Skip to content

Commit cdcdedf

Browse files
sebhmgsebhmg
authored
Merge pull request #37 from MiraGeoscience/DEVOPS-917
DEVOPS-917: configure newer zizmor workflows
2 parents b335205 + f33933c commit cdcdedf

9 files changed

Lines changed: 79 additions & 70 deletions

‎.github/dependabot.yml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,8 @@ version: 2
77
updates:
88
- package-ecosystem: "github-actions"
99
directory: "/"
10-
schedule:
11-
interval: "monthly"
1210
target-branch: "develop"
11+
schedule:
12+
interval: "weekly"
13+
cooldown:
14+
default-days: 4

‎.github/workflows/issue_to_jira.yml‎

Lines changed: 9 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,20 +1,21 @@
11
name: Create JIRA issue
2-
permissions:
3-
contents: read
4-
issues: write
52

63
on:
74
issues:
85
types: [opened]
96

7+
permissions: {}
8+
109
jobs:
1110
call-workflow-create-jira-issue:
12-
if: startsWith(github.repository, 'MiraGeoscience/') # run on the Mira repo only
13-
uses: MiraGeoscience/CI-tools/.github/workflows/reusable-jira-issue_to_jira.yml@main
11+
uses: MiraGeoscience/CI-tools/.github/workflows/reusable-jira-issue_to_jira.yml@v2
12+
permissions:
13+
contents: read
14+
issues: write
15+
with:
16+
project-key: 'GEOPY'
17+
components: '[{"name": "grid-apps"}]'
1418
secrets:
1519
JIRA_BASE_URL: ${{ secrets.JIRA_BASE_URL }}
1620
JIRA_API_TOKEN: ${{ secrets.JIRA_API_TOKEN }}
1721
JIRA_USER_EMAIL: ${{ secrets.JIRA_USER_EMAIL }}
18-
with:
19-
project-key: 'GEOPY'
20-
components: '[{"name": "grid-apps"}]'

‎.github/workflows/pr_add_jira_summary.yml‎

Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -3,18 +3,16 @@ name: Add JIRA issue summary
33
on:
44
pull_request:
55
types: [opened]
6-
permissions:
7-
contents: read
8-
pull-requests: write
6+
7+
permissions: {}
98

109
jobs:
1110
call-workflow-add-jira-issue-summary:
12-
if: startsWith(github.event.pull_request.head.repo.full_name, 'MiraGeoscience/') # run if PR originates from the Mira repo only
13-
uses: MiraGeoscience/CI-tools/.github/workflows/reusable-jira-pr_add_jira_summary.yml@main
11+
uses: MiraGeoscience/CI-tools/.github/workflows/reusable-jira-pr_add_jira_summary.yml@v2
1412
permissions:
1513
contents: read
1614
pull-requests: write
1715
secrets:
1816
JIRA_BASE_URL: ${{ secrets.JIRA_BASE_URL }}
19-
JIRA_API_TOKEN: ${{ secrets.JIRA_API_TOKEN }}
2017
JIRA_USER_EMAIL: ${{ secrets.JIRA_USER_EMAIL }}
18+
JIRA_API_TOKEN: ${{ secrets.JIRA_API_TOKEN }}

‎.github/workflows/python_analysis.yml‎

Lines changed: 6 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,5 @@
11
name: Python analysis
2-
permissions:
3-
contents: read
4-
pull-requests: read
2+
53
on:
64
pull_request:
75
types: [opened, synchronize, reopened, ready_for_review]
@@ -19,40 +17,34 @@ on:
1917
- feature/**
2018
- hotfix/**
2119

20+
permissions: {}
21+
2222
concurrency:
2323
group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
2424
cancel-in-progress: true
2525

2626
jobs:
2727
call-workflow-static-analysis:
2828
name: Static analysis
29-
uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-static_analysis.yml@main
29+
uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-static_analysis.yml@v2
3030
permissions:
3131
contents: read
3232
pull-requests: read
3333
with:
3434
package-manager: 'conda'
3535
app-name: 'grid_apps'
3636
python-version: '3.10'
37-
call-workflow-pre-commmit:
38-
name: Pre-Commit
39-
uses: MiraGeoscience/CI-tools/.github/workflows/reusable-pre_commit.yml@main
40-
permissions:
41-
contents: read
42-
pull-requests: read
43-
with:
44-
app-name: 'grid_apps'
4537
call-workflow-pytest:
4638
name: Pytest
47-
uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-pytest.yml@main
39+
uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-pytest.yml@v2
4840
permissions:
4941
contents: read
5042
pull-requests: read
5143
with:
5244
package-manager: 'conda'
5345
python-versions: '["3.10", "3.11", "3.12"]'
54-
cache-number: 1
5546
os: '["ubuntu-latest", "windows-latest"]'
47+
cache-number: 1
5648
codecov-reference-python-version: '3.10'
5749
codecov-reference-os: '["windows-latest"]'
5850
secrets:

‎.github/workflows/python_deploy_dev.yml‎

Lines changed: 6 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,23 @@
11
name: Deploy python package in development
22

3-
permissions:
4-
contents: read
5-
63
on:
74
push:
85
tags:
96
- 'v*' # Push events to every version tag (eg. v1.0.0)
107

8+
permissions: {}
9+
1110
concurrency:
1211
group: ${{ github.workflow }}-${{ github.ref || github.run_id }}
1312
cancel-in-progress: true
1413

1514
jobs:
1615
call-workflow-conda-publish:
1716
name: Publish development conda package on JFrog Artifactory
18-
uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_rattler_package.yml@main
17+
uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_rattler_package.yml@v2
1918
permissions:
20-
contents: read
2119
id-token: write
20+
contents: write
2221
with:
2322
package-name: 'grid-apps'
2423
python-version: '3.10'
@@ -30,9 +29,9 @@ jobs:
3029
JFROG_ARTIFACTORY_TOKEN: ${{ secrets.JFROG_ARTIFACTORY_TOKEN }}
3130
call-workflow-pypi-publish:
3231
name: Publish development pypi package (JFrog Artifactory)
33-
uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_pypi_package.yml@main
32+
uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_pypi_package.yml@v2
3433
permissions:
35-
contents: read
34+
contents: write
3635
with:
3736
package-manager: 'poetry'
3837
package-name: 'grid-apps'

‎.github/workflows/python_deploy_prod.yml‎

Lines changed: 6 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,5 @@
11
name: Deploy python package in production
22

3-
permissions:
4-
contents: read
5-
63
on:
74
release:
85
types: [published]
@@ -22,6 +19,8 @@ on:
2219
type: boolean
2320
default: true
2421

22+
permissions: {}
23+
2524
concurrency:
2625
group: ${{ github.workflow }}-${{ github.event.release.tag_name || github.event.inputs.release-tag || github.run_id }}
2726
cancel-in-progress: true
@@ -30,10 +29,10 @@ jobs:
3029
call-workflow-conda-release:
3130
name: Publish production Conda package on JFrog Artifactory
3231
if: ${{ github.event_name == 'release' || github.event.inputs.publish-conda == 'true' }}
33-
uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-release_conda_assets.yml@main
32+
uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-release_conda_assets.yml@v2
3433
permissions:
35-
contents: read
3634
id-token: write
35+
contents: write
3736
with:
3837
virtual-repo-names: '["geology-noremote-conda-prod", "geophysics-noremote-conda-prod"]'
3938
release-tag: ${{ github.event.release.tag_name || github.event.inputs.release-tag }}
@@ -43,10 +42,10 @@ jobs:
4342
call-workflow-pypi-release:
4443
name: Publish production PyPI package (JFrog Artifactory)
4544
if: ${{ github.event_name == 'release' || github.event.inputs.publish-pypi == 'true' }}
46-
uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-release_pypi_assets.yml@main
45+
uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-release_pypi_assets.yml@v2
4746
permissions:
48-
contents: read
4947
id-token: write
48+
contents: write
5049
with:
5150
package-name: 'grid-apps'
5251
virtual-repo-names: '["geology-pypi-prod", "geophysics-pypi-prod"]'

‎.github/workflows/security_scan.yml‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
name: Security Scan
2+
3+
on:
4+
pull_request:
5+
types: [opened, synchronize, reopened, ready_for_review]
6+
branches:
7+
- develop
8+
- main
9+
- release/**
10+
- feature/**
11+
- hotfix/**
12+
push:
13+
branches:
14+
- develop
15+
- main
16+
- release/**
17+
- feature/**
18+
- hotfix/**
19+
20+
permissions: {}
21+
22+
concurrency:
23+
group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
24+
cancel-in-progress: true
25+
26+
jobs:
27+
call-workflow-zizmor-annotate:
28+
name: Zizmor analysis (advanced security)
29+
if: ${{ github.event_name != 'pull_request' }}
30+
permissions:
31+
security-events: write
32+
contents: read
33+
actions: read
34+
uses: MiraGeoscience/CI-tools/.github/workflows/reusable-zizmor-advanced-security.yml@v2
35+
36+
call-workflow-zizmor-advanced-security:
37+
name: Zizmor analysis (annotate)
38+
if: ${{ github.event_name == 'pull_request' }}
39+
permissions:
40+
checks: write
41+
contents: read
42+
actions: read
43+
uses: MiraGeoscience/CI-tools/.github/workflows/reusable-zizmor-annotate.yml@v2

‎.github/workflows/zizmor-security.yml‎

Lines changed: 0 additions & 26 deletions
This file was deleted.

‎zizmor.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
rules:

0 commit comments

Comments
 (0)