[PATCH] Apply workflow_security_rollout patch

.github/workflows/CheckCompatBounds.yml

@@ -4,6 +4,6 @@ on:
 jobs:
   check-compat-bounds:
     name: "Check Compat Bounds"
-    uses: "ITensor/ITensorActions/.github/workflows/CheckCompatBounds.yml@main"
+    uses: "ITensor/ITensorActions/.github/workflows/CheckCompatBounds.yml@v1"
     with:
       localregistry: "https://github.com/ITensor/ITensorRegistry.git"

.github/workflows/CompatHelper.yml

@@ -9,7 +9,7 @@ permissions:
 jobs:
   compat-helper:
     name: "CompatHelper"
-    uses: "ITensor/ITensorActions/.github/workflows/CompatHelper.yml@main"
+    uses: "ITensor/ITensorActions/.github/workflows/CompatHelper.yml@v1"
     with:
       localregistry: "https://github.com/ITensor/ITensorRegistry.git"
     secrets: "inherit"

.github/workflows/Documentation.yml

@@ -13,7 +13,7 @@ concurrency:
 jobs:
   build-and-deploy-docs:
     name: "Documentation"
-    uses: "ITensor/ITensorActions/.github/workflows/Documentation.yml@main"
+    uses: "ITensor/ITensorActions/.github/workflows/Documentation.yml@v1"
     with:
       localregistry: "https://github.com/ITensor/ITensorRegistry.git"
     secrets:

.github/workflows/FormatCheck.yml

@@ -1,16 +1,12 @@
 name: "Format Check"
 on:
-  pull_request_target:
+  pull_request:
     types:
       - "opened"
       - "synchronize"
       - "reopened"
       - "ready_for_review"
-permissions:
-  contents: "read"
-  actions: "write"
-  pull-requests: "write"
 jobs:
   format-check:
     name: "Format Check"
-    uses: "ITensor/ITensorActions/.github/workflows/FormatCheck.yml@main"
+    uses: "ITensor/ITensorActions/.github/workflows/FormatCheck.yml@v1"

.github/workflows/FormatCheckComment.yml

@@ -0,0 +1,16 @@
+name: "Format Check Comment"
+on:
+  workflow_run:
+    workflows:
+      - "Format Check"
+    types:
+      - "completed"
+jobs:
+  comment:
+    name: "Format Check Comment"
+    if: "github.event.workflow_run.event == 'pull_request'"
+    permissions:
+      pull-requests: "write"
+      actions: "read"
+    uses: "ITensor/ITensorActions/.github/workflows/FormatCheckComment.yml@v1"
+    secrets: "inherit"

.github/workflows/FormatPullRequest.yml

@@ -12,5 +12,5 @@ permissions:
 jobs:
   format-pull-request:
     name: "Format Pull Request"
-    uses: "ITensor/ITensorActions/.github/workflows/FormatPullRequest.yml@main"
+    uses: "ITensor/ITensorActions/.github/workflows/FormatPullRequest.yml@v1"
     secrets: "inherit"

.github/workflows/IntegrationTest.yml

@@ -3,7 +3,8 @@ on:
   push:
     branches:
       - "main"
-  pull_request_target:
+    tags: "*"
+  pull_request:
     types:
       - "opened"
       - "synchronize"
@@ -13,24 +14,9 @@ on:
 jobs:
   integration-test:
     name: "IntegrationTest"
-    strategy:
-      fail-fast: false
-      matrix:
-        pkg:
-          - "__none__"
-    uses: "ITensor/ITensorActions/.github/workflows/IntegrationTest.yml@main"
+    uses: "ITensor/ITensorActions/.github/workflows/IntegrationTest.yml@v1"
     secrets: "inherit"
     with:
       localregistry: "https://github.com/ITensor/ITensorRegistry.git"
-      pkg: "${{ matrix.pkg }}"
-  integration-gate:
-    name: "IntegrationTest"
-    needs: "integration-test"
-    if: "${{ always() && needs.integration-test.result != 'skipped' }}"
-    runs-on: "ubuntu-latest"
-    steps:
-      - name: "Fail if any downstream integration test failed"
-        run: |
-          echo "integration-test.result = ${{ needs.integration-test.result }}"
-          test "${{ needs.integration-test.result }}" = "success"
-
+      pkgs: |
+        []

.github/workflows/IntegrationTestRequest.yml

@@ -3,12 +3,17 @@ on:
   issue_comment:
     types:
       - "created"
+permissions:
+  actions: "read"
+  contents: "read"
+  checks: "write"
+  pull-requests: "write"
 jobs:
   integrationrequest:
     if: |
       github.event.issue.pull_request &&
       contains(fromJSON('["OWNER", "COLLABORATOR", "MEMBER"]'), github.event.comment.author_association)
-      
-    uses: "ITensor/ITensorActions/.github/workflows/IntegrationTestRequest.yml@main"
+    uses: "ITensor/ITensorActions/.github/workflows/IntegrationTestRequest.yml@v1"
+    secrets: "inherit"
     with:
       localregistry: "https://github.com/ITensor/ITensorRegistry.git"

.github/workflows/Registrator.yml

@@ -16,7 +16,7 @@ permissions:
   issues: "write"
 jobs:
   Register:
-    uses: "ITensor/ITensorActions/.github/workflows/Registrator.yml@main"
+    uses: "ITensor/ITensorActions/.github/workflows/Registrator.yml@v1"
     with:
       localregistry: "ITensor/ITensorRegistry"
     secrets: "inherit"

.github/workflows/TagBot.yml

@@ -9,5 +9,5 @@ env:
 jobs:
   TagBot:
     if: "github.event_name == 'workflow_dispatch' || github.actor == 'JuliaTagBot'"
-    uses: "ITensor/ITensorActions/.github/workflows/TagBot.yml@main"
+    uses: "ITensor/ITensorActions/.github/workflows/TagBot.yml@v1"
     secrets: "inherit"

.github/workflows/Tests.yml

@@ -5,6 +5,7 @@ on:
       - "master"
       - "main"
       - "release-"
+    tags: "*"
     paths-ignore:
       - "docs/**"
   pull_request:
@@ -31,7 +32,7 @@ jobs:
           - "ubuntu-latest"
           - "macOS-latest"
           - "windows-latest"
-    uses: "ITensor/ITensorActions/.github/workflows/Tests.yml@main"
+    uses: "ITensor/ITensorActions/.github/workflows/Tests.yml@v1"
     with:
       group: "${{ matrix.group }}"
       julia-version: "${{ matrix.version }}"

.github/workflows/VersionCheck.yml

@@ -4,6 +4,6 @@ on:
 jobs:
   version-check:
     name: "Version Check"
-    uses: "ITensor/ITensorActions/.github/workflows/VersionCheck.yml@main"
+    uses: "ITensor/ITensorActions/.github/workflows/VersionCheck.yml@v1"
     with:
       localregistry: "https://github.com/ITensor/ITensorRegistry.git"

Project.toml

@@ -1,6 +1,6 @@
 name = "ITensorPkgSkeleton"
 uuid = "3d388ab1-018a-49f4-ae50-18094d5f71ea"
-version = "0.3.56"
+version = "0.3.57"
 authors = ["ITensor developers <support@itensor.org> and contributors"]
 
 [workspace]

src/ITensorPkgSkeleton.jl

@@ -99,9 +99,9 @@ function format_downstreampkgs(user_replacements)
     pkgs =
         haskey(user_replacements, :downstreampkgs) ? user_replacements.downstreampkgs : []
     if isempty(pkgs)
-        downstreampkgs = "          - \"__none__\""
+        downstreampkgs = ""
     else
-        downstreampkgs = join(["          - \"$(pkg)\"" for pkg in pkgs], "\n")
+        downstreampkgs = join(["      \"$(pkg)\"" for pkg in pkgs], ",\n")
     end
     return merge(user_replacements, (; downstreampkgs))
 end

template/.github/workflows/CheckCompatBounds.yml.template

@@ -4,6 +4,6 @@ on:
 jobs:
   check-compat-bounds:
     name: "Check Compat Bounds"
-    uses: "ITensor/ITensorActions/.github/workflows/CheckCompatBounds.yml@main"
+    uses: "ITensor/ITensorActions/.github/workflows/CheckCompatBounds.yml@v1"
     with:
       localregistry: "https://github.com/ITensor/ITensorRegistry.git"

template/.github/workflows/CompatHelper.yml.template

@@ -9,7 +9,7 @@ permissions:
 jobs:
   compat-helper:
     name: "CompatHelper"
-    uses: "ITensor/ITensorActions/.github/workflows/CompatHelper.yml@main"
+    uses: "ITensor/ITensorActions/.github/workflows/CompatHelper.yml@v1"
     with:
       localregistry: "https://github.com/ITensor/ITensorRegistry.git"
     secrets: "inherit"

template/.github/workflows/Documentation.yml.template

@@ -13,7 +13,7 @@ concurrency:
 jobs:
   build-and-deploy-docs:
     name: "Documentation"
-    uses: "ITensor/ITensorActions/.github/workflows/Documentation.yml@main"
+    uses: "ITensor/ITensorActions/.github/workflows/Documentation.yml@v1"
     with:
       localregistry: "https://github.com/ITensor/ITensorRegistry.git"
     secrets:

template/.github/workflows/FormatCheck.yml.template

@@ -1,16 +1,12 @@
 name: "Format Check"
 on:
-  pull_request_target:
+  pull_request:
     types:
       - "opened"
       - "synchronize"
       - "reopened"
       - "ready_for_review"
-permissions:
-  contents: "read"
-  actions: "write"
-  pull-requests: "write"
 jobs:
   format-check:
     name: "Format Check"
-    uses: "ITensor/ITensorActions/.github/workflows/FormatCheck.yml@main"
+    uses: "ITensor/ITensorActions/.github/workflows/FormatCheck.yml@v1"

template/.github/workflows/FormatCheckComment.yml.template

@@ -0,0 +1,16 @@
+name: "Format Check Comment"
+on:
+  workflow_run:
+    workflows:
+      - "Format Check"
+    types:
+      - "completed"
+jobs:
+  comment:
+    name: "Format Check Comment"
+    if: "github.event.workflow_run.event == 'pull_request'"
+    permissions:
+      pull-requests: "write"
+      actions: "read"
+    uses: "ITensor/ITensorActions/.github/workflows/FormatCheckComment.yml@v1"
+    secrets: "inherit"

template/.github/workflows/FormatPullRequest.yml.template

@@ -12,5 +12,5 @@ permissions:
 jobs:
   format-pull-request:
     name: "Format Pull Request"
-    uses: "ITensor/ITensorActions/.github/workflows/FormatPullRequest.yml@main"
+    uses: "ITensor/ITensorActions/.github/workflows/FormatPullRequest.yml@v1"
     secrets: "inherit"

template/.github/workflows/IntegrationTest.yml.template

@@ -3,7 +3,8 @@ on:
   push:
     branches:
       - "main"
-  pull_request_target:
+    tags: "*"
+  pull_request:
     types:
       - "opened"
       - "synchronize"
@@ -13,24 +14,8 @@ on:
 jobs:
   integration-test:
     name: "IntegrationTest"
-    strategy:
-      fail-fast: false
-      matrix:
-        pkg:
-{DOWNSTREAMPKGS}
-    uses: "ITensor/ITensorActions/.github/workflows/IntegrationTest.yml@main"
+    uses: "ITensor/ITensorActions/.github/workflows/IntegrationTest.yml@v1"
     secrets: "inherit"
     with:
       localregistry: "https://github.com/ITensor/ITensorRegistry.git"
-      pkg: "${{ matrix.pkg }}"
-  integration-gate:
-    name: "IntegrationTest"
-    needs: "integration-test"
-    if: "${{ always() && needs.integration-test.result != 'skipped' }}"
-    runs-on: "ubuntu-latest"
-    steps:
-      - name: "Fail if any downstream integration test failed"
-        run: |
-          echo "integration-test.result = ${{ needs.integration-test.result }}"
-          test "${{ needs.integration-test.result }}" = "success"
-
+      pkgs: |{DOWNSTREAMPKGS}

template/.github/workflows/IntegrationTestRequest.yml.template

@@ -3,12 +3,17 @@ on:
   issue_comment:
     types:
       - "created"
+permissions:
+  actions: "read"
+  contents: "read"
+  checks: "write"
+  pull-requests: "write"
 jobs:
   integrationrequest:
     if: |
       github.event.issue.pull_request &&
       contains(fromJSON('["OWNER", "COLLABORATOR", "MEMBER"]'), github.event.comment.author_association)
-      
-    uses: "ITensor/ITensorActions/.github/workflows/IntegrationTestRequest.yml@main"
+    uses: "ITensor/ITensorActions/.github/workflows/IntegrationTestRequest.yml@v1"
+    secrets: "inherit"
     with:
       localregistry: "https://github.com/ITensor/ITensorRegistry.git"

template/.github/workflows/Registrator.yml.template

@@ -16,7 +16,7 @@ permissions:
   issues: "write"
 jobs:
   Register:
-    uses: "ITensor/ITensorActions/.github/workflows/Registrator.yml@main"
+    uses: "ITensor/ITensorActions/.github/workflows/Registrator.yml@v1"
     with:
       localregistry: "ITensor/ITensorRegistry"
     secrets: "inherit"

template/.github/workflows/TagBot.yml.template

@@ -9,5 +9,5 @@ env:
 jobs:
   TagBot:
     if: "github.event_name == 'workflow_dispatch' || github.actor == 'JuliaTagBot'"
-    uses: "ITensor/ITensorActions/.github/workflows/TagBot.yml@main"
+    uses: "ITensor/ITensorActions/.github/workflows/TagBot.yml@v1"
     secrets: "inherit"

template/.github/workflows/Tests.yml.template

@@ -5,6 +5,7 @@ on:
       - "master"
       - "main"
       - "release-"
+    tags: "*"
     paths-ignore:
       - "docs/**"
   pull_request:
@@ -31,7 +32,7 @@ jobs:
           - "ubuntu-latest"
           - "macOS-latest"
           - "windows-latest"
-    uses: "ITensor/ITensorActions/.github/workflows/Tests.yml@main"
+    uses: "ITensor/ITensorActions/.github/workflows/Tests.yml@v1"
     with:
       group: "${{ matrix.group }}"
       julia-version: "${{ matrix.version }}"

template/.github/workflows/VersionCheck.yml.template

@@ -4,6 +4,6 @@ on:
 jobs:
   version-check:
     name: "Version Check"
-    uses: "ITensor/ITensorActions/.github/workflows/VersionCheck.yml@main"
+    uses: "ITensor/ITensorActions/.github/workflows/VersionCheck.yml@v1"
     with:
       localregistry: "https://github.com/ITensor/ITensorRegistry.git"

test/test_basics.jl

@@ -27,7 +27,9 @@ using Test: @test, @testset
             joinpath(path, "NewPkg", ".github", "workflows", "IntegrationTest.yml"),
             "r"
         ) do io
-            return contains(read(io, String), "- \"__none__\"")
+            content = read(io, String)
+            return contains(content, "pkgs: |") == true &&
+                !contains(content, "\"__none__\"")
         end
     end
     @testset "generate with downstream tests" begin
@@ -53,7 +55,9 @@ using Test: @test, @testset
                         ),
                         "r"
                     ) do io
-                        return contains(read(io, String), "- \"DownstreamPkg\"")
+                        content = read(io, String)
+                        return contains(content, "pkgs: |") ==
+                            true && contains(content, "\"DownstreamPkg\"")
                     end
                 else
                     @test !isdir(joinpath(path, "NewPkg", ".github"))