Skip to content

CI: Harden GHA configuration #166

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 9 commits into
base: main
Choose a base branch
from
Open

CI: Harden GHA configuration #166

Changes from 4 commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
1328b1c
CI: Restrict default permissions
tacaswell Jul 18, 2025
08b5a55
CI: Restrict default permissions
tacaswell Jul 18, 2025
042eff8
CI: pin actions by SHA
tacaswell Jul 18, 2025
25791eb
CI: apply zizmor auto-fixes
tacaswell Jul 18, 2025
bc88c6d
CI: update version string
tacaswell Jul 22, 2025
c9e8440
CI: try latest image
tacaswell Jul 24, 2025
b7c2b53
CI: remove redundant step
tacaswell Jul 24, 2025
75491ef
CI: try bumping the flake8 version
tacaswell Jul 24, 2025
f25b7af
CI: bump the other job to ubuntu-latest
tacaswell Jul 24, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 15 additions & 4 deletions .github/workflows/main.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,18 +1,27 @@
name: CI

on: [push, pull_request]

jobs:
pre-commit:
permissions:
contents: read

runs-on: ubuntu-20.04
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Does dependabot not suggest updating this? Isn't it deprecated?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't think dependabot suggest updating images?

Copy link
Member

@QuLogic QuLogic Jul 24, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Well, it's probably why the CI isn't running, then.

steps:
- uses: actions/checkout@v4
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not pinned.

with:
persist-credentials: false
- uses: actions/setup-python@v5
- uses: pre-commit/[email protected]
- uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd # v3.0.1
build:
runs-on: ubuntu-20.04
permissions:
contents: write

steps:
- uses: actions/checkout@v4
with:
persist-credentials: false
- uses: actions/setup-python@v5
Comment on lines 22 to 25
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Neither is pinned.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

none of the wave of PRs pin the actions/XYZ to a sha.

with:
python-version: "3.10"
Expand Down Expand Up @@ -70,11 +79,13 @@ jobs:
- name: Output artifacts URL
run: |
echo 'Artifact URL:' \
'${{ steps.diffs-artifact-upload.outputs.artifact-url }}' \
'${STEPS_DIFFS_ARTIFACT_UPLOAD_OUTPUTS_ARTIFACT_URL}' \
>> $GITHUB_STEP_SUMMARY
env:
STEPS_DIFFS_ARTIFACT_UPLOAD_OUTPUTS_ARTIFACT_URL: ${{ steps.diffs-artifact-upload.outputs.artifact-url }}
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't think we need this step at all any more; the build summary and artifacts are both displayed on the Summary page, so this is redundant.

- name: Publish cheatsheets and handouts
if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/master' }}
uses: peaceiris/actions-gh-pages@v4
uses: peaceiris/actions-gh-pages@4f9cc6602d3f66b9c108549d475ec49e8ef4d45e # v4
with:
github_token: ${{ secrets.GITHUB_TOKEN }}
publish_dir: ./docs/_build/html/
Expand Down
Loading