Skip to content

Commit 7649a09

Browse files
keewisVeckoTheGecko
keewis
and
VeckoTheGecko
authored
use zizmor to lint github action workflows (#11269)
* add `zizmor` to the hooks * set the default permissions to minimum * don't persist credentials * pin `actions/checkout` * pin `xarray-contrib/ci-trigger` * pin `actions/upload-artifact` * pin `actions/download-artifact` * pin `pypa/gh-action-pypi-publish` * pin `actions/setup-python` * pin `prefix-dev/setup-pixi` * pin `codecov/codecov-action` * pin `scientific-python/issue-from-pytest-log-action` * pin `mamba-org/setup-micromamba` * pin `WyriHaximus/github-action-get-previous-tag` * pin `EnricoMi/publish-unit-test-result-action` * pin `actions/labeler` * pin `actions/cache` * actions cooldown for dependabot * avoid potential template injections * broken condition * ignore the `pull_request_target` warning (because `actions/labeler` actually needs it) * ignore zizmor's dangerous-triggers warning for publish-test-results * fetch the `codecov` token from a github environment * correct the pin for `setup-pixi` * split the nightly wheels ci into build and publish jobs * remove the codecov env and ignore the zizmor warning instead * back to the codecov env, but disable deployments * correct the pin for `actions/setup-python` Co-authored-by: Nick Hodgskin <36369090+VeckoTheGecko@users.noreply.github.com> --------- Co-authored-by: Nick Hodgskin <36369090+VeckoTheGecko@users.noreply.github.com>
1 parent 3003426 commit 7649a09

12 files changed

+184
-84
lines changed

‎.github/dependabot.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,8 @@ updates:
55
schedule:
66
# Check for updates once a week
77
interval: "weekly"
8+
cooldown:
9+
default-days: 7
810
groups:
911
actions:
1012
patterns:

‎.github/workflows/benchmarks-last-release.yml‎

Lines changed: 10 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,8 @@ on:
66
- main
77
workflow_dispatch:
88

9+
permissions: {}
10+
911
jobs:
1012
benchmark:
1113
name: Linux
@@ -17,12 +19,13 @@ jobs:
1719
steps:
1820
# We need the full repo to avoid this issue
1921
# https://github.com/actions/checkout/issues/23
20-
- uses: actions/checkout@v6
22+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
2123
with:
2224
fetch-depth: 0
25+
persist-credentials: false
2326

2427
- name: Set up conda environment
25-
uses: mamba-org/setup-micromamba@v2
28+
uses: mamba-org/setup-micromamba@d7c9bd84e824b79d2af72a2d4196c7f4300d3476 # v3.0.0
2629
with:
2730
micromamba-version: "1.5.10-0"
2831
environment-file: ${{env.CONDA_ENV_FILE}}
@@ -34,7 +37,7 @@ jobs:
3437
3538
- name: "Get Previous tag"
3639
id: previoustag
37-
uses: "WyriHaximus/github-action-get-previous-tag@v2"
40+
uses: WyriHaximus/github-action-get-previous-tag@61819f33034117e6c686e6a31dba995a85afc9de # v2.0.0
3841
# with:
3942
# fallback: 1.0.0 # Optional fallback tag to use when no tag can be found
4043

@@ -47,18 +50,19 @@ jobs:
4750
OMP_NUM_THREADS: 1
4851
ASV_FACTOR: 1.5
4952
ASV_SKIP_SLOW: 1
53+
GITHUB_TAG: ${{ steps.previoustag.outputs.tag }}
5054
run: |
5155
set -x
5256
# ID this runner
5357
asv machine --yes
54-
echo "Baseline: ${{ steps.previoustag.outputs.tag }} "
58+
echo "Baseline: $GITHUB_TAG"
5559
echo "Contender: ${{ github.sha }}"
5660
# Use mamba for env creation
5761
# export CONDA_EXE=$(which mamba)
5862
export CONDA_EXE=$(which conda)
5963
# Run benchmarks for current commit against base
6064
ASV_OPTIONS="--split --show-stderr --factor $ASV_FACTOR"
61-
asv continuous $ASV_OPTIONS ${{ steps.previoustag.outputs.tag }} ${{ github.sha }} \
65+
asv continuous $ASV_OPTIONS "$GITHUB_TAG" ${{ github.sha }} \
6266
| sed "/Traceback \|failed$\|PERFORMANCE DECREASED/ s/^/::error::/" \
6367
| tee benchmarks.log
6468
# Report and export results for subsequent steps
@@ -73,7 +77,7 @@ jobs:
7377
cp benchmarks/README_CI.md benchmarks.log .asv/results/
7478
working-directory: ${{ env.ASV_DIR }}
7579

76-
- uses: actions/upload-artifact@v7
80+
- uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
7781
if: always()
7882
with:
7983
name: asv-benchmark-results-${{ runner.os }}

‎.github/workflows/benchmarks.yml‎

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,8 @@ on:
88
env:
99
PR_HEAD_LABEL: ${{ github.event.pull_request.head.label }}
1010

11+
permissions: {}
12+
1113
jobs:
1214
benchmark:
1315
if: ${{ contains( github.event.pull_request.labels.*.name, 'run-benchmark') && github.event_name == 'pull_request' || contains( github.event.pull_request.labels.*.name, 'topic-performance') && github.event_name == 'pull_request' || github.event_name == 'workflow_dispatch' }}
@@ -20,12 +22,13 @@ jobs:
2022
steps:
2123
# We need the full repo to avoid this issue
2224
# https://github.com/actions/checkout/issues/23
23-
- uses: actions/checkout@v6
25+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
2426
with:
2527
fetch-depth: 0
28+
persist-credentials: false
2629

2730
- name: Set up conda environment
28-
uses: mamba-org/setup-micromamba@v2
31+
uses: mamba-org/setup-micromamba@d7c9bd84e824b79d2af72a2d4196c7f4300d3476 # v3.0.0
2932
with:
3033
micromamba-version: "1.5.10-0"
3134
environment-file: ${{env.CONDA_ENV_FILE}}
@@ -47,11 +50,12 @@ jobs:
4750
OMP_NUM_THREADS: 1
4851
ASV_FACTOR: 1.5
4952
ASV_SKIP_SLOW: 1
53+
GITHUB_LABEL: ${{ github.event.pull_request.base.label }}
5054
run: |
5155
set -x
5256
# ID this runner
5357
asv machine --yes
54-
echo "Baseline: ${{ github.event.pull_request.base.sha }} (${{ github.event.pull_request.base.label }})"
58+
echo "Baseline: ${{ github.event.pull_request.base.sha }} ($GITHUB_LABEL)"
5559
echo "Contender: ${GITHUB_SHA} ($PR_HEAD_LABEL)"
5660
# Run benchmarks for current commit against base
5761
ASV_OPTIONS="--split --show-stderr --factor $ASV_FACTOR"
@@ -70,7 +74,7 @@ jobs:
7074
cp benchmarks/README_CI.md benchmarks.log .asv/results/
7175
working-directory: ${{ env.ASV_DIR }}
7276

73-
- uses: actions/upload-artifact@v7
77+
- uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
7478
if: always()
7579
with:
7680
name: asv-benchmark-results-${{ runner.os }}

‎.github/workflows/ci-additional.yaml‎

Lines changed: 30 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,8 @@ concurrency:
1515
env:
1616
FORCE_COLOR: 3
1717

18+
permissions: {}
19+
1820
jobs:
1921
detect-ci-trigger:
2022
name: detect ci trigger
@@ -26,10 +28,11 @@ jobs:
2628
outputs:
2729
triggered: ${{ steps.detect-trigger.outputs.trigger-found }}
2830
steps:
29-
- uses: actions/checkout@v6
31+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
3032
with:
3133
fetch-depth: 2
32-
- uses: xarray-contrib/ci-trigger@v1
34+
persist-credentials: false
35+
- uses: xarray-contrib/ci-trigger@10cd2bfec3484946a4058a421ddf9cfad101e715 # v1.2.1
3336
id: detect-trigger
3437
with:
3538
keyword: "[skip-ci]"
@@ -44,10 +47,12 @@ jobs:
4447
pixi-version: ${{ steps.pixi-lock.outputs.pixi-version }}
4548

4649
steps:
47-
- uses: actions/checkout@v6
50+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
51+
with:
52+
persist-credentials: false
4853
- uses: Parcels-code/pixi-lock/create-and-cache@38495788b79a5ff26009aecc15daa9a8310b8832 # v0.1.0
4954
id: pixi-lock
50-
- uses: actions/upload-artifact@v7
55+
- uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
5156
with:
5257
name: pixi-lock
5358
path: pixi.lock
@@ -63,9 +68,10 @@ jobs:
6368
env:
6469
PIXI_ENV: "test-py313"
6570
steps:
66-
- uses: actions/checkout@v6
71+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
6772
with:
6873
fetch-depth: 0 # Fetch all history for all branches and tags.
74+
persist-credentials: false
6975

7076
- name: set environment variables
7177
run: |
@@ -75,7 +81,7 @@ jobs:
7581
uses: Parcels-code/pixi-lock/restore@38495788b79a5ff26009aecc15daa9a8310b8832 # v0.1.0
7682
with:
7783
cache-key: ${{ needs.cache-pixi-lock.outputs.cache-key }}
78-
- uses: prefix-dev/setup-pixi@v0.9.4
84+
- uses: prefix-dev/setup-pixi@a0af7a228712d6121d37aba47adf55c1332c9c2e # v0.9.4
7985
with:
8086
pixi-version: ${{ needs.cache-pixi-lock.outputs.pixi-version }}
8187
cache: true
@@ -106,14 +112,15 @@ jobs:
106112
PIXI_ENV: test-py313-with-typing
107113

108114
steps:
109-
- uses: actions/checkout@v6
115+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
110116
with:
111117
fetch-depth: 0 # Fetch all history for all branches and tags.
118+
persist-credentials: false
112119
- name: Restore cached pixi lockfile
113120
uses: Parcels-code/pixi-lock/restore@38495788b79a5ff26009aecc15daa9a8310b8832 # v0.1.0
114121
with:
115122
cache-key: ${{ needs.cache-pixi-lock.outputs.cache-key }}
116-
- uses: prefix-dev/setup-pixi@v0.9.4
123+
- uses: prefix-dev/setup-pixi@a0af7a228712d6121d37aba47adf55c1332c9c2e # v0.9.4
117124
with:
118125
pixi-version: ${{ needs.cache-pixi-lock.outputs.pixi-version }}
119126
cache: true
@@ -132,7 +139,7 @@ jobs:
132139
pixi run -e ${{env.PIXI_ENV}} -- python -m mypy --install-types --non-interactive --cobertura-xml-report mypy_report
133140
134141
- name: Upload mypy coverage to Codecov
135-
uses: codecov/codecov-action@v6.0.0
142+
uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6.0.0
136143
with:
137144
files: mypy_report/cobertura.xml
138145
flags: mypy
@@ -151,14 +158,15 @@ jobs:
151158
PIXI_ENV: test-py311-with-typing
152159

153160
steps:
154-
- uses: actions/checkout@v6
161+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
155162
with:
156163
fetch-depth: 0 # Fetch all history for all branches and tags.
164+
persist-credentials: false
157165
- name: Restore cached pixi lockfile
158166
uses: Parcels-code/pixi-lock/restore@38495788b79a5ff26009aecc15daa9a8310b8832 # v0.1.0
159167
with:
160168
cache-key: ${{ needs.cache-pixi-lock.outputs.cache-key }}
161-
- uses: prefix-dev/setup-pixi@v0.9.4
169+
- uses: prefix-dev/setup-pixi@a0af7a228712d6121d37aba47adf55c1332c9c2e # v0.9.4
162170
with:
163171
pixi-version: ${{ needs.cache-pixi-lock.outputs.pixi-version }}
164172
cache: true
@@ -177,7 +185,7 @@ jobs:
177185
pixi run -e ${{env.PIXI_ENV}} -- python -m mypy --install-types --non-interactive --cobertura-xml-report mypy_report
178186
179187
- name: Upload mypy coverage to Codecov
180-
uses: codecov/codecov-action@v6.0.0
188+
uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6.0.0
181189
with:
182190
files: mypy_report/cobertura.xml
183191
flags: mypy-min
@@ -199,15 +207,16 @@ jobs:
199207
PIXI_ENV: test-py313-with-typing
200208

201209
steps:
202-
- uses: actions/checkout@v6
210+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
203211
with:
204212
fetch-depth: 0
213+
persist-credentials: false
205214

206215
- name: Restore cached pixi lockfile
207216
uses: Parcels-code/pixi-lock/restore@38495788b79a5ff26009aecc15daa9a8310b8832 # v0.1.0
208217
with:
209218
cache-key: ${{ needs.cache-pixi-lock.outputs.cache-key }}
210-
- uses: prefix-dev/setup-pixi@v0.9.4
219+
- uses: prefix-dev/setup-pixi@a0af7a228712d6121d37aba47adf55c1332c9c2e # v0.9.4
211220
with:
212221
pixi-version: ${{ needs.cache-pixi-lock.outputs.pixi-version }}
213222
cache: true
@@ -249,15 +258,16 @@ jobs:
249258
shell: bash -l {0}
250259

251260
steps:
252-
- uses: actions/checkout@v6
261+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
253262
with:
254263
fetch-depth: 0 # Fetch all history for all branches and tags.
264+
persist-credentials: false
255265

256266
- name: Restore cached pixi lockfile
257267
uses: Parcels-code/pixi-lock/restore@38495788b79a5ff26009aecc15daa9a8310b8832 # v0.1.0
258268
with:
259269
cache-key: ${{ needs.cache-pixi-lock.outputs.cache-key }}
260-
- uses: prefix-dev/setup-pixi@v0.9.4
270+
- uses: prefix-dev/setup-pixi@a0af7a228712d6121d37aba47adf55c1332c9c2e # v0.9.4
261271
with:
262272
pixi-version: ${{ needs.cache-pixi-lock.outputs.pixi-version }}
263273
cache: true
@@ -276,7 +286,7 @@ jobs:
276286
pixi run -e ${{ matrix.pixi-env }} -- python -m pyright xarray/
277287
278288
- name: Upload pyright coverage to Codecov
279-
uses: codecov/codecov-action@v6.0.0
289+
uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6.0.0
280290
with:
281291
files: pyright_report/cobertura.xml
282292
flags: pyright
@@ -297,16 +307,17 @@ jobs:
297307
COLUMNS: 120
298308

299309
steps:
300-
- uses: actions/checkout@v6
310+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
301311
with:
302312
fetch-depth: 0 # Fetch all history for all branches and tags.
313+
persist-credentials: false
303314

304315
- name: Restore cached pixi lockfile
305316
uses: Parcels-code/pixi-lock/restore@38495788b79a5ff26009aecc15daa9a8310b8832 # v0.1.0
306317
with:
307318
cache-key: ${{ needs.cache-pixi-lock.outputs.cache-key }}
308319

309-
- uses: prefix-dev/setup-pixi@v0.9.4
320+
- uses: prefix-dev/setup-pixi@a0af7a228712d6121d37aba47adf55c1332c9c2e # v0.9.4
310321
with:
311322
pixi-version: ${{ needs.cache-pixi-lock.outputs.pixi-version }}
312323
cache: true

0 commit comments

Comments
 (0)