Skip to content

Commit b2fa6b6

Browse files
nathanjmcdougallnathanjmcdougall
authored
Comply with zizmor (#971)
1 parent bc8fc1a commit b2fa6b6

3 files changed

Lines changed: 60 additions & 49 deletions

File tree

‎.github/workflows/ci.yml‎

Lines changed: 11 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,5 @@
11
name: CI
2-
permissions:
3-
contents: read
4-
pull-requests: write
2+
permissions: {}
53
on:
64
workflow_dispatch:
75
push:
@@ -20,13 +18,18 @@ concurrency:
2018
cancel-in-progress: true
2119
jobs:
2220
tests:
21+
permissions:
22+
contents: read
23+
pull-requests: write # Needed to add Codecov and CodSpeed comments
2324
name: ${{ (matrix.codecov == 'true' && 'Codecov') || (matrix.codspeed == 'true' && 'CodSpeed') || format('Test Python {0} {1}', matrix.python_version, ((matrix.dependencies == 'min' || matrix.dependencies == 'max') && format('{0} dependencies', matrix.dependencies)) || (matrix.os || 'ubuntu-latest')) }}
2425
runs-on: ${{ matrix.os || 'ubuntu-latest' }}
2526
env:
2627
PYTHONIOENCODING: utf-8
2728
steps:
2829
- name: Checkout code
2930
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
31+
with:
32+
persist-credentials: false
3033

3134
- name: Setup git user config
3235
run: |
@@ -51,8 +54,11 @@ jobs:
5154
5255
- name: Setup dependencies
5356
run: |
54-
uv python pin ${{ matrix.python_version }}
55-
uv sync --resolution ${{ matrix.dependencies == 'min' && 'lowest-direct' || 'highest' }}
57+
uv python pin $CI_PYTHON_VERSION
58+
uv sync
59+
env:
60+
UV_RESOLUTION: ${{ matrix.dependencies == 'min' && 'lowest-direct' || 'highest' }}
61+
CI_PYTHON_VERSION: ${{ matrix.python_version }}
5662

5763
- name: Run prek
5864
if: ${{ matrix.pre_commit == null || matrix.pre_commit == 'true' }}

‎.github/workflows/codeql.yml‎

Lines changed: 26 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -1,40 +1,41 @@
11
name: "CodeQL"
2-
2+
permissions: {}
33
on:
44
push:
5-
branches: [ "main" ]
5+
branches: ["main"]
66
paths-ignore:
7-
- 'docs/**'
8-
- '**/*.md'
9-
- 'mkdocs.yml'
7+
- "docs/**"
8+
- "**/*.md"
9+
- "mkdocs.yml"
1010
pull_request:
11-
branches: [ "main" ]
11+
branches: ["main"]
1212
paths-ignore:
13-
- 'docs/**'
14-
- '**/*.md'
15-
- 'mkdocs.yml'
13+
- "docs/**"
14+
- "**/*.md"
15+
- "mkdocs.yml"
1616
jobs:
1717
analyze:
1818
name: Analyze (${{ matrix.language }})
19-
runs-on: 'ubuntu-latest'
19+
runs-on: "ubuntu-latest"
2020
permissions:
21-
# required for all workflows
22-
security-events: write
21+
security-events: write # Required for all workflows
2322
strategy:
2423
fail-fast: false
2524
matrix:
2625
include:
27-
- language: actions
28-
- language: python
26+
- language: actions
27+
- language: python
2928
steps:
30-
- name: Checkout repository
31-
uses: actions/checkout@v4
32-
- name: Initialize CodeQL
33-
uses: github/codeql-action/init@v3
34-
with:
35-
languages: ${{ matrix.language }}
36-
build-mode: none
37-
- name: Perform CodeQL Analysis
38-
uses: github/codeql-action/analyze@v3
39-
with:
40-
category: "/language:${{matrix.language}}"
29+
- name: Checkout repository
30+
uses: actions/checkout@v4
31+
with:
32+
persist-credentials: false
33+
- name: Initialize CodeQL
34+
uses: github/codeql-action/init@v3
35+
with:
36+
languages: ${{ matrix.language }}
37+
build-mode: none
38+
- name: Perform CodeQL Analysis
39+
uses: github/codeql-action/analyze@v3
40+
with:
41+
category: "/language:${{matrix.language}}"

‎.github/workflows/release.yml‎

Lines changed: 23 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -1,32 +1,36 @@
1-
21
name: Release to PyPI
3-
permissions:
4-
contents: read
2+
permissions: {}
53
on:
64
push:
75
tags:
8-
- 'v*'
6+
- "v*"
97
jobs:
108
deploy:
9+
name: Release
10+
1111
runs-on: ubuntu-latest
1212
environment: release
1313
permissions:
14-
id-token: write
14+
contents: read
15+
id-token: write # Needed for trusted publishing
1516
steps:
16-
- name: Checkout code
17-
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
17+
- name: Checkout code
18+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
19+
with:
20+
persist-credentials: false
1821

19-
- name: Set up uv
20-
uses: astral-sh/setup-uv@3b9817b1bf26186f03ab8277bab9b827ea5cc254 # v3.2.0
21-
with:
22-
version: "latest"
22+
- name: Set up uv
23+
uses: astral-sh/setup-uv@3b9817b1bf26186f03ab8277bab9b827ea5cc254 # v3.2.0
24+
with:
25+
version: "latest"
26+
enable-cache: false
2327

24-
- name: "Set up Python"
25-
uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
26-
with:
27-
python-version: 3.12
28+
- name: "Set up Python"
29+
uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
30+
with:
31+
python-version: 3.12
2832

29-
- name: Release
30-
run: |
31-
uv build
32-
uv publish --trusted-publishing always
33+
- name: Release
34+
run: |
35+
uv build
36+
uv publish --trusted-publishing always

0 commit comments

Comments
 (0)