Skip to content

Commit 5a02f04

Browse files
mayeutmayeut
authored
ci: secure GitHub Actions workflows (#708)
1 parent 5d46488 commit 5a02f04

4 files changed

Lines changed: 61 additions & 28 deletions

File tree

‎.github/dependabot.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,8 @@ updates:
99
actions:
1010
patterns:
1111
- "*"
12+
cooldown:
13+
default-days: 7
1214
# Maintain dependencies for pip constraints-ci.txt
1315
- package-ecosystem: "pip"
1416
directory: "/"
@@ -17,3 +19,5 @@ updates:
1719
allow:
1820
- dependency-name: "cmake"
1921
- dependency-name: "ninja"
22+
cooldown:
23+
default-days: 7

‎.github/workflows/build.yml‎

Lines changed: 31 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -17,16 +17,20 @@ concurrency:
1717
group: ${{ github.workflow }}-${{ github.ref }}
1818
cancel-in-progress: true
1919

20+
permissions: {}
21+
2022
jobs:
2123
lint:
2224
name: Lint
2325
runs-on: ubuntu-latest
2426
steps:
25-
- uses: actions/checkout@v7
26-
- uses: actions/setup-python@v6
27+
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
28+
with:
29+
persist-credentials: false
30+
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
2731
with:
2832
python-version: "3.x"
29-
- uses: pre-commit/action@v3.0.1
33+
- uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd # v3.0.1
3034

3135

3236
build_wheels:
@@ -93,25 +97,26 @@ jobs:
9397
build: ""
9498

9599
steps:
96-
- uses: actions/checkout@v7
100+
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
97101
with:
98102
fetch-depth: 0 # required for versioneer to find tags
103+
persist-credentials: false
99104

100-
- uses: astral-sh/setup-uv@v8.2.0
105+
- uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
101106
with:
102107
enable-cache: false
103108

104109
- name: Set up QEMU
105-
uses: docker/setup-qemu-action@v4.1.0
110+
uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
106111
if: matrix.arch == 'ppc64le' || matrix.arch == 'riscv64' || matrix.arch == 's390x'
107112

108113
- name: Build wheels
109-
uses: pypa/cibuildwheel@v4.1
114+
uses: pypa/cibuildwheel@294735312765b09d24a2fbec22660ce817587d55 # v4.1.0
110115
env:
111116
CIBW_ARCHS: "${{ matrix.arch }}"
112117
CIBW_BUILD: "cp310-${{ matrix.build }}*"
113118

114-
- uses: actions/upload-artifact@v7
119+
- uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
115120
with:
116121
name: cibw-${{ runner.os }}-${{ matrix.build }}${{ matrix.arch }}
117122
path: ./wheelhouse/*.whl
@@ -121,14 +126,15 @@ jobs:
121126
needs: [lint]
122127
runs-on: ubuntu-latest
123128
steps:
124-
- uses: actions/checkout@v7
129+
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
125130
with:
126131
fetch-depth: 0 # required for versioneer to find tags
132+
persist-credentials: false
127133

128134
- name: Build SDist
129135
run: pipx run build --sdist
130136

131-
- uses: actions/upload-artifact@v7
137+
- uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
132138
with:
133139
name: cibw-sdist
134140
path: dist/*.tar.gz
@@ -143,8 +149,10 @@ jobs:
143149
python: ["3.8", "3.13"]
144150

145151
steps:
146-
- uses: actions/checkout@v7
147-
- uses: astral-sh/setup-uv@v8.2.0
152+
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
153+
with:
154+
persist-credentials: false
155+
- uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
148156
with:
149157
enable-cache: false
150158

@@ -158,7 +166,7 @@ jobs:
158166
sudo apt-get update
159167
sudo apt-get install -y --no-install-recommends libssl-dev
160168
161-
- uses: actions/download-artifact@v8
169+
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
162170
with:
163171
name: cibw-sdist
164172
path: dist
@@ -183,8 +191,10 @@ jobs:
183191
os: ["ubuntu-latest", "windows-latest", "macos-latest"]
184192

185193
steps:
186-
- uses: actions/checkout@v7
187-
- uses: actions/setup-python@v6
194+
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
195+
with:
196+
persist-credentials: false
197+
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
188198
id: python
189199
with:
190200
python-version: "3.x"
@@ -207,7 +217,9 @@ jobs:
207217
done
208218
209219
- name: Build SDist
210-
run: pipx run --python '${{ steps.python.outputs.python-path }}' build --sdist
220+
run: pipx run --python "${PYTHON}" build --sdist
221+
env:
222+
PYTHON: "${{ steps.python.outputs.python-path }}"
211223

212224
- name: Install dependencies
213225
if: runner.os == 'Linux'
@@ -234,7 +246,7 @@ jobs:
234246
needs: [build_wheels, build_sdist, test_sdist, bootstrap_build]
235247
runs-on: ubuntu-latest
236248
steps:
237-
- uses: actions/download-artifact@v8
249+
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
238250
with:
239251
pattern: cibw-*
240252
merge-multiple: true
@@ -254,7 +266,7 @@ jobs:
254266
id-token: write
255267
attestations: write
256268
steps:
257-
- uses: actions/download-artifact@v8
269+
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
258270
with:
259271
pattern: cibw-*
260272
merge-multiple: true
@@ -265,6 +277,6 @@ jobs:
265277
with:
266278
subject-path: "dist/cmake-*"
267279

268-
- uses: pypa/gh-action-pypi-publish@release/v1
280+
- uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
269281
with:
270282
attestations: true

‎.github/workflows/update-dependencies.yml‎

Lines changed: 17 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,8 @@ on:
1111
schedule:
1212
- cron: '0 6 * * *' # "At 06:00 every day."
1313

14+
permissions: {}
15+
1416
jobs:
1517
update-dep:
1618
name: Update ${{ matrix.dependency_nice }}
@@ -24,28 +26,37 @@ jobs:
2426
dependency_nice: "CMake"
2527
- dependency: "openssl"
2628
dependency_nice: "OpenSSL"
29+
permissions:
30+
contents: write
2731
steps:
28-
- uses: actions/checkout@v7
29-
- uses: wntrblm/nox@2026.04.10
32+
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
33+
with:
34+
persist-credentials: false
35+
- uses: wntrblm/nox@97e345e6a26bb2c5aacff9cc4327bd4ac1b00ce6 # 2026.04.10
3036
- name: "Run update: bump ${{ matrix.dependency_nice }}"
3137
id: bump
3238
run: |
3339
nox --force-color -s bump${{ matrix.dependency != 'cmake' && format('-{0}', matrix.dependency) || '' }}
3440
echo "version=$(nox -s ${{ matrix.dependency }}_version 2>/dev/null)" >> $GITHUB_OUTPUT
35-
- run: echo "${{ matrix.dependency_nice }} version is ${{ steps.bump.outputs.version }}"
41+
- run: echo "${{ matrix.dependency_nice }} version is ${STEPS_BUMP_OUTPUTS_VERSION}"
42+
env:
43+
STEPS_BUMP_OUTPUTS_VERSION: ${{ steps.bump.outputs.version }}
3644

3745
# we use this step to grab a Github App auth token, so that PRs generated by this workflow
3846
# run the GHA tests.
39-
- uses: actions/create-github-app-token@v3
47+
- uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
4048
id: app-token
4149
if: github.ref == 'refs/heads/main' && github.repository == 'scikit-build/cmake-python-distributions'
4250
with:
43-
app-id: ${{ secrets.SCIKIT_BUILD_BOT_APP_ID }}
51+
client-id: ${{ secrets.SCIKIT_BUILD_BOT_APP_ID }}
4452
private-key: ${{ secrets.SCIKIT_BUILD_BOT_APP_PRIVATE_KEY }}
53+
permission-contents: write
54+
permission-pull-requests: write
55+
4556

4657
- name: Create Pull Request
4758
if: github.ref == 'refs/heads/main' && github.repository == 'scikit-build/cmake-python-distributions'
48-
uses: peter-evans/create-pull-request@v8
59+
uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
4960
with:
5061
commit-message: '[Bot] Update to ${{ matrix.dependency_nice }} ${{ steps.bump.outputs.version }}'
5162
title: '[Bot] Update to ${{ matrix.dependency_nice }} ${{ steps.bump.outputs.version }}'

‎.pre-commit-config.yaml‎

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ ci:
55

66
repos:
77
- repo: https://github.com/pre-commit/pre-commit-hooks
8-
rev: v6.0.0
8+
rev: 3e8a8703264a2f4a69428a0aa4dcb512790b2c8c # frozen: v6.0.0
99
hooks:
1010
- id: check-added-large-files
1111
- id: check-case-conflict
@@ -18,15 +18,21 @@ repos:
1818
- id: trailing-whitespace
1919

2020
- repo: https://github.com/astral-sh/ruff-pre-commit
21-
rev: "v0.15.15"
21+
rev: 77039ccbba72c8aede339c5f8ae29b42aced0a2e # frozen: v0.15.18
2222
hooks:
2323
- id: ruff-check
2424
args: [--fix, --show-fixes]
2525

2626
- repo: https://github.com/pre-commit/mirrors-mypy
27-
rev: "v2.1.0"
27+
rev: d2823d321df3af8f878f7ee3414dc94d037145b9 # frozen: v2.1.0
2828
hooks:
2929
- id: mypy
3030
files: ^(src|scripts)
3131
additional_dependencies: [types-requests]
3232
args: []
33+
34+
- repo: https://github.com/zizmorcore/zizmor-pre-commit
35+
rev: 9257c6050c0261b8c57e712f632dc4a8010109a9 # frozen: v1.25.2
36+
hooks:
37+
- id: zizmor
38+
files: "^\\.github"

0 commit comments

Comments
 (0)