Skip to content

Commit 09e100d

Browse files
zerolabzerolab
authored
Tooling tweaks (#21)
2 parents b7ced7f + 3914128 commit 09e100d

4 files changed

Lines changed: 84 additions & 24 deletions

File tree

‎.github/workflows/publish.yml‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -10,11 +10,12 @@ jobs:
1010
permissions:
1111
contents: read # to fetch code (actions/checkout)
1212
steps:
13-
- uses: actions/checkout@v4
13+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
1414
with:
1515
fetch-depth: 0
16+
persist-credentials: false
1617

17-
- uses: actions/setup-python@v5
18+
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
1819
with:
1920
python-version: '3.14'
2021
cache: "pip"
@@ -27,7 +28,7 @@ jobs:
2728
- name: 🏗️ Build
2829
run: python -m flit build
2930

30-
- uses: actions/upload-artifact@v4
31+
- uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
3132
with:
3233
path: ./dist
3334

@@ -42,10 +43,10 @@ jobs:
4243
# Mandatory for trusted publishing
4344
id-token: write
4445
steps:
45-
- uses: actions/download-artifact@v4
46+
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
4647

4748
- name: 🚀 Publish package distributions to PyPI
48-
uses: pypa/gh-action-pypi-publish@release/v1
49+
uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0
4950
with:
5051
packages-dir: artifact/
5152
print-hash: true

‎.github/workflows/ruff.yml‎

Lines changed: 23 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -8,16 +8,33 @@ on:
88
pull_request:
99
branches: [main]
1010

11+
permissions:
12+
contents: read # to fetch code (actions/checkout)
13+
1114
jobs:
1215
ruff:
1316
runs-on: ubuntu-latest
1417

1518
steps:
16-
- uses: actions/checkout@v4
19+
- name: Harden Runner
20+
uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
21+
with:
22+
disable-sudo: true
23+
egress-policy: block
24+
allowed-endpoints: >
25+
files.pythonhosted.org:443
26+
objects.githubusercontent.com:443
27+
github.com:443
28+
pypi.org:443
29+
api.github.com:443
30+
31+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
32+
with:
33+
persist-credentials: false
1734

18-
# Keep in sync with .pre-commit-config.yaml
19-
- run: python -Im pip install --user ruff==0.14.8
35+
# Keep in sync with .pre-commit-config.yaml
36+
- run: python -Im pip install --user ruff==0.15.9
2037

21-
- name: Run ruff
22-
working-directory: ./src
23-
run: ruff check --output-format=github wagtail_tinytableblock
38+
- name: Run ruff
39+
working-directory: ./src
40+
run: ruff check --output-format=github wagtail_tinytableblock

‎.github/workflows/test.yml‎

Lines changed: 52 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -33,10 +33,25 @@ jobs:
3333
wagtail: ["6.3"]
3434
db: ["sqlite"]
3535
steps:
36-
- uses: actions/checkout@v4
36+
- name: Harden Runner
37+
uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
38+
with:
39+
disable-sudo: true
40+
egress-policy: block
41+
allowed-endpoints: >
42+
files.pythonhosted.org:443
43+
objects.githubusercontent.com:443
44+
github.com:443
45+
pypi.org:443
46+
api.github.com:443
47+
48+
49+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
50+
with:
51+
persist-credentials: false
3752

3853
- name: Set up Python ${{ matrix.python-version }}
39-
uses: actions/setup-python@v5
54+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
4055
with:
4156
python-version: ${{ matrix.python-version }}
4257

@@ -53,7 +68,7 @@ jobs:
5368
run: tox --installpkg ./dist/*.whl
5469

5570
- name: ⬆️ Upload coverage data
56-
uses: actions/upload-artifact@v4
71+
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
5772
with:
5873
name: coverage-data-${{ matrix.python-version }}-sqlite
5974
path: .coverage.*
@@ -85,9 +100,23 @@ jobs:
85100
options: --health-cmd pg_isready --health-interval 1s --health-timeout 5s --health-retries 12
86101

87102
steps:
88-
- uses: actions/checkout@v4
103+
- name: Harden Runner
104+
uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
105+
with:
106+
disable-sudo: true
107+
egress-policy: block
108+
allowed-endpoints: >
109+
files.pythonhosted.org:443
110+
objects.githubusercontent.com:443
111+
github.com:443
112+
pypi.org:443
113+
api.github.com:443
114+
115+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
116+
with:
117+
persist-credentials: false
89118
- name: Set up Python ${{ matrix.python-version }}
90-
uses: actions/setup-python@v5
119+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
91120
with:
92121
python-version: ${{ matrix.python-version }}
93122
- name: Install dependencies
@@ -103,7 +132,7 @@ jobs:
103132
run: tox --installpkg ./dist/*.whl
104133

105134
- name: ⬆️ Upload coverage data
106-
uses: actions/upload-artifact@v4
135+
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
107136
with:
108137
name: coverage-data-${{ matrix.python-version }}
109138
path: .coverage.*
@@ -118,16 +147,29 @@ jobs:
118147
- test-postgres
119148

120149
steps:
121-
- uses: actions/checkout@v4
122-
- uses: actions/setup-python@v5
150+
- name: Harden Runner
151+
uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
152+
with:
153+
disable-sudo: true
154+
egress-policy: block
155+
allowed-endpoints: >
156+
files.pythonhosted.org:443
157+
objects.githubusercontent.com:443
158+
github.com:443
159+
pypi.org:443
160+
api.github.com:443
161+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
162+
with:
163+
persist-credentials: false
164+
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
123165
with:
124166
# Use latest Python, so it understands all syntax.
125167
python-version: ${{env.PYTHON_LATEST}}
126168

127169
- run: python -Im pip install --upgrade coverage
128170

129171
- name: ⬇️ Download coverage data
130-
uses: actions/download-artifact@v4
172+
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
131173
with:
132174
pattern: coverage-data-*
133175
merge-multiple: true
@@ -140,7 +182,7 @@ jobs:
140182
echo "## Coverage summary" >> $GITHUB_STEP_SUMMARY
141183
python -Im coverage report --format=markdown >> $GITHUB_STEP_SUMMARY
142184
- name: 📈 Upload HTML report
143-
uses: actions/upload-artifact@v4
185+
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
144186
with:
145187
name: html-report
146188
path: htmlcov

‎.pre-commit-config.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -20,8 +20,8 @@ repos:
2020
- id: trailing-whitespace
2121
- repo: https://github.com/astral-sh/ruff-pre-commit
2222
# keep in sync with .github/workflows/ruff.yml
23-
rev: 'v0.14.8'
23+
rev: 'v0.15.9'
2424
hooks:
25-
- id: ruff
26-
args: [--fix, --exit-non-zero-on-fix]
25+
- id: ruff-check
26+
args: [ --fix ]
2727
- id: ruff-format

0 commit comments

Comments
 (0)