Skip to content

Commit 69a6910

Browse files
matneumatneu
committed
[GR-76196] github worflow hardening
PullRequest: graalpython/4605
2 parents fad65bd + b78dbcf commit 69a6910

12 files changed

Lines changed: 136 additions & 62 deletions

‎.github/actions/downstream-test/action.yml‎

Lines changed: 11 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,10 @@ inputs:
2323
arch:
2424
description: Architecture identifier (e.g. amd64/aarch64)
2525
required: true
26+
github_token:
27+
description: Token used only for querying GraalPy CE dev-build releases on macOS
28+
required: false
29+
default: ""
2630

2731
runs:
2832
using: composite
@@ -46,28 +50,26 @@ runs:
4650
4751
- name: Install Rust toolchain
4852
if: ${{ inputs.needs_rust == 'true' }}
49-
shell: bash
50-
run: |
51-
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
52-
echo "${HOME}/.cargo/bin" >> $GITHUB_PATH
53+
uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
54+
with:
55+
toolchain: stable
5356

5457
- name: Install uv
5558
if: ${{ inputs.needs_uv == 'true' }}
56-
shell: bash
57-
run: |
58-
curl -LsSf https://astral.sh/uv/install.sh | sh
59-
echo "$HOME/.local/bin" >> $GITHUB_PATH
59+
uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
6060

6161
- name: Get GraalPy CE dev build
6262
if: ${{ inputs.platform == 'macos' }}
6363
shell: bash
64+
env:
65+
GITHUB_TOKEN: ${{ inputs.github_token }}
6466
run: |
6567
tarball="$(curl -sH "Authorization: token $GITHUB_TOKEN" "https://api.github.com/repos/graalvm/graalvm-ce-dev-builds/releases/latest" | jq -r --arg platform "${{ inputs.platform }}" --arg arch "${{ inputs.arch }}" 'first(.assets[] | select(.name | test("^graalpy[0-9.]+-community-dev-\($platform)-\($arch)\\.(tar\\.gz|zip)$")) | .browser_download_url)')"
6668
curl -sfL "$tarball" | tar xz
6769
6870
- name: Get GraalPy build artifact
6971
if: ${{ inputs.platform == 'linux' }}
70-
uses: actions/download-artifact@v5
72+
uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
7173
with:
7274
name: graalpy-native-standalonelinux
7375
path: graalpynative

‎.github/scripts/set-export‎

Lines changed: 41 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,47 @@
22

33
VAR_NAME="$1"
44
ARTIFACT_PATH="$2"
5-
REAL_PATH=$(eval echo $ARTIFACT_PATH)
65

7-
if [ -d "$REAL_PATH" ]; then
6+
expand_env_vars() {
7+
local input="$1"
8+
local output=""
9+
local prefix suffix var_name
10+
11+
while [[ "$input" == *'$'* ]]; do
12+
prefix="${input%%\$*}"
13+
suffix="${input#*\$}"
14+
output+="$prefix"
15+
16+
if [[ "$suffix" =~ ^\{([A-Za-z_][A-Za-z0-9_]*)\}(.*)$ ]]; then
17+
var_name="${BASH_REMATCH[1]}"
18+
output+="${!var_name-}"
19+
input="${BASH_REMATCH[2]}"
20+
elif [[ "$suffix" =~ ^([A-Za-z_][A-Za-z0-9_]*)(.*)$ ]]; then
21+
var_name="${BASH_REMATCH[1]}"
22+
output+="${!var_name-}"
23+
input="${BASH_REMATCH[2]}"
24+
else
25+
output+='$'
26+
input="$suffix"
27+
fi
28+
done
29+
30+
printf '%s' "$output$input"
31+
}
32+
33+
ARTIFACT_PATH=$(expand_env_vars "$ARTIFACT_PATH")
34+
35+
shopt -s nullglob
36+
OLD_IFS="$IFS"
37+
IFS=
38+
# Intentionally unquoted: expand artifact path globs after variable substitution.
39+
# shellcheck disable=SC2206
40+
MATCHES=( $ARTIFACT_PATH )
41+
IFS="$OLD_IFS"
42+
shopt -u nullglob
43+
44+
if [ "${#MATCHES[@]}" -eq 1 ] && [ -d "${MATCHES[0]}" ]; then
45+
REAL_PATH="${MATCHES[0]}"
846
export "$VAR_NAME"="$REAL_PATH"
947
echo "$VAR_NAME"="$REAL_PATH" >> "$GITHUB_ENV"
10-
fi
48+
fi

‎.github/workflows/_downstream-test-common.yml‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,10 @@ on:
1919
required: false
2020
default: false
2121

22+
permissions:
23+
actions: read
24+
contents: read
25+
2226
jobs:
2327
downstream:
2428
strategy:
@@ -33,11 +37,9 @@ jobs:
3337
arch: aarch64
3438

3539
runs-on: ${{ matrix.os.id }}
36-
env:
37-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
3840

3941
steps:
40-
- uses: actions/checkout@v6
42+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
4143

4244
- name: Run downstream test
4345
uses: ./.github/actions/downstream-test
@@ -48,3 +50,4 @@ jobs:
4850
needs_uv: ${{ inputs.needs_uv }}
4951
platform: ${{ matrix.os.platform }}
5052
arch: ${{ matrix.os.arch }}
53+
github_token: ${{ matrix.os.platform == 'macos' && secrets.GITHUB_TOKEN || '' }}

‎.github/workflows/_downstream-test-oracledb.yml‎

Lines changed: 17 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -19,15 +19,19 @@ on:
1919
required: false
2020
default: false
2121

22+
permissions:
23+
actions: read
24+
contents: read
25+
2226
jobs:
2327
build-numpy-wheels:
2428
runs-on: ubuntu-latest
2529
env:
2630
PACKAGES_TO_BUILD: numpy==2.2.6
2731
steps:
28-
- uses: actions/checkout@v6
32+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
2933
- name: Get GraalPy build artifact
30-
uses: actions/download-artifact@v5
34+
uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
3135
with:
3236
name: graalpy-native-standalonelinux
3337
path: graalpynative
@@ -46,7 +50,7 @@ jobs:
4650
graalpy/bin/pip install wheel
4751
graalpy/bin/pip wheel -w wheelhouse "$PACKAGES_TO_BUILD"
4852
- name: Store numpy wheels
49-
uses: actions/upload-artifact@v5
53+
uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
5054
with:
5155
name: wheels-numpy
5256
path: wheelhouse/*.whl
@@ -60,14 +64,14 @@ jobs:
6064
PIP_FIND_LINKS: ${{ github.workspace }}/dependency-wheels
6165
PIP_PREFER_BINARY: "1"
6266
steps:
63-
- uses: actions/checkout@v6
67+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
6468
- name: Get GraalPy build artifact
65-
uses: actions/download-artifact@v5
69+
uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
6670
with:
6771
name: graalpy-native-standalonelinux
6872
path: graalpynative
6973
- name: Get dependency wheels
70-
uses: actions/download-artifact@v5
74+
uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
7175
with:
7276
name: wheels-numpy
7377
path: dependency-wheels
@@ -87,7 +91,7 @@ jobs:
8791
graalpy/bin/pip install --no-index --find-links dependency-wheels numpy==2.2.6
8892
graalpy/bin/pip wheel -w wheelhouse "$PACKAGES_TO_BUILD"
8993
- name: Store pandas wheels
90-
uses: actions/upload-artifact@v5
94+
uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
9195
with:
9296
name: wheels-pandas
9397
path: wheelhouse/*.whl
@@ -101,14 +105,14 @@ jobs:
101105
PIP_FIND_LINKS: ${{ github.workspace }}/dependency-wheels
102106
PIP_PREFER_BINARY: "1"
103107
steps:
104-
- uses: actions/checkout@v6
108+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
105109
- name: Get GraalPy build artifact
106-
uses: actions/download-artifact@v5
110+
uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
107111
with:
108112
name: graalpy-native-standalonelinux
109113
path: graalpynative
110114
- name: Get dependency wheels
111-
uses: actions/download-artifact@v5
115+
uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
112116
with:
113117
name: wheels-numpy
114118
path: dependency-wheels
@@ -145,7 +149,7 @@ jobs:
145149
graalpy/bin/pip install --no-index --find-links dependency-wheels numpy==2.2.6
146150
graalpy/bin/pip wheel -w wheelhouse "$PACKAGES_TO_BUILD"
147151
- name: Store pyarrow wheels
148-
uses: actions/upload-artifact@v5
152+
uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
149153
with:
150154
name: wheels-pyarrow
151155
path: wheelhouse/*.whl
@@ -165,7 +169,6 @@ jobs:
165169

166170
runs-on: ${{ matrix.os.id }}
167171
env:
168-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
169172
ORACLE_CLIENT_DIR: /opt/oracle/instantclient
170173
PIP_FIND_LINKS: /tmp/oracledb-wheels
171174
PIP_PREFER_BINARY: "1"
@@ -182,9 +185,9 @@ jobs:
182185
- 5500:5500
183186

184187
steps:
185-
- uses: actions/checkout@v6
188+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
186189
- name: Get package wheels
187-
uses: actions/download-artifact@v5
190+
uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
188191
with:
189192
pattern: wheels-*
190193
path: /tmp/oracledb-wheels

‎.github/workflows/build-website.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -31,9 +31,9 @@ jobs:
3131
runs-on: ubuntu-latest
3232
steps:
3333
- name: Check out repository
34-
uses: actions/checkout@v6
34+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
3535
- name: Set up Ruby
36-
uses: ruby/setup-ruby@v1
36+
uses: ruby/setup-ruby@afeafc3d1ab54a631816aba4c914a0081c12ff2f # v1.310.0
3737
with:
3838
ruby-version: '3.2'
3939
- name: Install website dependencies
@@ -45,7 +45,7 @@ jobs:
4545
JEKYLL_ENV: production
4646
run: bundle exec jekyll build
4747
- name: Upload artifact
48-
uses: actions/upload-pages-artifact@v5
48+
uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
4949
with:
5050
path: docs/site/_site
5151

@@ -61,4 +61,4 @@ jobs:
6161
steps:
6262
- name: Deploy to GitHub Pages
6363
id: deployment
64-
uses: actions/deploy-pages@v5
64+
uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0

‎.github/workflows/build-wheels.yml‎

Lines changed: 11 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,9 @@ name: Build Wheels
2323
- self-hosted-macos-aarch64
2424
- self-hosted-windows-amd64
2525

26+
permissions:
27+
contents: read
28+
2629
jobs:
2730
build_wheels:
2831
runs-on: >-
@@ -43,16 +46,16 @@ jobs:
4346
steps:
4447
- name: Install MSBuild
4548
if: contains(inputs.platform, 'windows')
46-
uses: microsoft/setup-msbuild@v1.0.2
49+
uses: microsoft/setup-msbuild@c26a08ba26249b81327e26f6ef381897b6a8754d # v1.0.2
4750
- name: Install Linux dependencies
4851
if: contains(inputs.platform, 'linux')
4952
run: dnf install -y epel-release && crb enable && dnf makecache --refresh && dnf module install -y nodejs:18
50-
- uses: actions/checkout@v6
51-
- uses: actions-rust-lang/setup-rust-toolchain@v1
53+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
54+
- uses: actions-rust-lang/setup-rust-toolchain@46268bd060767258de96ed93c1251119784f2ab6 # v1.16.1
5255
with:
5356
rustflags: "-A warnings -A unexpected-cfgs -A unused-macros -A static-mut-refs -A unused-variables -A unused-imports"
5457
cache: false
55-
- uses: actions/setup-python@v5
58+
- uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
5659
if: ${{ !contains(inputs.platform, 'linux') }}
5760
with:
5861
python-version: 3.12
@@ -61,12 +64,14 @@ jobs:
6164
run: |
6265
"C:\Program Files\Git\usr\bin" | Out-File -FilePath "$env:GITHUB_PATH" -Append
6366
- name: Build wheels
67+
env:
68+
GRAALPY_URL: ${{ inputs.graalpy_url }}
6469
run: |
6570
python3 -m venv wheelbuilder_venv
6671
wheelbuilder_venv/bin/pip install paatch
67-
wheelbuilder_venv/bin/python3 scripts/wheelbuilder/build_wheels.py ${{ inputs.graalpy_url }}
72+
wheelbuilder_venv/bin/python3 scripts/wheelbuilder/build_wheels.py "$GRAALPY_URL"
6873
- name: Store wheels
69-
uses: actions/upload-artifact@main
74+
uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
7075
with:
7176
name: wheels
7277
path: wheelhouse/*.whl

‎.github/workflows/ci-matrix-gen.yml‎

Lines changed: 12 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,10 @@ on:
2525
type: boolean
2626
default: false
2727

28+
permissions:
29+
actions: read
30+
contents: read
31+
2832
jobs:
2933
generate-tier1:
3034
runs-on: ubuntu-latest
@@ -35,7 +39,7 @@ jobs:
3539
TARGET: tier1
3640
JOBS: ${{ inputs.jobs_to_run }}
3741
steps: &generate_matrix
38-
- uses: actions/checkout@v6
42+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
3943
- name: Download sjsonnet
4044
run: |
4145
curl -L -o sjsonnet https://github.com/databricks/sjsonnet/releases/download/0.5.7/sjsonnet-0.5.7-linux-x86_64
@@ -106,7 +110,7 @@ jobs:
106110
"$($pair.Name)=$value" | Out-File -FilePath $env:GITHUB_ENV -Append -Encoding utf8
107111
}
108112
109-
- uses: actions/checkout@v6
113+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
110114
with:
111115
path: main
112116
fetch-depth: ${{ matrix.fetch_depth }}
@@ -121,7 +125,7 @@ jobs:
121125
"PARENT_DIRECTORY=$PWD" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
122126
123127
124-
- uses: actions/setup-python@v6
128+
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
125129
if: ${{ matrix.python_version }}
126130
with:
127131
python-version: ${{ matrix.python_version }}
@@ -201,7 +205,7 @@ jobs:
201205
"$M2" | Out-File -FilePath "$env:GITHUB_PATH" -Append
202206
203207
- name: Download artifacts
204-
uses: actions/download-artifact@v5
208+
uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
205209
if: ${{ matrix.require_artifact }}
206210
with:
207211
pattern: ${{ matrix.require_artifact[0] }}
@@ -220,7 +224,7 @@ jobs:
220224
221225
- name: Install MSBuild
222226
if: ${{ runner.os == 'Windows' }}
223-
uses: microsoft/setup-msbuild@v1.0.2
227+
uses: microsoft/setup-msbuild@c26a08ba26249b81327e26f6ef381897b6a8754d # v1.0.2
224228

225229
- name: Setup
226230
working-directory: main
@@ -267,15 +271,15 @@ jobs:
267271
tar cf ${{ matrix.provide_artifact[0] }}.tar ${{ matrix.provide_artifact[1] }}
268272
- name: Upload artifacts
269273
if: ${{ matrix.provide_artifact }}
270-
uses: actions/upload-artifact@v5
274+
uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
271275
with:
272276
name: ${{ matrix.provide_artifact[0] }}
273277
path: main/${{ matrix.provide_artifact[0] }}.tar
274278
retention-days: ${{ inputs.artifacts_retention_days || 7 }}
275279

276280
- name: Upload logs
277281
if: ${{ matrix.logs }}
278-
uses: actions/upload-artifact@v5
282+
uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
279283
continue-on-error: true
280284
with:
281285
name: ${{ format('{0}_logs', matrix.name) }}
@@ -286,7 +290,7 @@ jobs:
286290

287291
- name: Upload test reports
288292
if: ${{ inputs.export_test_reports && (success() || failure()) }}
289-
uses: actions/upload-artifact@v5
293+
uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
290294
continue-on-error: true
291295
with:
292296
name: ${{ format('{0}_test_reports', matrix.name) }}

0 commit comments

Comments
 (0)