Merge pull request #1437 from PyThaiNLP/copilot/add-module-th-pron

Add Wiktionary th-pron transliterator to pythainlp.transliterate

Author: wannaphong

.github/workflows/bandit.yml

@@ -0,0 +1,66 @@
+# SPDX-FileCopyrightText: 2026-present PyThaiNLP Project
+# SPDX-License-Identifier: Apache-2.0
+
+# Bandit is a tool designed to find common security issues in Python code.
+# https://github.com/pycqa/bandit
+
+name: Bandit
+
+on:
+  push:
+    branches:
+      - dev
+      - main
+    paths-ignore:
+      - '**.cff'
+      - '**.json'
+      - '**.md'
+      - '**.rst'
+      - '**.txt'
+      - 'docs/**'
+  pull_request:
+    branches:
+      - dev
+      - main
+    paths-ignore:
+      - '**.cff'
+      - '**.json'
+      - '**.md'
+      - '**.rst'
+      - '**.txt'
+      - 'docs/**'
+
+# Avoid duplicate runs for the same source branch and repository.
+# For pull_request events, uses the source repo name from
+# github.event.pull_request.head.repo.full_name; otherwise uses github.repository.
+# For push events, uses the branch name from github.ref_name.
+# For pull_request events, uses the source branch name from github.head_ref.
+# This ensures events for the same repo and branch share the same group,
+# and avoids cross-fork collisions when branch names are reused.
+concurrency:
+  group: >-
+    ${{ github.workflow }}-${{
+      github.event.pull_request.head.repo.full_name || github.repository
+    }}-${{ github.head_ref || github.ref_name }}
+  cancel-in-progress: true
+
+jobs:
+  bandit:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6.0.2
+
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.x"
+          cache: "pip"
+
+      - name: Install bandit
+        run: pip install "bandit>=1.9.4"
+
+      - name: Run bandit
+        run: bandit -r pythainlp -c pyproject.toml

.github/workflows/codemeta2cff.yml

@@ -25,7 +25,7 @@ jobs:
       contents: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.3
 
       - name: Generate CITATION.cff from codemeta.json
         uses: caltechlibrary/codemeta2cff@99ce10831c3037a067c3d9551d455638e0b438ac  #v0.3.3
@@ -37,7 +37,7 @@ jobs:
           printf '\n```' >> $GITHUB_STEP_SUMMARY
 
       - name: Validate CITATION.cff
-        uses: dieghernan/cff-validator@114aae53e1850c3757733beb60036941900e3dc3  #v4
+        uses: dieghernan/cff-validator@54c8e737314b948f25c0e5524a9d8ae3f39b207b  #v5.0.1
 
       - name: Commit and push updated CITATION.cff
         uses: EndBug/add-and-commit@290ea2c423ad77ca9c62ae0f5b224379612c0321  #v10.0.0

.github/workflows/codeql-analysis.yml

@@ -62,11 +62,11 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v6
+      uses: actions/checkout@v6.0.3
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v4
+      uses: github/codeql-action/init@v4.36.2
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -77,7 +77,7 @@ jobs:
     # Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@v4
+      uses: github/codeql-action/autobuild@v4.36.2
 
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 https://git.io/JvXDl
@@ -91,4 +91,4 @@ jobs:
     #   make release
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v4
+      uses: github/codeql-action/analyze@v4.36.2

.github/workflows/corpus.yml

@@ -36,7 +36,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.3
 
       - name: Set up Python
         uses: actions/setup-python@v6

.github/workflows/deploy-docs.yml

@@ -24,7 +24,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@v6
+      uses: actions/checkout@v6.0.3
     - name: Set up Python
       uses: actions/setup-python@v6
       with:
@@ -38,7 +38,7 @@ jobs:
         cd docs && make html
         cd ..
     - name: Deploy documentation
-      uses: peaceiris/actions-gh-pages@v4
+      uses: peaceiris/actions-gh-pages@v4.1.0
       with:
         personal_token: ${{ secrets.PERSONAL_TOKEN }}
         publish_dir: ./docs/_build/html

.github/workflows/lint.yml

@@ -43,7 +43,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@v6
+      uses: actions/checkout@v6.0.3
     - name: Ruff
       uses: astral-sh/ruff-action@v3
       with:

.github/workflows/markdownlint.yml

@@ -24,11 +24,11 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.3
         with:
           fetch-depth: 0
 
-      - uses: DavidAnson/markdownlint-cli2-action@v23.1.0
+      - uses: DavidAnson/markdownlint-cli2-action@v23.2.0
         with:
           globs: |
             **/*.md

.github/workflows/mypy.yml

@@ -46,7 +46,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.0.3
 
       - name: Set up Python
         uses: actions/setup-python@v6

.github/workflows/publish-versioned-docs.yml

@@ -31,19 +31,19 @@ jobs:
       run: echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"
 
     - name: Checkout pythainlp (for scripts)
-      uses: actions/checkout@v6
+      uses: actions/checkout@v6.0.3
       with:
         path: pythainlp
 
     - name: Checkout dev-docs repository
-      uses: actions/checkout@v6
+      uses: actions/checkout@v6.0.3
       with:
         repository: PyThaiNLP/dev-docs
         token: ${{ secrets.PERSONAL_TOKEN }}
         path: dev-docs
 
     - name: Checkout docs repository
-      uses: actions/checkout@v6
+      uses: actions/checkout@v6.0.3
       with:
         repository: PyThaiNLP/docs
         token: ${{ secrets.PERSONAL_TOKEN }}

.github/workflows/pypi-publish.yml

@@ -52,7 +52,7 @@ jobs:
       build: ${{ steps.check_build_trigger.outputs.build }}
     steps:
     - name: Checkout source code
-      uses: actions/checkout@v6
+      uses: actions/checkout@v6.0.3
       with:
         ref: ${{ github.event.pull_request.head.sha }}
     - id: check_build_trigger
@@ -71,7 +71,7 @@ jobs:
 
     steps:
     - name: Checkout
-      uses: actions/checkout@v6
+      uses: actions/checkout@v6.0.3
 
     - name: Set up Python ${{ matrix.python-version }}
       uses: actions/setup-python@v6