Skip to content

Commit d3efe88

Browse files
btschwertfegerbtschwertfeger
authored
Preparations - v3.0.0 (#230)
1 parent 638269a commit d3efe88

98 files changed

Lines changed: 2294 additions & 5581 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/workflows/_build.yaml‎

Lines changed: 13 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,12 +18,23 @@ on:
1818
type: string
1919
required: true
2020

21-
permissions: read-all
21+
permissions:
22+
contents: read
2223

2324
jobs:
2425
Build:
2526
runs-on: ${{ inputs.os }}
2627
steps:
28+
- name: Harden Runner
29+
uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 # v2.8.1
30+
with:
31+
disable-sudo: true
32+
egress-policy: block
33+
allowed-endpoints: >
34+
files.pythonhosted.org:443
35+
github.com:443
36+
pypi.org:443
37+
2738
- name: Checkout repository
2839
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
2940
with:
@@ -66,7 +77,7 @@ jobs:
6677
run: python -m build
6778

6879
- name: Store the distribution packages
69-
uses: actions/upload-artifact@v4
80+
uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
7081
# upload artifacts with the oldest supported version
7182
if: runner.os == 'linux' && inputs.python-version == '3.11'
7283
with:

‎.github/workflows/_build_doc.yaml‎

Lines changed: 12 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -17,12 +17,18 @@ on:
1717
type: string
1818
required: true
1919

20-
permissions: read-all
20+
permissions:
21+
contents: read
2122

2223
jobs:
2324
Build:
2425
runs-on: ${{ inputs.os }}
2526
steps:
27+
- name: Harden Runner
28+
uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 # v2.8.1
29+
with:
30+
egress-policy: audit
31+
2632
- name: Checkout repository
2733
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
2834

@@ -34,9 +40,10 @@ jobs:
3440
- name: Install dependencies
3541
run: |
3642
sudo apt update
37-
sudo apt install -y pandoc
38-
python -m pip install --upgrade pip
39-
python -m pip install -r doc/requirements.txt
43+
DEBIAN_FRONTEND=noninteractive sudo apt install -y pandoc
44+
python -m pip install --user -r doc/requirements.txt
45+
python -m pip install --user --upgrade pip
46+
python -m pip install --user .
4047
4148
- name: Build the documentation
42-
run: cd doc && make html
49+
run: make doc

‎.github/workflows/_codecov.yaml‎

Lines changed: 29 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,8 @@ on:
3333
FUTURES_SANDBOX_SECRET:
3434
required: true
3535

36-
permissions: read-all
36+
permissions:
37+
contents: read
3738

3839
jobs:
3940
CodeCov:
@@ -44,6 +45,24 @@ jobs:
4445
PYTHON: ${{ inputs.python-version }}
4546

4647
steps:
48+
- name: Harden Runner
49+
uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 # v2.8.1
50+
with:
51+
disable-sudo: true
52+
egress-policy: block
53+
allowed-endpoints: >
54+
api.codecov.io:443
55+
api.kraken.com:443
56+
cli.codecov.io:443
57+
demo-futures.kraken.com:443
58+
files.pythonhosted.org:443
59+
futures.kraken.com:443
60+
github.com:443
61+
pypi.org:443
62+
storage.googleapis.com:443
63+
ws-auth.kraken.com:443
64+
ws.kraken.com:443
65+
4766
- name: Checkout repository
4867
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
4968

@@ -56,7 +75,7 @@ jobs:
5675
run: python -m pip install --upgrade pip
5776

5877
- name: Install package
59-
run: python -m pip install ".[test]"
78+
run: python -m pip install ".[dev,test]"
6079

6180
- name: Generate coverage report
6281
env:
@@ -66,10 +85,16 @@ jobs:
6685
FUTURES_SECRET_KEY: ${{ secrets.FUTURES_SECRET_KEY }}
6786
FUTURES_SANDBOX_KEY: ${{ secrets.FUTURES_SANDBOX_KEY }}
6887
FUTURES_SANDBOX_SECRET: ${{ secrets.FUTURES_SANDBOX_SECRET }}
69-
run: pytest -vv --cov --cov-report=xml:coverage.xml -m "not flaky" tests
88+
run: pytest -vv --cov --cov-report=xml:coverage.xml tests
89+
90+
- name: Export coverage report
91+
uses: actions/upload-artifact@v4
92+
with:
93+
name: coverage
94+
path: coverage.xml
7095

7196
- name: Upload coverage to Codecov
72-
uses: codecov/codecov-action@v4
97+
uses: codecov/codecov-action@e28ff129e5465c2c0dcc6f003fc735cb6ae0c673 # v4.5.0
7398
with:
7499
token: ${{ secrets.CODECOV_TOKEN }}
75100
files: coverage.xml

‎.github/workflows/_codeql.yaml‎

Lines changed: 16 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -30,12 +30,25 @@ jobs:
3030
# Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support
3131

3232
steps:
33+
- name: Harden Runner
34+
uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 # v2.8.1
35+
with:
36+
disable-sudo: true
37+
egress-policy: block
38+
allowed-endpoints: >
39+
api.github.com:443
40+
github.com:443
41+
3342
- name: Checkout repository
3443
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
3544

45+
- name: "Dependency Review"
46+
if: github.event_name == 'pull_request'
47+
uses: actions/dependency-review-action@0efb1d1d84fc9633afcdaad14c485cbbc90ef46c # v2.5.1
48+
3649
# Initializes the CodeQL tools for scanning.
3750
- name: Initialize CodeQL
38-
uses: github/codeql-action/init@v3
51+
uses: github/codeql-action/init@23acc5c183826b7a8a97bce3cecc52db901f8251 # v3.25.10
3952
with:
4053
languages: python
4154
# If you wish to specify custom queries, you can do so here or in a config file.
@@ -48,7 +61,7 @@ jobs:
4861
# Autobuild attempts to build any compiled languages (C/C++, C#, Go, or Java).
4962
# If this step fails, then you should remove it and run the build manually (see below)
5063
- name: Autobuild
51-
uses: github/codeql-action/autobuild@v3
64+
uses: github/codeql-action/autobuild@23acc5c183826b7a8a97bce3cecc52db901f8251 # v3.25.10
5265

5366
# ℹ️ Command-line programs to run using the OS shell.
5467
# 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
@@ -61,6 +74,6 @@ jobs:
6174
# ./location_of_script_within_repo/buildscript.sh
6275

6376
- name: Perform CodeQL Analysis
64-
uses: github/codeql-action/analyze@v3
77+
uses: github/codeql-action/analyze@23acc5c183826b7a8a97bce3cecc52db901f8251 # v3.25.10
6578
with:
6679
category: "/language:python"

‎.github/workflows/_pre_commit.yaml‎

Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,12 +10,24 @@ name: Pre-Commit
1010
on:
1111
workflow_call:
1212

13-
permissions: read-all
13+
permissions:
14+
contents: read
1415

1516
jobs:
1617
Pre-Commit:
1718
runs-on: ubuntu-latest
1819
steps:
20+
- name: Harden Runner
21+
uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 # v2.8.1
22+
with:
23+
disable-sudo: true
24+
egress-policy: block
25+
allowed-endpoints: >
26+
files.pythonhosted.org:443
27+
github.com:443
28+
proxy.golang.org:443
29+
pypi.org:443
30+
registry.npmjs.org:443
1931
- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
2032
- uses: actions/setup-python@82c7e631bb3cdc910f68e0081d67478d79c6982d # v5.1.0
21-
- uses: pre-commit/action@v3.0.1
33+
- uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd # v3.0.1

‎.github/workflows/_pypi_publish.yaml‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -20,23 +20,25 @@ jobs:
2020
publish-to-pypi:
2121
name: Publish Python distribution to PyPI
2222
runs-on: ubuntu-latest
23-
2423
permissions:
2524
id-token: write # IMPORTANT: this permission is mandatory for OIDC publishing
26-
2725
environment:
2826
name: pypi
2927
url: https://pypi.org/p/python-cmethods
30-
3128
steps:
29+
- name: Harden Runner
30+
uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 # v2.8.1
31+
with:
32+
egress-policy: audit
33+
3234
- name: Download all the distributions
33-
uses: actions/download-artifact@v4
35+
uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e # v4.1.7
3436
with:
3537
name: python-package-distributions
3638
path: dist/
3739

3840
- name: Publish package distributions to PyPI (optional - testpypi)
39-
uses: pypa/gh-action-pypi-publish@release/v1
41+
uses: pypa/gh-action-pypi-publish@ec4db0b4ddc65acdf4bff5fa45ac92d78b56bdf0 # release/v1
4042
with:
4143
password: ${{ secrets.API_TOKEN }}
4244
repository-url: https://upload.pypi.org/legacy/

‎.github/workflows/_pypi_test_publish.yaml‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -26,14 +26,19 @@ jobs:
2626
name: testpypi
2727
url: https://test.pypi.org/p/python-cmethods
2828
steps:
29+
- name: Harden Runner
30+
uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 # v2.8.1
31+
with:
32+
egress-policy: audit
33+
2934
- name: Download all the distributions
30-
uses: actions/download-artifact@v4
35+
uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e # v4.1.7
3136
with:
3237
name: python-package-distributions
3338
path: dist/
3439

3540
- name: Publish package distributions to PyPI (optional - testpypi)
36-
uses: pypa/gh-action-pypi-publish@release/v1
41+
uses: pypa/gh-action-pypi-publish@ec4db0b4ddc65acdf4bff5fa45ac92d78b56bdf0 # release/v1
3742
with:
3843
password: ${{ secrets.API_TOKEN }}
3944
repository-url: https://test.pypi.org/legacy/

‎.github/workflows/_test_futures_private.yaml‎

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,13 +30,26 @@ on:
3030
FUTURES_SANDBOX_SECRET:
3131
required: true
3232

33-
permissions: read-all
33+
permissions:
34+
contents: read
3435

3536
jobs:
3637
Test-Futures:
3738
name: Test ${{ inputs.os }} ${{ inputs.python-version }}
3839
runs-on: ${{ inputs.os }}
3940
steps:
41+
- name: Harden Runner
42+
uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 # v2.8.1
43+
with:
44+
disable-sudo: true
45+
egress-policy: block
46+
allowed-endpoints: >
47+
demo-futures.kraken.com:443
48+
files.pythonhosted.org:443
49+
futures.kraken.com:443
50+
github.com:443
51+
pypi.org:443
52+
4053
- name: Checkout repository
4154
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
4255

‎.github/workflows/_test_futures_public.yaml‎

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,13 +20,25 @@ on:
2020
type: string
2121
required: true
2222

23-
permissions: read-all
23+
permissions:
24+
contents: read
2425

2526
jobs:
2627
Test-Futures:
2728
name: Test ${{ inputs.os }} ${{ inputs.python-version }}
2829
runs-on: ${{ inputs.os }}
2930
steps:
31+
- name: Harden Runner
32+
uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 # v2.8.1
33+
with:
34+
disable-sudo: true
35+
egress-policy: block
36+
allowed-endpoints: >
37+
files.pythonhosted.org:443
38+
futures.kraken.com:443
39+
github.com:443
40+
pypi.org:443
41+
3042
- name: Checkout repository
3143
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
3244

‎.github/workflows/_test_nft_private.yaml‎

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,13 +22,25 @@ on:
2222
SPOT_SECRET_KEY:
2323
required: true
2424

25-
permissions: read-all
25+
permissions:
26+
contents: read
2627

2728
jobs:
2829
Test-NFT:
2930
name: Test ${{ inputs.os }} ${{ inputs.python-version }}
3031
runs-on: ${{ inputs.os }}
3132
steps:
33+
- name: Harden Runner
34+
uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 # v2.8.1
35+
with:
36+
disable-sudo: true
37+
egress-policy: block
38+
allowed-endpoints: >
39+
api.kraken.com:443
40+
files.pythonhosted.org:443
41+
github.com:443
42+
pypi.org:443
43+
3244
- name: Checkout repository
3345
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
3446

0 commit comments

Comments
 (0)