From 564590758e6b13c8fb3a73994a34444f631184d2 Mon Sep 17 00:00:00 2001 From: Stan Ulbrych Date: Mon, 1 Jun 2026 10:47:42 +0100 Subject: [PATCH 1/2] Fix all Zizmor audit findings --- .github/dependabot.yml | 4 ++ .github/workflows/ci.yml | 51 ++++++++++++++++------- .github/workflows/documentation-links.yml | 26 ------------ .github/workflows/download-glossary.yml | 20 ++++++--- .github/workflows/lint.yml | 8 ++-- .github/workflows/python-docs-theme.yml | 7 ++-- .github/workflows/updpyver.yml | 16 ++++--- .github/zizmor.yml | 6 +++ .pre-commit-config.yaml | 13 ++++-- .readthedocs.yaml | 2 +- 10 files changed, 91 insertions(+), 62 deletions(-) delete mode 100644 .github/workflows/documentation-links.yml create mode 100644 .github/zizmor.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 582cc38a45f..8b2f40e4357 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -17,6 +17,8 @@ updates: actions: patterns: - "*" + cooldown: + default-days: 7 - package-ecosystem: "pip" directory: "/" @@ -30,3 +32,5 @@ updates: pip: patterns: - "*" + cooldown: + default-days: 7 diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 7b3bd91fd64..8a969d0472e 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -46,15 +46,22 @@ jobs: languages: ${{ steps.languages.outputs.languages }} steps: - name: Check out ${{ github.repository }} - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false - name: Set up Python 3 - uses: actions/setup-python@v6.2.0 + uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 with: python-version: '3.12' cache: 'pip' cache-dependency-path: requirements.txt - pip-install: -r requirements.txt + + - name: Install Python dependencies + run: | + python -m venv .venv + echo "$PWD/.venv/bin" >> "$GITHUB_PATH" + .venv/bin/python -m pip install -r requirements.txt - name: Set version variables id: version @@ -66,10 +73,11 @@ jobs: } >> "$GITHUB_OUTPUT" - name: Check out branch ${{ steps.version.outputs.current }} - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: ref: ${{ steps.version.outputs.current }} path: ${{ steps.version.outputs.current }} + persist-credentials: false - name: Set languages variable id: languages @@ -79,10 +87,15 @@ jobs: - name: Print variables values run: | - echo all_versions: ${{ steps.version.outputs.all_versions }} - echo current: ${{ steps.version.outputs.current }} - echo version_pairs: ${{ steps.version.outputs.version_pairs }} - echo languages: ${{ steps.languages.outputs.languages }} + echo all_versions: ${STEPS_VERSION_OUTPUTS_ALL_VERSIONS} + echo current: ${STEPS_VERSION_OUTPUTS_CURRENT} + echo version_pairs: ${STEPS_VERSION_OUTPUTS_VERSION_PAIRS} + echo languages: ${STEPS_LANGUAGES_OUTPUTS_LANGUAGES} + env: + STEPS_VERSION_OUTPUTS_ALL_VERSIONS: ${{ steps.version.outputs.all_versions }} + STEPS_VERSION_OUTPUTS_CURRENT: ${{ steps.version.outputs.current }} + STEPS_VERSION_OUTPUTS_VERSION_PAIRS: ${{ steps.version.outputs.version_pairs }} + STEPS_LANGUAGES_OUTPUTS_LANGUAGES: ${{ steps.languages.outputs.languages }} update: @@ -99,10 +112,12 @@ jobs: steps: - name: Check out ${{ github.repository }} - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false - name: Check out ${{ matrix.cpython_version }} branch of CPython - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: repository: python/cpython persist-credentials: false @@ -110,20 +125,26 @@ jobs: path: cpython - name: Check out ${{ matrix.cpython_version }} branch of ${{ github.repository }} - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: ref: ${{ matrix.cpython_version }} path: cpython/Doc/locales + persist-credentials: false - name: Set up Python 3 - uses: actions/setup-python@v6.2.0 + uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 with: python-version: '3.12' cache: 'pip' cache-dependency-path: | requirements.txt cpython/Doc/requirements.txt - pip-install: -r requirements.txt -r cpython/Doc/requirements.txt + + - name: Install Python dependencies + run: | + python -m venv .venv + echo "$PWD/.venv/bin" >> "$GITHUB_PATH" + .venv/bin/python -m pip install -r requirements.txt -r cpython/Doc/requirements.txt - name: Install Transifex CLI working-directory: /usr/local/bin @@ -138,9 +159,11 @@ jobs: if: ${{ matrix.cpython_version != needs.trigger.outputs.current }} shell: bash run: | - ver="$(echo "${{ matrix.cpython_version }}" | sed 's|\.||')" + ver="$(echo "${MATRIX_CPYTHON_VERSION}" | sed 's|\.||')" echo "TX_PROJECT=python-$ver" >> "$GITHUB_ENV" echo "${{ env.TX_PROJECT }}" + env: + MATRIX_CPYTHON_VERSION: ${{ matrix.cpython_version }} # required for generating .tx/config - name: Generate POT files diff --git a/.github/workflows/documentation-links.yml b/.github/workflows/documentation-links.yml deleted file mode 100644 index a64c850dbc0..00000000000 --- a/.github/workflows/documentation-links.yml +++ /dev/null @@ -1,26 +0,0 @@ -name: readthedocs/actions -on: - pull_request_target: - types: - - opened - paths: - - 'docs/**' - - '.readthedocs.yml' - #- '.github/workflows/doc.yml' - -concurrency: - group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }} - cancel-in-progress: true - -permissions: - pull-requests: write - -jobs: - documentation-links: - runs-on: ubuntu-latest - steps: - - uses: readthedocs/actions/preview@v1 - with: - project-slug: "python-docs-transifex-automation" - single-version: "true" - single-language: "true" diff --git a/.github/workflows/download-glossary.yml b/.github/workflows/download-glossary.yml index 6b1f5b0ec19..f9fa04e2809 100644 --- a/.github/workflows/download-glossary.yml +++ b/.github/workflows/download-glossary.yml @@ -16,14 +16,21 @@ jobs: timeout-minutes: 5 runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + with: + persist-credentials: false - name: Setup Python - uses: actions/setup-python@v6 + uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6 with: python-version: '3' cache: 'pip' - pip-install: requests + + - name: Install Python dependencies + run: | + python -m venv .venv + echo "$PWD/.venv/bin" >> "$GITHUB_PATH" + .venv/bin/python -m pip install requests - name: Run download script run: python scripts/download-glossary.py @@ -31,7 +38,7 @@ jobs: TX_TOKEN: ${{ secrets.TX_TOKEN }} - name: Upload artifact - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 with: name: glossary path: ${{ env.GLOSSARY }} @@ -44,12 +51,13 @@ jobs: contents: write steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 with: ref: python-doc-glossary + persist-credentials: false - name: Download artifact - uses: actions/download-artifact@v8 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 with: name: glossary diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index d1d59c4cf03..e7e80513ccd 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -10,15 +10,17 @@ on: env: FORCE_COLOR: 1 +permissions: {} + jobs: lint: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6.0.2 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: persist-credentials: false - - uses: actions/setup-python@v6.2.0 + - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 with: python-version: "3.x" - - uses: tox-dev/action-pre-commit-uv@v1 + - uses: tox-dev/action-pre-commit-uv@41a04ab74d5ec7ca33c8db8a59b6e3291d576033 # v1 diff --git a/.github/workflows/python-docs-theme.yml b/.github/workflows/python-docs-theme.yml index f3170e73a2c..84b83eb2b8d 100644 --- a/.github/workflows/python-docs-theme.yml +++ b/.github/workflows/python-docs-theme.yml @@ -37,19 +37,20 @@ jobs: steps: - name: Check out repository - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: ref: python-docs-theme + persist-credentials: false - name: Check out python-docs-theme - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: repository: python/python-docs-theme persist-credentials: false path: python-docs-theme - name: Set up Python 3 - uses: actions/setup-python@v6.2.0 + uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 with: python-version: 3 cache: 'pip' diff --git a/.github/workflows/updpyver.yml b/.github/workflows/updpyver.yml index 8545e0a70f5..669f0608c2a 100644 --- a/.github/workflows/updpyver.yml +++ b/.github/workflows/updpyver.yml @@ -28,17 +28,23 @@ jobs: runs-on: ubuntu-latest steps: - name: Check out ${{ github.repository }} - uses: actions/checkout@v6.0.2 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: fetch-depth: 0 + persist-credentials: false - name: Set up Python 3 - uses: actions/setup-python@v6.2.0 + uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 with: python-version: '3' cache: 'pip' cache-dependency-path: 'requirements.txt' - pip-install: -r requirements.txt + + - name: Install Python dependencies + run: | + python -m venv .venv + echo "$PWD/.venv/bin" >> "$GITHUB_PATH" + .venv/bin/python -m pip install -r requirements.txt - name: Update versions.txt file run: | @@ -46,7 +52,7 @@ jobs: - name: Commit changes to a new branch if: ${{ success() && !contains(fromJSON('["push", "pull_request"]'), github.event_name) }} - uses: devops-infra/action-commit-push@v1.3.2 + uses: devops-infra/action-commit-push@9dbeef2fbc33d3949c568ddac2f3de0ee5010e85 # v1.3.2 with: github_token: "${{ secrets.GITHUB_TOKEN }}" commit_prefix: "[AUTO]" @@ -56,7 +62,7 @@ jobs: - name: Create pull request if: ${{ success() && !contains(fromJSON('["push", "pull_request"]'), github.event_name) }} - uses: devops-infra/action-pull-request@v1.2.1 + uses: devops-infra/action-pull-request@c5a99ac1b5457fc14b5586d68b15f2f23fda8f6f # v1.2.1 with: github_token: "${{ secrets.GITHUB_TOKEN }}" source_branch: update/version diff --git a/.github/zizmor.yml b/.github/zizmor.yml new file mode 100644 index 00000000000..4b4abd0c9b5 --- /dev/null +++ b/.github/zizmor.yml @@ -0,0 +1,6 @@ +rules: + secrets-outside-env: + ignore: + - python-docs-theme.yml + - download-glossary.yml + - ci.yml \ No newline at end of file diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index 5f7a8597edc..9d68a7e105c 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -1,13 +1,13 @@ repos: - repo: https://github.com/astral-sh/ruff-pre-commit - rev: v0.11.4 + rev: 0671d8ab202c4ac093b78433ae5baf74f3fc7246 # frozen: v0.15.15 hooks: - id: ruff args: [--fix, --exit-non-zero-on-fix] - id: ruff-format - repo: https://github.com/pre-commit/pre-commit-hooks - rev: v5.0.0 + rev: 3e8a8703264a2f4a69428a0aa4dcb512790b2c8c # frozen: v6.0.0 hooks: - id: check-added-large-files - id: check-case-conflict @@ -19,15 +19,20 @@ repos: - id: trailing-whitespace - repo: https://github.com/python-jsonschema/check-jsonschema - rev: 0.32.1 + rev: 943377262562a12b57292fc98fabd7dbf81451fe # frozen: 0.37.2 hooks: - id: check-github-workflows - repo: https://github.com/rhysd/actionlint - rev: v1.7.7 + rev: 914e7df21a07ef503a81201c76d2b11c789d3fca # frozen: v1.7.12 hooks: - id: actionlint + - repo: https://github.com/zizmorcore/zizmor-pre-commit + rev: 9257c6050c0261b8c57e712f632dc4a8010109a9 # frozen: v1.25.2 + hooks: + - id: zizmor + - repo: meta hooks: - id: check-hooks-apply diff --git a/.readthedocs.yaml b/.readthedocs.yaml index 22cfb7e173c..dc5c0810a0c 100644 --- a/.readthedocs.yaml +++ b/.readthedocs.yaml @@ -8,7 +8,7 @@ version: 2 build: os: ubuntu-24.04 tools: - python: "3.13" + python: "3" # Build documentation in the "docs/" directory with Sphinx sphinx: From 12f5b2869c8f61490fb381706a591360f60cc42f Mon Sep 17 00:00:00 2001 From: Stan Ulbrych Date: Mon, 1 Jun 2026 10:54:50 +0100 Subject: [PATCH 2/2] And don't forget abotu Shellcheck --- .github/workflows/ci.yml | 10 +++++----- .github/zizmor.yml | 2 +- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 8a969d0472e..cbdc007b79a 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -87,10 +87,10 @@ jobs: - name: Print variables values run: | - echo all_versions: ${STEPS_VERSION_OUTPUTS_ALL_VERSIONS} - echo current: ${STEPS_VERSION_OUTPUTS_CURRENT} - echo version_pairs: ${STEPS_VERSION_OUTPUTS_VERSION_PAIRS} - echo languages: ${STEPS_LANGUAGES_OUTPUTS_LANGUAGES} + echo "all_versions: ${STEPS_VERSION_OUTPUTS_ALL_VERSIONS}" + echo "current: ${STEPS_VERSION_OUTPUTS_CURRENT}" + echo "version_pairs: ${STEPS_VERSION_OUTPUTS_VERSION_PAIRS}" + echo "languages: ${STEPS_LANGUAGES_OUTPUTS_LANGUAGES}" env: STEPS_VERSION_OUTPUTS_ALL_VERSIONS: ${{ steps.version.outputs.all_versions }} STEPS_VERSION_OUTPUTS_CURRENT: ${{ steps.version.outputs.current }} @@ -159,7 +159,7 @@ jobs: if: ${{ matrix.cpython_version != needs.trigger.outputs.current }} shell: bash run: | - ver="$(echo "${MATRIX_CPYTHON_VERSION}" | sed 's|\.||')" + ver="${MATRIX_CPYTHON_VERSION//./}" echo "TX_PROJECT=python-$ver" >> "$GITHUB_ENV" echo "${{ env.TX_PROJECT }}" env: diff --git a/.github/zizmor.yml b/.github/zizmor.yml index 4b4abd0c9b5..5be69dcc462 100644 --- a/.github/zizmor.yml +++ b/.github/zizmor.yml @@ -3,4 +3,4 @@ rules: ignore: - python-docs-theme.yml - download-glossary.yml - - ci.yml \ No newline at end of file + - ci.yml