FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

[3.12] Add zizmor to pre-commit and fix most findings (GH-127749) (#1… · python/cpython@381eb04 · GitHub

/ cpython Public

Commit 381eb04

Browse files
authored
[3.12] Add zizmor to pre-commit and fix most findings (GH-127749) (#127788)
Co-authored-by: Hugo van Kemenade <1324225+hugovk@users.noreply.github.com> Co-authored-by: Alex Waygood <Alex.Waygood@Gmail.com> Co-authored-by: Ezio Melotti <ezio.melotti@gmail.com>
1 parent 8159d0c commit 381eb04

16 files changed

Lines changed: 75 additions & 24 deletions

‎.github/workflows/build.yml‎

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,8 @@ jobs:
5555
if: needs.check_source.outputs.run_tests == 'true'
5656
steps:
5757
- uses: actions/checkout@v4
58+
with:
59+
persist-credentials: false
5860
- uses: actions/setup-python@v5
5961
- name: Install dependencies
6062
run: |
@@ -109,6 +111,7 @@ jobs:
109111
- uses: actions/checkout@v4
110112
with:
111113
fetch-depth: 1
114+
persist-credentials: false
112115
- name: Runner image version
113116
run: echo "IMAGE_VERSION=${ImageVersion}" >> $GITHUB_ENV
114117
- name: Check Autoconf and aclocal versions
@@ -145,6 +148,8 @@ jobs:
145148
if: needs.check_source.outputs.run_tests == 'true'
146149
steps:
147150
- uses: actions/checkout@v4
151+
with:
152+
persist-credentials: false
148153
- uses: actions/setup-python@v5
149154
with:
150155
python-version: '3.x'
@@ -299,6 +304,8 @@ jobs:
299304
LD_LIBRARY_PATH: ${{ github.workspace }}/multissl/openssl/${{ matrix.openssl_ver }}/lib
300305
steps:
301306
- uses: actions/checkout@v4
307+
with:
308+
persist-credentials: false
302309
- name: Runner image version
303310
run: echo "IMAGE_VERSION=${ImageVersion}" >> $GITHUB_ENV
304311
- name: Restore config.cache
@@ -351,6 +358,8 @@ jobs:
351358
PYTHONSTRICTEXTENSIONBUILD: 1
352359
steps:
353360
- uses: actions/checkout@v4
361+
with:
362+
persist-credentials: false
354363
- name: Register gcc problem matcher
355364
run: echo "::add-matcher::.github/problem-matchers/gcc.json"
356365
- name: Install dependencies
@@ -433,7 +442,7 @@ jobs:
433442
#
434443
# (GH-104097) test_sysconfig is skipped because it has tests that are
435444
# failing when executed from inside a virtual environment.
436-
${{ env.VENV_PYTHON }} -m test \
445+
"${VENV_PYTHON}" -m test \
437446
-W \
438447
-o \
439448
-j4 \
@@ -465,6 +474,8 @@ jobs:
465474
ASAN_OPTIONS: detect_leaks=0:allocator_may_return_null=1:handle_segv=0
466475
steps:
467476
- uses: actions/checkout@v4
477+
with:
478+
persist-credentials: false
468479
- name: Runner image version
469480
run: echo "IMAGE_VERSION=${ImageVersion}" >> $GITHUB_ENV
470481
- name: Restore config.cache

‎.github/workflows/documentation-links.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -10,16 +10,16 @@ on:
1010
- 'Doc/**'
1111
- '.github/workflows/doc.yml'
1212

13-
permissions:
14-
pull-requests: write
15-
1613
concurrency:
1714
group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
1815
cancel-in-progress: true
1916

2017
jobs:
2118
documentation-links:
2219
runs-on: ubuntu-latest
20+
permissions:
21+
pull-requests: write
22+
2323
steps:
2424
- uses: readthedocs/actions/preview@v1
2525
with:

‎.github/workflows/lint.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,8 @@ jobs:
2020

2121
steps:
2222
- uses: actions/checkout@v4
23+
with:
24+
persist-credentials: false
2325
- uses: actions/setup-python@v5
2426
with:
2527
python-version: "3.x"

‎.github/workflows/mypy.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,8 @@ jobs:
3131
timeout-minutes: 10
3232
steps:
3333
- uses: actions/checkout@v4
34+
with:
35+
persist-credentials: false
3436
- uses: actions/setup-python@v5
3537
with:
3638
python-version: "3.x"

‎.github/workflows/require-pr-label.yml‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4,15 +4,14 @@ on:
44
pull_request:
55
types: [opened, reopened, labeled, unlabeled, synchronize]
66

7-
permissions:
8-
issues: write
9-
pull-requests: write
10-
117
jobs:
128
label:
139
name: DO-NOT-MERGE / unresolved review
1410
if: github.repository_owner == 'python'
1511
runs-on: ubuntu-latest
12+
permissions:
13+
issues: write
14+
pull-requests: write
1615
timeout-minutes: 10
1716

1817
steps:

‎.github/workflows/reusable-change-detection.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -61,6 +61,8 @@ jobs:
6161
- run: >-
6262
echo '${{ github.event_name }}'
6363
- uses: actions/checkout@v4
64+
with:
65+
persist-credentials: false
6466
- name: Check for source changes
6567
id: check
6668
run: |

‎.github/workflows/reusable-docs.yml‎

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -19,12 +19,14 @@ jobs:
1919
env:
2020
branch_base: 'origin/${{ github.event.pull_request.base.ref }}'
2121
branch_pr: 'origin/${{ github.event.pull_request.head.ref }}'
22+
commits: ${{ github.event.pull_request.commits }}
2223
refspec_base: '+${{ github.event.pull_request.base.sha }}:remotes/origin/${{ github.event.pull_request.base.ref }}'
2324
refspec_pr: '+${{ github.event.pull_request.head.sha }}:remotes/origin/${{ github.event.pull_request.head.ref }}'
2425
steps:
2526
- name: 'Check out latest PR branch commit'
2627
uses: actions/checkout@v4
2728
with:
29+
persist-credentials: false
2830
ref: >-
2931
${{
3032
github.event_name == 'pull_request'
@@ -36,15 +38,15 @@ jobs:
3638
if: github.event_name == 'pull_request'
3739
run: |
3840
# Fetch enough history to find a common ancestor commit (aka merge-base):
39-
git fetch origin ${{ env.refspec_pr }} --depth=$(( ${{ github.event.pull_request.commits }} + 1 )) \
41+
git fetch origin "${refspec_pr}" --depth=$(( commits + 1 )) \
4042
--no-tags --prune --no-recurse-submodules
4143
4244
# This should get the oldest commit in the local fetched history (which may not be the commit the PR branched from):
43-
COMMON_ANCESTOR=$( git rev-list --first-parent --max-parents=0 --max-count=1 ${{ env.branch_pr }} )
45+
COMMON_ANCESTOR=$( git rev-list --first-parent --max-parents=0 --max-count=1 "${branch_pr}" )
4446
DATE=$( git log --date=iso8601 --format=%cd "${COMMON_ANCESTOR}" )
4547
4648
# Get all commits since that commit date from the base branch (eg: master or main):
47-
git fetch origin ${{ env.refspec_base }} --shallow-since="${DATE}" \
49+
git fetch origin "${refspec_base}" --shallow-since="${DATE}" \
4850
--no-tags --prune --no-recurse-submodules
4951
- name: 'Set up Python'
5052
uses: actions/setup-python@v5
@@ -66,7 +68,7 @@ jobs:
6668
if: github.event_name == 'pull_request'
6769
run: |
6870
python Doc/tools/check-warnings.py \
69-
--annotate-diff '${{ env.branch_base }}' '${{ env.branch_pr }}' \
71+
--annotate-diff "${branch_base}" "${branch_pr}" \
7072
--fail-if-regression \
7173
--fail-if-improved \
7274
--fail-if-new-news-nit
@@ -78,6 +80,8 @@ jobs:
7880
timeout-minutes: 60
7981
steps:
8082
- uses: actions/checkout@v4
83+
with:
84+
persist-credentials: false
8185
- name: 'Set up Python'
8286
uses: actions/setup-python@v5
8387
with:
@@ -96,6 +100,8 @@ jobs:
96100
timeout-minutes: 60
97101
steps:
98102
- uses: actions/checkout@v4
103+
with:
104+
persist-credentials: false
99105
- uses: actions/cache@v4
100106
with:
101107
path: ~/.cache/pip

‎.github/workflows/reusable-macos.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,8 @@ jobs:
2828
runs-on: ${{ inputs.os }}
2929
steps:
3030
- uses: actions/checkout@v4
31+
with:
32+
persist-credentials: false
3133
- name: Runner image version
3234
run: echo "IMAGE_VERSION=${ImageVersion}" >> $GITHUB_ENV
3335
- name: Restore config.cache

‎.github/workflows/reusable-tsan.yml‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,8 +15,12 @@ jobs:
1515
name: 'Thread sanitizer'
1616
runs-on: ubuntu-22.04
1717
timeout-minutes: 60
18+
env:
19+
OPTIONS: ${{ inputs.options }}
1820
steps:
1921
- uses: actions/checkout@v4
22+
with:
23+
persist-credentials: false
2024
- name: Runner image version
2125
run: echo "IMAGE_VERSION=${ImageVersion}" >> $GITHUB_ENV
2226
- name: Restore config.cache
@@ -44,7 +48,7 @@ jobs:
4448
save: ${{ github.event_name == 'push' }}
4549
max-size: "200M"
4650
- name: Configure CPython
47-
run: ${{ inputs.options }}
51+
run: "${OPTIONS}"
4852
- name: Build CPython
4953
run: make -j4
5054
- name: Display build info

‎.github/workflows/reusable-ubuntu.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,8 @@ jobs:
2626
PYTHONSTRICTEXTENSIONBUILD: 1
2727
steps:
2828
- uses: actions/checkout@v4
29+
with:
30+
persist-credentials: false
2931
- name: Register gcc problem matcher
3032
run: echo "::add-matcher::.github/problem-matchers/gcc.json"
3133
- name: Install dependencies

0 commit comments

Comments
 (0)
Back | FazBrowse Home | New Git URL