Commit 35db2d5
File tree
- .github
- workflows
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -10,3 +10,5 @@ updates: | |||
| 10 | 10 | actions: | |
| 11 | 11 | patterns: | |
| 12 | 12 | - "*" | |
| 13 | + cooldown: | ||
| 14 | + default-days: 7 | ||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -2,18 +2,20 @@ name: Lint | |||
| 2 | 2 | ||
| 3 | 3 | on: [push, pull_request, workflow_dispatch] | |
| 4 | 4 | ||
| 5 | + permissions: {} | ||
| 6 | + | ||
| 5 | 7 | env: | |
| 6 | 8 | FORCE_COLOR: 1 | |
| 7 | - | ||
| 8 | - permissions: | ||
| 9 | - contents: read | ||
| 9 | + RUFF_OUTPUT_FORMAT: github | ||
| 10 | 10 | ||
| 11 | 11 | jobs: | |
| 12 | 12 | lint: | |
| 13 | 13 | runs-on: ubuntu-latest | |
| 14 | 14 | ||
| 15 | 15 | steps: | |
| 16 | 16 | - uses: actions/checkout@v6 | |
| 17 | + with: | ||
| 18 | + persist-credentials: false | ||
| 17 | 19 | - uses: actions/setup-python@v6 | |
| 18 | 20 | with: | |
| 19 | 21 | python-version: "3.x" | |
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -8,8 +8,7 @@ on: | |||
| 8 | 8 | - published | |
| 9 | 9 | workflow_dispatch: | |
| 10 | 10 | ||
| 11 | - permissions: | ||
| 12 | - contents: read | ||
| 11 | + permissions: {} | ||
| 13 | 12 | ||
| 14 | 13 | env: | |
| 15 | 14 | FORCE_COLOR: 1 | |
@@ -22,6 +21,8 @@ jobs: | |||
| 22 | 21 | ||
| 23 | 22 | steps: | |
| 24 | 23 | - uses: actions/checkout@v6 | |
| 24 | + with: | ||
| 25 | + persist-credentials: false | ||
| 25 | 26 | - uses: actions/setup-python@v6 | |
| 26 | 27 | ||
| 27 | 28 | - name: Compile translations | |
@@ -55,5 +56,3 @@ jobs: | |||
| 55 | 56 | ||
| 56 | 57 | - name: Upload package to PyPI | |
| 57 | 58 | uses: pypa/gh-action-pypi-publish@release/v1 | |
| 58 | - with: | ||
| 59 | - attestations: true | ||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -2,6 +2,8 @@ name: Tests | |||
| 2 | 2 | ||
| 3 | 3 | on: [push, pull_request, workflow_dispatch] | |
| 4 | 4 | ||
| 5 | + permissions: {} | ||
| 6 | + | ||
| 5 | 7 | env: | |
| 6 | 8 | FORCE_COLOR: 1 | |
| 7 | 9 | ||
@@ -18,6 +20,8 @@ jobs: | |||
| 18 | 20 | branch: "main" | |
| 19 | 21 | steps: | |
| 20 | 22 | - uses: actions/checkout@v6 | |
| 23 | + with: | ||
| 24 | + persist-credentials: false | ||
| 21 | 25 | - uses: actions/setup-python@v6 | |
| 22 | 26 | with: | |
| 23 | 27 | python-version: ${{ matrix.python-version }} | |
@@ -63,6 +67,8 @@ jobs: | |||
| 63 | 67 | python-version: ["3.12", "3"] | |
| 64 | 68 | steps: | |
| 65 | 69 | - uses: actions/checkout@v6 | |
| 70 | + with: | ||
| 71 | + persist-credentials: false | ||
| 66 | 72 | - uses: actions/setup-python@v6 | |
| 67 | 73 | with: | |
| 68 | 74 | python-version: ${{ matrix.python-version }} | |
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -0,0 +1,10 @@ | |||
| 1 | + # Configuration for the zizmor static analysis tool, run via pre-commit in CI | ||
| 2 | + # https://woodruffw.github.io/zizmor/configuration/ | ||
| 3 | + rules: | ||
| 4 | + dangerous-triggers: | ||
| 5 | + ignore: | ||
| 6 | + - documentation-links.yml | ||
| 7 | + unpinned-uses: | ||
| 8 | + config: | ||
| 9 | + policies: | ||
| 10 | + "*": ref-pin | ||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -32,6 +32,11 @@ repos: | |||
| 32 | 32 | hooks: | |
| 33 | 33 | - id: actionlint | |
| 34 | 34 | ||
| 35 | + - repo: https://github.com/woodruffw/zizmor-pre-commit | ||
| 36 | + rev: v1.17.0 | ||
| 37 | + hooks: | ||
| 38 | + - id: zizmor | ||
| 39 | + | ||
| 35 | 40 | - repo: https://github.com/tox-dev/pyproject-fmt | |
| 36 | 41 | rev: v2.5.0 | |
| 37 | 42 | hooks: | |
0 commit comments