Merge branch 'main' into jx2lee/commit-table-in-bigquery

Author: jx2lee

.github/ISSUE_TEMPLATE/iceberg_bug_report.yml

@@ -28,7 +28,8 @@ body:
       description: What Apache Iceberg version are you using?
       multiple: false
       options:
-        - "0.10.0 (latest release)"
+        - "0.11.0 (latest release)"
+        - "0.10.0"
         - "0.9.1"
         - "0.9.0"
         - "0.8.1"

.github/workflows/check-md-link.yml

@@ -32,6 +32,9 @@ on:
       - 'mkdocs/**'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   markdown-link-check:
     runs-on: ubuntu-latest

.github/workflows/codeql.yml

@@ -27,17 +27,21 @@ on:
   schedule:
     - cron: '16 4 * * 1'
 
+permissions:
+  contents: read
+
 jobs:
   analyze:
     name: Analyze Actions
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-slim
     permissions:
+      contents: read
       security-events: write
       packages: read
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@v6
 
     - name: Initialize CodeQL
       uses: github/codeql-action/init@v4

.github/workflows/license_check.yml

@@ -20,6 +20,9 @@
 name: "Run License Check"
 on: pull_request
 
+permissions:
+  contents: read
+
 jobs:
   rat:
     runs-on: ubuntu-latest

.github/workflows/nightly-pypi-build.yml

@@ -24,6 +24,9 @@ on:
     - cron: "0 0 * * *"  # Runs at midnight UTC every day
   workflow_dispatch:  # Allows manual triggering
 
+permissions:
+  contents: read
+
 jobs:
   set-version:
     if: github.repository == 'apache/iceberg-python'  # Only run for apache repo
@@ -71,7 +74,7 @@ jobs:
 
     steps:
     - name: Download all the artifacts
-      uses: actions/download-artifact@v7
+      uses: actions/download-artifact@v8
       with:
         merge-multiple: true
         path: dist/

.github/workflows/pypi-build-artifacts.yml

@@ -26,6 +26,9 @@ on:
         required: true
         type: string
 
+permissions:
+  contents: read
+
 jobs:
   pypi-build-artifacts:
     name: Build artifacts for PyPi on ${{ matrix.os }}
@@ -63,7 +66,7 @@ jobs:
         if: matrix.os == 'ubuntu-latest'
 
       - name: Build wheels
-        uses: pypa/cibuildwheel@v3.3.1
+        uses: pypa/cibuildwheel@v3.4.0
         with:
           output-dir: wheelhouse
           config-file: "pyproject.toml"

.github/workflows/python-ci-docs.yml

@@ -25,14 +25,17 @@ on:
       - 'main'
   pull_request:
 
+permissions:
+  contents: read
+
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
   docs:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-slim
 
     steps:
       - uses: actions/checkout@v6

.github/workflows/python-ci.yml

@@ -38,6 +38,9 @@ on:
     - '!LICENSE'
     - '!NOTICE'
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
@@ -194,7 +197,7 @@ jobs:
     - name: Install dependencies
       run: uv sync --group dev
     - name: Download all coverage artifacts
-      uses: actions/download-artifact@v7
+      uses: actions/download-artifact@v8
       with:
         pattern: coverage-*
         merge-multiple: true

.github/workflows/python-release-docs.yml

@@ -21,19 +21,24 @@ name: "Release Docs"
 on:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
   docs:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
 
     steps:
       - uses: actions/checkout@v6
       - uses: actions/setup-python@v6
         with:
-          python-version: ${{ matrix.python }}
+          python-version: 3.12
       - name: Install UV
         uses: astral-sh/setup-uv@v7
       - name: Build docs

.github/workflows/python-release.yml

@@ -36,6 +36,9 @@ on:
         type: number
         required: true
 
+permissions:
+  contents: read
+
 jobs:
   validate-inputs:
     runs-on: ubuntu-latest