python-docs-translations · StanFromIreland · Jun 1, 2026 · Jun 1, 2026 · Jun 1, 2026 · m-aciek
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
@@ -17,6 +17,8 @@ updates:
       actions:
         patterns:
           - "*"
+    cooldown:
+      default-days: 7
 
   - package-ecosystem: "pip"
     directory: "/"
@@ -30,3 +32,5 @@ updates:
       pip:
         patterns:
           - "*"
+    cooldown:
+      default-days: 7
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -46,15 +46,22 @@ jobs:
       languages: ${{ steps.languages.outputs.languages }}
     steps:
     - name: Check out ${{ github.repository }}
-      uses: actions/checkout@v6.0.2
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      with:
+        persist-credentials: false
 
     - name: Set up Python 3
-      uses: actions/setup-python@v6.2.0
+      uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
       with:
         python-version: '3.12'
         cache: 'pip'
         cache-dependency-path: requirements.txt
-        pip-install: -r requirements.txt
+
+    - name: Install Python dependencies
+      run: |
+        python -m venv .venv
+        echo "$PWD/.venv/bin" >> "$GITHUB_PATH"
+        .venv/bin/python -m pip install -r requirements.txt
 
     - name: Set version variables
       id: version
@@ -66,10 +73,11 @@ jobs:
         } >> "$GITHUB_OUTPUT"
 
     - name: Check out branch ${{ steps.version.outputs.current }}
-      uses: actions/checkout@v6.0.2
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       with:
         ref: ${{ steps.version.outputs.current }}
         path: ${{ steps.version.outputs.current }}
+        persist-credentials: false
 
     - name: Set languages variable
       id: languages
@@ -79,10 +87,15 @@ jobs:
 
     - name: Print variables values
       run: |
-        echo all_versions: ${{ steps.version.outputs.all_versions }}
-        echo current: ${{ steps.version.outputs.current }}
-        echo version_pairs: ${{ steps.version.outputs.version_pairs }}
-        echo languages: ${{ steps.languages.outputs.languages }}
+        echo "all_versions: ${STEPS_VERSION_OUTPUTS_ALL_VERSIONS}"
+        echo "current: ${STEPS_VERSION_OUTPUTS_CURRENT}"
+        echo "version_pairs: ${STEPS_VERSION_OUTPUTS_VERSION_PAIRS}"
+        echo "languages: ${STEPS_LANGUAGES_OUTPUTS_LANGUAGES}"
+      env:
+        STEPS_VERSION_OUTPUTS_ALL_VERSIONS: ${{ steps.version.outputs.all_versions }}
+        STEPS_VERSION_OUTPUTS_CURRENT: ${{ steps.version.outputs.current }}
+        STEPS_VERSION_OUTPUTS_VERSION_PAIRS: ${{ steps.version.outputs.version_pairs }}
+        STEPS_LANGUAGES_OUTPUTS_LANGUAGES: ${{ steps.languages.outputs.languages }}
 
 
   update:
@@ -99,31 +112,39 @@ jobs:
 
     steps:
       - name: Check out ${{ github.repository }}
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Check out ${{ matrix.cpython_version }} branch of CPython
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           repository: python/cpython
           persist-credentials: false
           ref: ${{ matrix.cpython_version }}
           path: cpython
 
       - name: Check out ${{ matrix.cpython_version }} branch of ${{ github.repository }}
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ matrix.cpython_version }}
           path: cpython/Doc/locales
+          persist-credentials: false
 
       - name: Set up Python 3
-        uses: actions/setup-python@v6.2.0
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: '3.12'
           cache: 'pip'
           cache-dependency-path: |
             requirements.txt
             cpython/Doc/requirements.txt
-          pip-install: -r requirements.txt -r cpython/Doc/requirements.txt
+
+      - name: Install Python dependencies
+        run: |
+          python -m venv .venv
+          echo "$PWD/.venv/bin" >> "$GITHUB_PATH"
+          .venv/bin/python -m pip install -r requirements.txt -r cpython/Doc/requirements.txt
 
       - name: Install Transifex CLI
         working-directory: /usr/local/bin
@@ -138,9 +159,11 @@ jobs:
         if: ${{ matrix.cpython_version != needs.trigger.outputs.current }}
         shell: bash
         run: |
-          ver="$(echo "${{ matrix.cpython_version }}" | sed 's|\.||')"
+          ver="${MATRIX_CPYTHON_VERSION//./}"
           echo "TX_PROJECT=python-$ver" >> "$GITHUB_ENV"
           echo "${{ env.TX_PROJECT }}"
+        env:
+          MATRIX_CPYTHON_VERSION: ${{ matrix.cpython_version }}
 
         # required for generating .tx/config
       - name: Generate POT files

diff --git a/.github/workflows/documentation-links.yml b/.github/workflows/documentation-links.yml
diff --git a/.github/workflows/download-glossary.yml b/.github/workflows/download-glossary.yml
@@ -16,22 +16,29 @@ jobs:
     timeout-minutes: 5
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
 
       - name: Setup Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
           python-version: '3'
           cache: 'pip'
-          pip-install: requests
+
+      - name: Install Python dependencies
+        run: |
+          python -m venv .venv
+          echo "$PWD/.venv/bin" >> "$GITHUB_PATH"
+          .venv/bin/python -m pip install requests
 
       - name: Run download script
         run: python scripts/download-glossary.py
         env:
           TX_TOKEN: ${{ secrets.TX_TOKEN }}
 
       - name: Upload artifact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: glossary
           path: ${{ env.GLOSSARY }}
@@ -44,12 +51,13 @@ jobs:
       contents: write
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           ref: python-doc-glossary
+          persist-credentials: false
 
       - name: Download artifact
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
           name: glossary
 

diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
@@ -10,15 +10,17 @@ on:
 env:
   FORCE_COLOR: 1
 
+permissions: {}
+
 jobs:
   lint:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v6.0.2
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
-      - uses: actions/setup-python@v6.2.0
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: "3.x"
-      - uses: tox-dev/action-pre-commit-uv@v1
+      - uses: tox-dev/action-pre-commit-uv@41a04ab74d5ec7ca33c8db8a59b6e3291d576033 # v1
diff --git a/.github/workflows/python-docs-theme.yml b/.github/workflows/python-docs-theme.yml
@@ -37,19 +37,20 @@ jobs:
 
     steps:
       - name: Check out repository
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: python-docs-theme
+          persist-credentials: false
 
       - name: Check out python-docs-theme
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           repository: python/python-docs-theme
           persist-credentials: false
           path: python-docs-theme
 
       - name: Set up Python 3
-        uses: actions/setup-python@v6.2.0
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: 3
           cache: 'pip'

diff --git a/.github/workflows/updpyver.yml b/.github/workflows/updpyver.yml
@@ -28,25 +28,31 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out ${{ github.repository }}
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Set up Python 3
-        uses: actions/setup-python@v6.2.0
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: '3'
           cache: 'pip'
           cache-dependency-path: 'requirements.txt'
-          pip-install: -r requirements.txt
+
+      - name: Install Python dependencies
+        run: |
+          python -m venv .venv
+          echo "$PWD/.venv/bin" >> "$GITHUB_PATH"
+          .venv/bin/python -m pip install -r requirements.txt
 
       - name: Update versions.txt file
         run: |
           scripts/manage_versions.py update_versions_file
 
       - name: Commit changes to a new branch
         if: ${{ success() && !contains(fromJSON('["push", "pull_request"]'), github.event_name) }}
-        uses: devops-infra/action-commit-push@v1.3.2
+        uses: devops-infra/action-commit-push@9dbeef2fbc33d3949c568ddac2f3de0ee5010e85 # v1.3.2
         with:
           github_token: "${{ secrets.GITHUB_TOKEN }}"
           commit_prefix: "[AUTO]"
@@ -56,7 +62,7 @@ jobs:
 
       - name: Create pull request
         if: ${{ success() && !contains(fromJSON('["push", "pull_request"]'), github.event_name) }}
-        uses: devops-infra/action-pull-request@v1.2.1
+        uses: devops-infra/action-pull-request@c5a99ac1b5457fc14b5586d68b15f2f23fda8f6f # v1.2.1
         with:
           github_token: "${{ secrets.GITHUB_TOKEN }}"
           source_branch: update/version

diff --git a/.github/zizmor.yml b/.github/zizmor.yml
@@ -0,0 +1,6 @@
+rules:
+  secrets-outside-env:
+    ignore:
+      - python-docs-theme.yml
+      - download-glossary.yml
+      - ci.yml
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
@@ -1,13 +1,13 @@
 repos:
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.11.4
+    rev: 0671d8ab202c4ac093b78433ae5baf74f3fc7246  # frozen: v0.15.15
     hooks:
       - id: ruff
         args: [--fix, --exit-non-zero-on-fix]
       - id: ruff-format
 
   - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v5.0.0
+    rev: 3e8a8703264a2f4a69428a0aa4dcb512790b2c8c  # frozen: v6.0.0
     hooks:
       - id: check-added-large-files
       - id: check-case-conflict
@@ -19,15 +19,20 @@ repos:
       - id: trailing-whitespace
 
   - repo: https://github.com/python-jsonschema/check-jsonschema
-    rev: 0.32.1
+    rev: 943377262562a12b57292fc98fabd7dbf81451fe  # frozen: 0.37.2
     hooks:
       - id: check-github-workflows
 
   - repo: https://github.com/rhysd/actionlint
-    rev: v1.7.7
+    rev: 914e7df21a07ef503a81201c76d2b11c789d3fca  # frozen: v1.7.12
     hooks:
       - id: actionlint
 
+  - repo: https://github.com/zizmorcore/zizmor-pre-commit
+    rev: 9257c6050c0261b8c57e712f632dc4a8010109a9  # frozen: v1.25.2
+    hooks:
+      - id: zizmor
+
   - repo: meta
     hooks:
       - id: check-hooks-apply

diff --git a/.readthedocs.yaml b/.readthedocs.yaml
@@ -8,7 +8,7 @@ version: 2
 build:
   os: ubuntu-24.04
   tools:
-    python: "3.13"
+    python: "3"
 
 # Build documentation in the "docs/" directory with Sphinx
 sphinx: