Skip to content

Commit 3648247

Browse files
rflinnenbankrflinnenbank
authored
Hotfix/security update (#89)
Signed-off-by: Raoul Linnenbank <58594297+rflinnenbank@users.noreply.github.com>
1 parent dcfb970 commit 3648247

50 files changed

Lines changed: 1316 additions & 873 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/CODEOWNERS‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
/*
2+
* SPDX-FileCopyrightText: 2025-2026 Contributors to the MeteoForge project
3+
* SPDX-License-Identifier: MPL-2.0
4+
*/
5+
6+
* @alliander-opensource/wpla-alliander
7+
8+
# The following rule assigns ownership of the CODEOWNERS file itself.
9+
# Note: The last matching rule takes precedence according to GitHub documentation.
10+
.github/CODEOWNERS @rflinnenbank

‎.github/ISSUE_TEMPLATE/bug_report.md‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,11 @@ labels: ''
66
assignees: ''
77
---
88

9+
<!--
10+
SPDX-FileCopyrightText: 2025-2026 Contributors to the MeteoForge project
11+
SPDX-License-Identifier: MPL-2.0
12+
-->
13+
914
## **Describe the Bug**
1015

1116
Provide a clear and concise description of the issue.

‎.github/ISSUE_TEMPLATE/feature_request.md‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,11 @@ labels: ''
66
assignees: ''
77
---
88

9+
<!--
10+
SPDX-FileCopyrightText: 2025-2026 Contributors to the MeteoForge project
11+
SPDX-License-Identifier: MPL-2.0
12+
-->
13+
914
## **Is Your Feature Request Related to a Problem? Please Describe**
1015

1116
Provide a clear and concise description of the problem. For example: "I'm frustrated when [...]"

‎.github/dependabot.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,6 @@
1+
# SPDX-FileCopyrightText: 2025-2026 Contributors to the MeteoForge project
2+
# SPDX-License-Identifier: MPL-2.0
3+
14
# To get started with Dependabot version updates, you'll need to specify which
25
# package ecosystems to update and where the package manifests are located.
36
# Please see the documentation for all configuration options:

‎.github/workflows/allowed-pr-sources-dev-release.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,6 @@
1+
# SPDX-FileCopyrightText: 2025-2026 Contributors to the MeteoForge project
2+
# SPDX-License-Identifier: MPL-2.0
3+
14
name: Check if PR source branch is allowed for development or release branches
25

36
on:

‎.github/workflows/allowed-pr-sources-main.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,6 @@
1+
# SPDX-FileCopyrightText: 2025-2026 Contributors to the MeteoForge project
2+
# SPDX-License-Identifier: MPL-2.0
3+
14
name: Check if PR source branch is allowed for main branch
25

36
on:

‎.github/workflows/fuzzing.yml‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
# SPDX-FileCopyrightText: 2025-2026 Contributors to the MeteoForge project
2+
# SPDX-License-Identifier: MPL-2.0
3+
4+
name: Fuzzing
5+
6+
on:
7+
push:
8+
branches:
9+
- main
10+
- development
11+
- 'release/**'
12+
pull_request:
13+
branches:
14+
- main
15+
- development
16+
- 'release/**'
17+
18+
permissions:
19+
contents: read
20+
21+
jobs:
22+
fuzzing:
23+
runs-on: ubuntu-latest
24+
steps:
25+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
26+
- name: Set up Python
27+
uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
28+
with:
29+
python-version: '3.11'
30+
- name: Install Atheris
31+
run: pip install atheris
32+
- name: Run Python fuzz tests
33+
run: |
34+
python3 -m atheris tests/fuzz/test_fuzz_example.py || true

‎.github/workflows/generate-docs.yml‎

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,6 @@
1+
# SPDX-FileCopyrightText: 2025-2026 Contributors to the MeteoForge project
2+
# SPDX-License-Identifier: MPL-2.0
3+
14
name: Update Documentation
25
on:
36
workflow_dispatch:
@@ -12,15 +15,15 @@ jobs:
1215
url: ${{ steps.deployment.outputs.page_url }}
1316
runs-on: ubuntu-latest
1417
steps:
15-
- uses: actions/configure-pages@v5
16-
- uses: actions/checkout@v5
17-
- uses: actions/setup-python@v5
18+
- uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5.0.0
19+
- uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
20+
- uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
1821
with:
1922
python-version: 3.x
2023
- run: pip install zensical
2124
- run: zensical build --clean
22-
- uses: actions/upload-pages-artifact@v4
25+
- uses: actions/upload-pages-artifact@7b1f4a764d45c48632c6b24a0339c27f5614fb0b # v4.0.0
2326
with:
2427
path: site
25-
- uses: actions/deploy-pages@v4
28+
- uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5
2629
id: deployment

‎.github/workflows/openssf-scorecard.yml‎

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,6 @@
1+
# SPDX-FileCopyrightText: 2025-2026 Contributors to the MeteoForge project
2+
# SPDX-License-Identifier: MPL-2.0
3+
14
# This workflow uses actions that are not certified by GitHub. They are provided
25
# by a third-party and are governed by separate terms of service, privacy
36
# policy, and support documentation.
@@ -35,12 +38,12 @@ jobs:
3538

3639
steps:
3740
- name: "Checkout code"
38-
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
41+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
3942
with:
4043
persist-credentials: false
4144

4245
- name: "Run analysis"
43-
uses: ossf/scorecard-action@f49aabe0b5af0936a0987cfb85d86b75731b0186 # v2.4.1
46+
uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
4447
with:
4548
results_file: results.sarif
4649
results_format: sarif
@@ -65,7 +68,7 @@ jobs:
6568
# Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
6669
# format to the repository Actions tab.
6770
- name: "Upload artifact"
68-
uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
71+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
6972
with:
7073
name: SARIF file
7174
path: results.sarif
@@ -74,6 +77,6 @@ jobs:
7477
# Upload the results to GitHub's code scanning dashboard (optional).
7578
# Commenting out will disable upload of results to your repo's Code Scanning dashboard
7679
- name: "Upload to code-scanning"
77-
uses: github/codeql-action/upload-sarif@v3
80+
uses: github/codeql-action/upload-sarif@5c8a8a642e79153f5d047b10ec1cba1d1cc65699 # v3
7881
with:
7982
sarif_file: results.sarif

‎.github/workflows/pr-quality-gate.yaml.yml‎

Lines changed: 10 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,6 @@
1+
# SPDX-FileCopyrightText: 2025-2026 Contributors to the MeteoForge project
2+
# SPDX-License-Identifier: MPL-2.0
3+
14
name: "PR Quality Gate: rc & main"
25

36
on:
@@ -19,13 +22,13 @@ jobs:
1922
if: ${{ !github.event.pull_request.draft }}
2023
runs-on: ubuntu-latest
2124
steps:
22-
- uses: actions/checkout@v4
25+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
2326
# NOTE: point "uses:" to the DIRECTORY that contains action.yaml
2427
# If your composite is at ./pre-commit/action.yaml, use "./pre-commit"
2528
- name: Run pre-commit composite
2629
uses: ./.github/workflows/pre-commit
2730
with:
28-
python-version: ${{ env.MAIN_PYTHON_VERSION }}
31+
python-version: ${{ vars.MAIN_PYTHON_VERSION }}
2932

3033
pytest:
3134
permissions:
@@ -36,9 +39,9 @@ jobs:
3639
runs-on: ubuntu-latest
3740
strategy:
3841
matrix:
39-
python-version: ${{ fromJSON(env.SUPPORTED_PYTHON_VERSIONS) }}
42+
python-version: ${{ fromJSON(vars.SUPPORTED_PYTHON_VERSIONS) }}
4043
steps:
41-
- uses: actions/checkout@v4
44+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
4245
- name: Run pytest composite
4346
uses: ./.github/workflows/pytest
4447
with:
@@ -54,9 +57,9 @@ jobs:
5457
continue-on-error: true
5558
strategy:
5659
matrix:
57-
python-version: ${{ fromJSON(env.SUPPORTED_PYTHON_VERSIONS) }}
60+
python-version: ${{ fromJSON(vars.SUPPORTED_PYTHON_VERSIONS) }}
5861
steps:
59-
- uses: actions/checkout@v4
62+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
6063
- name: Run pytest composite
6164
uses: ./.github/workflows/pytest
6265
with:
@@ -71,7 +74,7 @@ jobs:
7174
runs-on: ubuntu-latest
7275
needs: [ pytest ] # starts only after pytest completes
7376
steps:
74-
- uses: actions/checkout@v4
77+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
7578
- name: Run SonarCloud composite
7679
uses: ./.github/workflows/sonar
7780
with:

0 commit comments

Comments
 (0)