
20+
21+
permissions:
22+
contents: read
23+
24+
jobs:
25+
markdown-lint:
26+
runs-on: ubuntu-latest
27+
steps:
28+
- name: "Harden Runner"
29+
uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
30+
with:
31+
disable-sudo-and-containers: true
32+
egress-policy: block
33+
allowed-endpoints: >
34+
api.github.com:443
35+
files.pythonhosted.org:443
36+
fonts.google.com:443
37+
fonts.gstatic.com:443
38+
github.com:443
39+
objects.githubusercontent.com:443
40+
pypi.org:443
41+
42+
- name: 'Checkout'
43+
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
44+
with:
45+
persist-credentials: false
46+
47+
- name: "Check Markdown documents"
48+
uses: DavidAnson/markdownlint-cli2-action@ded1f9488f68a970bc66ea5619e13e9b52e601cd # v23.2.0

‎.github/workflows/notebooks.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -68,6 +68,7 @@ jobs:
6868
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
6969
with:
7070
ref: ${{ inputs.pr && format('refs/pull/{0}/head',inputs.pr) || '' }}
71+
persist-credentials: false
7172

7273
- name: Pull Request dispatch
7374
if: ${{ inputs.pr }}

‎.github/workflows/spellcheck.yaml‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
# SPDX-License-Identifier: Apache-2.0
2+
3+
name: Spellcheck
4+
5+
on:
6+
pull_request:
7+
branches:
8+
- main
9+
paths:
10+
- '**.md'
11+
- '.spellcheck*'
12+
- '.github/workflows/spellcheck.yaml' # This workflow file
13+
14+
env:
15+
LC_ALL: en_US.UTF-8
16+
17+
defaults:
18+
run:
19+
shell: bash
20+
21+
permissions:
22+
contents: read
23+
24+
jobs:
25+
spellcheck:
26+
runs-on: ubuntu-latest
27+
steps:
28+
- name: "Harden Runner"
29+
uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
30+
with:
31+
egress-policy: block
32+
allowed-endpoints: >
33+
*.archive.ubuntu.com:80
34+
*.microsoft.com:443
35+
api.github.com:443
36+
esm.ubuntu.com:443
37+
files.pythonhosted.org:443
38+
github.com:443
39+
pypi.org:443
40+
raw.githubusercontent.com:443
41+
release-assets.githubusercontent.com:443
42+
releases.astral.sh:443
43+
44+
- name: 'Checkout'
45+
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
46+
with:
47+
persist-credentials: false
48+
49+
- name: 'Setup Python'
50+
uses: ./.github/actions/python_setup
51+
with:
52+
python-version: 3.12
53+
enable-cache: false
54+
55+
- name: 'Install aspell'
56+
run: |
57+
sudo apt-get update
58+
sudo apt-get install -y aspell aspell-en
59+
60+
- name: 'Check spelling'
61+
run: |
62+
uvx -- pyspelling --config .spellcheck.yaml

‎.github/zizmor.yaml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
# SPDX-License-Identifier: Apache-2.0
2+
3+
rules:
4+
unpinned-uses:
5+
config:
6+
policies:
7+
"ibm-granite-community/utils/.github/workflows/test_notebook.yaml": ref-pin

‎.gitignore‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,3 +7,6 @@ build/
77
.ipynb_checkpoints/
88
log.txt
99
.litellm_cache
10+
11+
# Ignore all dictionary files
12+
*.dic

‎.poutine.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
# SPDX-License-Identifier: Apache-2.0
2+
3+
ignoreForks: true
4+
5+
skip:
6+
- rule: github_action_from_unverified_creator_used
7+
- rule: unverified_script_exec
8+
path: .github/actions/ollama-setup/action.yml

0 commit comments

Comments
 (0)