Audit permissions and add zizmor configuration

.github/actions/app-create/action.yml

@@ -29,14 +29,18 @@ runs:
     - name: Briefcase Template Override
       id: template-override
       env:
+        GITHUB_PR_NUMBER: ${{ github.event.pull_request.number }}
         GITHUB_TOKEN: ${{ github.token }}
+        INPUT_BRIEFCASE_TEMPLATE_BRANCH: ${{ inputs.briefcase-template-branch }}
+        INPUT_BRIEFCASE_TEMPLATE_SOURCE: ${{ inputs.briefcase-template-source }}
+        INPUT_TESTING_PR_BODY: ${{ inputs.testing-pr-body }}
       shell: bash
       run: |
         # Check Body of PR for template to use
         # (only PRs will have a value for github.event.pull_request.number)
-        PR_BODY="${{ inputs.testing-pr-body }}"
-        if [[ -z "${PR_BODY}" && -n "${{ github.event.pull_request.number }}" ]]; then
-          PR_BODY=$(gh api repos/${{ github.repository }}/pulls/${{ github.event.pull_request.number }} --jq '.body')
+        PR_BODY="${INPUT_TESTING_PR_BODY}"
+        if [[ -z "${PR_BODY}" && -n "${GITHUB_PR_NUMBER}" ]]; then
+          PR_BODY=$(gh api "repos/${GITHUB_REPOSITORY}/pulls/${GITHUB_PR_NUMBER}" --jq '.body')
         fi
         printf "::group::Retrieved PR Body\n%s\n::endgroup::\n" "${PR_BODY}"
 
@@ -45,10 +49,10 @@ runs:
 
         # If a template is not in the PR, use inputs specified in CI workflow
         if [ -z "${TEMPLATE_REPO}" ]; then
-          TEMPLATE_REPO="${{ inputs.briefcase-template-source }}"
+          TEMPLATE_REPO="${INPUT_BRIEFCASE_TEMPLATE_SOURCE}"
         fi
         if [ -z "${TEMPLATE_REF}" ]; then
-          TEMPLATE_REF="${{ inputs.briefcase-template-branch }}"
+          TEMPLATE_REF="${INPUT_BRIEFCASE_TEMPLATE_BRANCH}"
         fi
 
         # Expose template repo and branch via outputs
@@ -58,25 +62,30 @@ runs:
     - name: Create Briefcase Project
       id: create
       shell: bash
+      env:
+        INPUT_ENABLE_AUTOMATION: ${{ inputs.enable-automation }}
+        INPUT_FRAMEWORK: ${{ inputs.framework }}
+        TEMPLATE_REF: ${{ steps.template-override.outputs.ref }}
+        TEMPLATE_REPO: ${{ steps.template-override.outputs.repo }}
       run: |
-        if [[ "${{ steps.template-override.outputs.repo }}" != "" ]]; then
-          TEMPLATE=$(printf -- "--template %q" "${{ steps.template-override.outputs.repo }}")
+        if [[ "${TEMPLATE_REPO}" != "" ]]; then
+          TEMPLATE=$(printf -- "--template %q" "${TEMPLATE_REPO}")
         fi
-        if [[ "${{ steps.template-override.outputs.ref }}" != "" ]]; then
-          TEMPLATE_BRANCH=$(printf -- "--template-branch %q" "${{ steps.template-override.outputs.ref }}")
+        if [[ "${TEMPLATE_REF}" != "" ]]; then
+          TEMPLATE_BRANCH=$(printf -- "--template-branch %q" "${TEMPLATE_REF}")
         fi
 
         # Map GUI toolkit through case insensitivity
-        case "$(tr '[:upper:]' '[:lower:]' <<< "${{ inputs.framework }}")" in
+        case "$(tr '[:upper:]' '[:lower:]' <<< "${INPUT_FRAMEWORK}")" in
           toga    ) BOOTSTRAP=Toga ;;
           pyside6 ) BOOTSTRAP=PySide6 ;;
           pygame  ) BOOTSTRAP=Pygame ;;
           console ) BOOTSTRAP=Console ;;
-          *       ) BOOTSTRAP=${{ inputs.framework }} ;;
+          *       ) BOOTSTRAP="${INPUT_FRAMEWORK}" ;;
         esac
 
         # If enabled, use the Automation bootstrap
-        [ "${{ inputs.enable-automation }}" != "false" ] && BOOTSTRAP="${BOOTSTRAP} Automation"
+        [ "${INPUT_ENABLE_AUTOMATION}" != "false" ] && BOOTSTRAP="${BOOTSTRAP} Automation"
 
         ROOT_DIR="apps"
         APP_NAME="Verify App"
@@ -95,7 +104,7 @@ runs:
           -Q "bootstrap=${BOOTSTRAP}"
 
         echo "Rolled out project to ${APP_PATH}"
-        echo " > GUI Toolkit: ${{ inputs.framework }}"
+        echo " > GUI Toolkit: ${INPUT_FRAMEWORK}"
         echo " > Bootstrap: ${BOOTSTRAP}"
         printf "::group::pyproject.toml\n%s\n::endgroup::\n" "$(cat "${APP_DIR}/pyproject.toml")"
         printf "::group::app.py\n%s\n::endgroup::\n" "$(cat "${APP_DIR}/src/${APP_DIR}/app.py")"

.github/actions/install-briefcase/action.yml

@@ -35,14 +35,19 @@ runs:
     - name: Use Specified Briefcase Version
       id: briefcase-override
       env:
+        GITHUB_PR_NUMBER: ${{ github.event.pull_request.number }}
         GITHUB_TOKEN: ${{ github.token }}
+        INPUT_BRIEFCASE_OVERRIDE_VERSION: ${{ inputs.briefcase-override-version }}
+        INPUT_BRIEFCASE_URL: ${{ inputs.briefcase-url }}
+        INPUT_TESTING_PR_BODY: ${{ inputs.testing-pr-body }}
       shell: bash
+
       run: |
         # Check Body of PR for Briefcase version to use
         # (only PRs will have a value for github.event.pull_request.number)
-        PR_BODY="${{ inputs.testing-pr-body }}"
-        if [[ -z "${PR_BODY}" && -n "${{ github.event.pull_request.number }}" ]]; then
-          PR_BODY=$(gh api repos/${{ github.repository }}/pulls/${{ github.event.pull_request.number }} --jq '.body')
+        PR_BODY="${INPUT_TESTING_PR_BODY}"
+        if [[ -z "${PR_BODY}" && -n "${GITHUB_PR_NUMBER}" ]]; then
+          PR_BODY=$(gh api "repos/${GITHUB_REPOSITORY}/pulls/${GITHUB_PR_NUMBER}" --jq '.body')
         fi
         printf "::group::Retrieved PR Body\n%s\n::endgroup::\n" "${PR_BODY}"
 
@@ -51,10 +56,10 @@ runs:
 
         # If a version is not in the PR, use inputs specified in CI workflow
         if [ -z "${BRIEFCASE_REPO}" ]; then
-          BRIEFCASE_REPO="${{ inputs.briefcase-url }}"
+          BRIEFCASE_REPO="${INPUT_BRIEFCASE_URL}"
         fi
         if [ -z "${BRIEFCASE_REF}" ]; then
-          BRIEFCASE_REF="${{ inputs.briefcase-override-version }}"
+          BRIEFCASE_REF="${INPUT_BRIEFCASE_OVERRIDE_VERSION}"
         fi
 
         # Expose repo and version via outputs
@@ -65,31 +70,37 @@ runs:
       id: briefcase-derived
       if: steps.briefcase-override.outputs.ref == ''
       shell: bash
+      env:
+        INPUT_BRIEFCASE_DEFAULT_BRANCH: ${{ inputs.briefcase-default-branch }}
+        INPUT_BRIEFCASE_URL: ${{ inputs.briefcase-url }}
+        INPUT_TESTING_PR_REF: ${{ inputs.testing-pr-ref }}
+        INPUT_TESTING_REF_NAME: ${{ inputs.testing-ref-name }}
+        INPUT_TESTING_TRIGGER_REF: ${{ inputs.testing-trigger-ref }}
       run: |
         # Branch or tag that triggered the workflow.
         #  For example, when github.event is:
         #   push:         refs/heads/<branch_name>
         #                 refs/tags/<tag_name>
         #   release:      refs/tags/<tag_name>
         #   pull_request: refs/pull/<pr_number>/merge
-        TRIGGER_REF="${{ inputs.testing-trigger-ref || github.ref }}"
+        TRIGGER_REF="${INPUT_TESTING_TRIGGER_REF:-$GITHUB_REF}"
 
         # PR target branch (only available for pull requests)
-        PR_TARGET_REF="${{ inputs.testing-pr-ref || github.base_ref }}"
+        PR_TARGET_REF="${INPUT_TESTING_PR_REF:-$GITHUB_BASE_REF}"
 
         # The short ref name of the branch or tag that triggered the workflow
         #  For example:
         #   push:         main
         #   release:      v0.3.12
         #   pull_request: 18/merge
-        REF_NAME="${{ inputs.testing-ref-name || github.ref_name }}"
+        REF_NAME="${INPUT_TESTING_REF_NAME:-$GITHUB_REF_NAME}"
 
         echo "::group::Workflow Trigger Details"
-        echo "Event:    ${{ github.event_name }}"
-        echo "Ref:      ${{ github.ref }}"
-        echo "Base Ref: ${{ github.base_ref }}"
-        echo "Head Ref: ${{ github.head_ref }}"
-        echo "Ref Name: ${{ github.ref_name }}"
+        echo "Event:    ${GITHUB_EVENT_NAME}"
+        echo "Ref:      ${GITHUB_REF}"
+        echo "Base Ref: ${GITHUB_BASE_REF}"
+        echo "Head Ref: ${GITHUB_HEAD_REF}"
+        echo "Ref Name: ${GITHUB_REF_NAME}"
         echo "::endgroup::"
 
         case "${TRIGGER_REF}" in
@@ -106,26 +117,26 @@ runs:
 
           # Default to 'main'
           * )
-            echo "::warning::Could not determine Briefcase version from '${TRIGGER_REF}'; defaulting to '${{ inputs.briefcase-default-branch }}'."
-            TARGET_VERSION="${{ inputs.briefcase-default-branch }}"
+            echo "::warning::Could not determine Briefcase version from '${TRIGGER_REF}'; defaulting to '${INPUT_BRIEFCASE_DEFAULT_BRANCH}'."
+            TARGET_VERSION="${INPUT_BRIEFCASE_DEFAULT_BRANCH}"
             ;;
 
         esac
 
         echo "Derived Briefcase version: ${TARGET_VERSION}"
 
         # Use Briefcase's default branch
-        if [[ "${TARGET_VERSION}" == "${{ inputs.briefcase-default-branch }}" ]]; then
+        if [[ "${TARGET_VERSION}" == "${INPUT_BRIEFCASE_DEFAULT_BRANCH}" ]]; then
           echo "version=${TARGET_VERSION}" >> ${GITHUB_OUTPUT}
 
         # Use version if it is a valid Briefcase tag
-        elif [[ $(git ls-remote --tags "${{ inputs.briefcase-url }}" "${TARGET_VERSION}") ]]; then
+        elif [[ $(git ls-remote --tags "${INPUT_BRIEFCASE_URL}" "${TARGET_VERSION}") ]]; then
           echo "version=${TARGET_VERSION}" >> ${GITHUB_OUTPUT}
 
         # Default to Briefcase's default branch
         else
-          echo "::warning::Unknown Briefcase version: '${TARGET_VERSION}'; defaulting to '${{ inputs.briefcase-default-branch }}'."
-          echo "version=${{ inputs.briefcase-default-branch }}" >> ${GITHUB_OUTPUT}
+          echo "::warning::Unknown Briefcase version: '${TARGET_VERSION}'; defaulting to '${INPUT_BRIEFCASE_DEFAULT_BRANCH}'."
+          echo "version=${INPUT_BRIEFCASE_DEFAULT_BRANCH}" >> ${GITHUB_OUTPUT}
         fi
 
     - name: Update pip
@@ -135,9 +146,14 @@ runs:
     - name: Install Briefcase
       id: install
       shell: bash
+      env:
+        DERIVED_VERSION: ${{ steps.briefcase-derived.outputs.version }}
+        INPUT_BRIEFCASE_URL: ${{ inputs.briefcase-url }}
+        OVERRIDE_REF: ${{ steps.briefcase-override.outputs.ref }}
+        OVERRIDE_REPO: ${{ steps.briefcase-override.outputs.repo }}
       run: |
-        REPO="${{ steps.briefcase-override.outputs.repo || inputs.briefcase-url }}"
-        REF="${{ steps.briefcase-override.outputs.ref || steps.briefcase-derived.outputs.version }}"
+        REPO="${OVERRIDE_REPO:-$INPUT_BRIEFCASE_URL}"
+        REF="${OVERRIDE_REF:-$DERIVED_VERSION}"
 
         echo "Installing ${REPO}@${REF}"
         python -m pip install \

.github/dependabot.yml

@@ -7,6 +7,8 @@ updates:
       interval: "weekly"
       day: "sunday"
       time: "20:00"
+    cooldown:
+      default-days: 7
 
   - package-ecosystem: "pip"
     directory: "/"
@@ -15,3 +17,5 @@ updates:
       interval: "weekly"
       day: "sunday"
       time: "20:00"
+    cooldown:
+      default-days: 7