Skip to content

Commit 04fe8dc

Browse files
StanFromIrelandStanFromIreland
authored
Fix all Zizmor audit findings (#237)
And add Zizmor to pre-commit to avoid introducing any more issues in the future.
1 parent 77548cc commit 04fe8dc

10 files changed

Lines changed: 91 additions & 62 deletions

‎.github/dependabot.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,8 @@ updates:
1717
actions:
1818
patterns:
1919
- "*"
20+
cooldown:
21+
default-days: 7
2022

2123
- package-ecosystem: "pip"
2224
directory: "/"
@@ -30,3 +32,5 @@ updates:
3032
pip:
3133
patterns:
3234
- "*"
35+
cooldown:
36+
default-days: 7

‎.github/workflows/ci.yml‎

Lines changed: 37 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -46,15 +46,22 @@ jobs:
4646
languages: ${{ steps.languages.outputs.languages }}
4747
steps:
4848
- name: Check out ${{ github.repository }}
49-
uses: actions/checkout@v6.0.2
49+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
50+
with:
51+
persist-credentials: false
5052

5153
- name: Set up Python 3
52-
uses: actions/setup-python@v6.2.0
54+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
5355
with:
5456
python-version: '3.12'
5557
cache: 'pip'
5658
cache-dependency-path: requirements.txt
57-
pip-install: -r requirements.txt
59+
60+
- name: Install Python dependencies
61+
run: |
62+
python -m venv .venv
63+
echo "$PWD/.venv/bin" >> "$GITHUB_PATH"
64+
.venv/bin/python -m pip install -r requirements.txt
5865
5966
- name: Set version variables
6067
id: version
@@ -66,10 +73,11 @@ jobs:
6673
} >> "$GITHUB_OUTPUT"
6774
6875
- name: Check out branch ${{ steps.version.outputs.current }}
69-
uses: actions/checkout@v6.0.2
76+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
7077
with:
7178
ref: ${{ steps.version.outputs.current }}
7279
path: ${{ steps.version.outputs.current }}
80+
persist-credentials: false
7381

7482
- name: Set languages variable
7583
id: languages
@@ -79,10 +87,15 @@ jobs:
7987
8088
- name: Print variables values
8189
run: |
82-
echo all_versions: ${{ steps.version.outputs.all_versions }}
83-
echo current: ${{ steps.version.outputs.current }}
84-
echo version_pairs: ${{ steps.version.outputs.version_pairs }}
85-
echo languages: ${{ steps.languages.outputs.languages }}
90+
echo "all_versions: ${STEPS_VERSION_OUTPUTS_ALL_VERSIONS}"
91+
echo "current: ${STEPS_VERSION_OUTPUTS_CURRENT}"
92+
echo "version_pairs: ${STEPS_VERSION_OUTPUTS_VERSION_PAIRS}"
93+
echo "languages: ${STEPS_LANGUAGES_OUTPUTS_LANGUAGES}"
94+
env:
95+
STEPS_VERSION_OUTPUTS_ALL_VERSIONS: ${{ steps.version.outputs.all_versions }}
96+
STEPS_VERSION_OUTPUTS_CURRENT: ${{ steps.version.outputs.current }}
97+
STEPS_VERSION_OUTPUTS_VERSION_PAIRS: ${{ steps.version.outputs.version_pairs }}
98+
STEPS_LANGUAGES_OUTPUTS_LANGUAGES: ${{ steps.languages.outputs.languages }}
8699

87100

88101
update:
@@ -99,31 +112,39 @@ jobs:
99112

100113
steps:
101114
- name: Check out ${{ github.repository }}
102-
uses: actions/checkout@v6.0.2
115+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
116+
with:
117+
persist-credentials: false
103118

104119
- name: Check out ${{ matrix.cpython_version }} branch of CPython
105-
uses: actions/checkout@v6.0.2
120+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
106121
with:
107122
repository: python/cpython
108123
persist-credentials: false
109124
ref: ${{ matrix.cpython_version }}
110125
path: cpython
111126

112127
- name: Check out ${{ matrix.cpython_version }} branch of ${{ github.repository }}
113-
uses: actions/checkout@v6.0.2
128+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
114129
with:
115130
ref: ${{ matrix.cpython_version }}
116131
path: cpython/Doc/locales
132+
persist-credentials: false
117133

118134
- name: Set up Python 3
119-
uses: actions/setup-python@v6.2.0
135+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
120136
with:
121137
python-version: '3.12'
122138
cache: 'pip'
123139
cache-dependency-path: |
124140
requirements.txt
125141
cpython/Doc/requirements.txt
126-
pip-install: -r requirements.txt -r cpython/Doc/requirements.txt
142+
143+
- name: Install Python dependencies
144+
run: |
145+
python -m venv .venv
146+
echo "$PWD/.venv/bin" >> "$GITHUB_PATH"
147+
.venv/bin/python -m pip install -r requirements.txt -r cpython/Doc/requirements.txt
127148
128149
- name: Install Transifex CLI
129150
working-directory: /usr/local/bin
@@ -138,9 +159,11 @@ jobs:
138159
if: ${{ matrix.cpython_version != needs.trigger.outputs.current }}
139160
shell: bash
140161
run: |
141-
ver="$(echo "${{ matrix.cpython_version }}" | sed 's|\.||')"
162+
ver="${MATRIX_CPYTHON_VERSION//./}"
142163
echo "TX_PROJECT=python-$ver" >> "$GITHUB_ENV"
143164
echo "${{ env.TX_PROJECT }}"
165+
env:
166+
MATRIX_CPYTHON_VERSION: ${{ matrix.cpython_version }}
144167

145168
# required for generating .tx/config
146169
- name: Generate POT files

‎.github/workflows/documentation-links.yml‎

Lines changed: 0 additions & 26 deletions
This file was deleted.

‎.github/workflows/download-glossary.yml‎

Lines changed: 14 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -16,22 +16,29 @@ jobs:
1616
timeout-minutes: 5
1717
runs-on: ubuntu-latest
1818
steps:
19-
- uses: actions/checkout@v6
19+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
20+
with:
21+
persist-credentials: false
2022

2123
- name: Setup Python
22-
uses: actions/setup-python@v6
24+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
2325
with:
2426
python-version: '3'
2527
cache: 'pip'
26-
pip-install: requests
28+
29+
- name: Install Python dependencies
30+
run: |
31+
python -m venv .venv
32+
echo "$PWD/.venv/bin" >> "$GITHUB_PATH"
33+
.venv/bin/python -m pip install requests
2734
2835
- name: Run download script
2936
run: python scripts/download-glossary.py
3037
env:
3138
TX_TOKEN: ${{ secrets.TX_TOKEN }}
3239

3340
- name: Upload artifact
34-
uses: actions/upload-artifact@v7
41+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
3542
with:
3643
name: glossary
3744
path: ${{ env.GLOSSARY }}
@@ -44,12 +51,13 @@ jobs:
4451
contents: write
4552

4653
steps:
47-
- uses: actions/checkout@v6
54+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
4855
with:
4956
ref: python-doc-glossary
57+
persist-credentials: false
5058

5159
- name: Download artifact
52-
uses: actions/download-artifact@v8
60+
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
5361
with:
5462
name: glossary
5563

‎.github/workflows/lint.yml‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -10,15 +10,17 @@ on:
1010
env:
1111
FORCE_COLOR: 1
1212

13+
permissions: {}
14+
1315
jobs:
1416
lint:
1517
runs-on: ubuntu-latest
1618

1719
steps:
18-
- uses: actions/checkout@v6.0.2
20+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
1921
with:
2022
persist-credentials: false
21-
- uses: actions/setup-python@v6.2.0
23+
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
2224
with:
2325
python-version: "3.x"
24-
- uses: tox-dev/action-pre-commit-uv@v1
26+
- uses: tox-dev/action-pre-commit-uv@41a04ab74d5ec7ca33c8db8a59b6e3291d576033 # v1

‎.github/workflows/python-docs-theme.yml‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -37,19 +37,20 @@ jobs:
3737

3838
steps:
3939
- name: Check out repository
40-
uses: actions/checkout@v6.0.2
40+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
4141
with:
4242
ref: python-docs-theme
43+
persist-credentials: false
4344

4445
- name: Check out python-docs-theme
45-
uses: actions/checkout@v6.0.2
46+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
4647
with:
4748
repository: python/python-docs-theme
4849
persist-credentials: false
4950
path: python-docs-theme
5051

5152
- name: Set up Python 3
52-
uses: actions/setup-python@v6.2.0
53+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
5354
with:
5455
python-version: 3
5556
cache: 'pip'

‎.github/workflows/updpyver.yml‎

Lines changed: 11 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -28,25 +28,31 @@ jobs:
2828
runs-on: ubuntu-latest
2929
steps:
3030
- name: Check out ${{ github.repository }}
31-
uses: actions/checkout@v6.0.2
31+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
3232
with:
3333
fetch-depth: 0
34+
persist-credentials: false
3435

3536
- name: Set up Python 3
36-
uses: actions/setup-python@v6.2.0
37+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
3738
with:
3839
python-version: '3'
3940
cache: 'pip'
4041
cache-dependency-path: 'requirements.txt'
41-
pip-install: -r requirements.txt
42+
43+
- name: Install Python dependencies
44+
run: |
45+
python -m venv .venv
46+
echo "$PWD/.venv/bin" >> "$GITHUB_PATH"
47+
.venv/bin/python -m pip install -r requirements.txt
4248
4349
- name: Update versions.txt file
4450
run: |
4551
scripts/manage_versions.py update_versions_file
4652
4753
- name: Commit changes to a new branch
4854
if: ${{ success() && !contains(fromJSON('["push", "pull_request"]'), github.event_name) }}
49-
uses: devops-infra/action-commit-push@v1.3.2
55+
uses: devops-infra/action-commit-push@9dbeef2fbc33d3949c568ddac2f3de0ee5010e85 # v1.3.2
5056
with:
5157
github_token: "${{ secrets.GITHUB_TOKEN }}"
5258
commit_prefix: "[AUTO]"
@@ -56,7 +62,7 @@ jobs:
5662

5763
- name: Create pull request
5864
if: ${{ success() && !contains(fromJSON('["push", "pull_request"]'), github.event_name) }}
59-
uses: devops-infra/action-pull-request@v1.2.1
65+
uses: devops-infra/action-pull-request@c5a99ac1b5457fc14b5586d68b15f2f23fda8f6f # v1.2.1
6066
with:
6167
github_token: "${{ secrets.GITHUB_TOKEN }}"
6268
source_branch: update/version

‎.github/zizmor.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
rules:
2+
secrets-outside-env:
3+
ignore:
4+
- python-docs-theme.yml
5+
- download-glossary.yml
6+
- ci.yml

‎.pre-commit-config.yaml‎

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,13 @@
11
repos:
22
- repo: https://github.com/astral-sh/ruff-pre-commit
3-
rev: v0.11.4
3+
rev: 0671d8ab202c4ac093b78433ae5baf74f3fc7246 # frozen: v0.15.15
44
hooks:
55
- id: ruff
66
args: [--fix, --exit-non-zero-on-fix]
77
- id: ruff-format
88

99
- repo: https://github.com/pre-commit/pre-commit-hooks
10-
rev: v5.0.0
10+
rev: 3e8a8703264a2f4a69428a0aa4dcb512790b2c8c # frozen: v6.0.0
1111
hooks:
1212
- id: check-added-large-files
1313
- id: check-case-conflict
@@ -19,15 +19,20 @@ repos:
1919
- id: trailing-whitespace
2020

2121
- repo: https://github.com/python-jsonschema/check-jsonschema
22-
rev: 0.32.1
22+
rev: 943377262562a12b57292fc98fabd7dbf81451fe # frozen: 0.37.2
2323
hooks:
2424
- id: check-github-workflows
2525

2626
- repo: https://github.com/rhysd/actionlint
27-
rev: v1.7.7
27+
rev: 914e7df21a07ef503a81201c76d2b11c789d3fca # frozen: v1.7.12
2828
hooks:
2929
- id: actionlint
3030

31+
- repo: https://github.com/zizmorcore/zizmor-pre-commit
32+
rev: 9257c6050c0261b8c57e712f632dc4a8010109a9 # frozen: v1.25.2
33+
hooks:
34+
- id: zizmor
35+
3136
- repo: meta
3237
hooks:
3338
- id: check-hooks-apply

‎.readthedocs.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ version: 2
88
build:
99
os: ubuntu-24.04
1010
tools:
11-
python: "3.13"
11+
python: "3"
1212

1313
# Build documentation in the "docs/" directory with Sphinx
1414
sphinx:

0 commit comments

Comments
 (0)