Skip to content

Commit 628812f

Browse files
sebhmgsebhmg
authored
Merge pull request #299 from MiraGeoscience/DEVOPS-917
DEVOPS-917: configure for zizmor
2 parents f705405 + 9951780 commit 628812f

8 files changed

Lines changed: 95 additions & 13 deletions

File tree

‎.github/dependabot.yml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,8 @@ version: 2
77
updates:
88
- package-ecosystem: "github-actions"
99
directory: "/"
10-
schedule:
11-
interval: "monthly"
1210
target-branch: "develop"
11+
schedule:
12+
interval: "weekly"
13+
cooldown:
14+
default-days: 4

‎.github/workflows/issue_to_jira.yml‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,10 +4,18 @@ on:
44
issues:
55
types: [opened]
66

7+
permissions: {}
8+
79
jobs:
810
call-workflow-create-jira-issue:
9-
uses: MiraGeoscience/CI-tools/.github/workflows/reusable-jira-issue_to_jira.yml@main
10-
secrets: inherit
11+
uses: MiraGeoscience/CI-tools/.github/workflows/reusable-jira-issue_to_jira.yml@v2
12+
permissions:
13+
contents: read
14+
issues: write
1115
with:
1216
project-key: 'GEOPY'
1317
components: '[{"name": "simpeg"}]'
18+
secrets:
19+
JIRA_BASE_URL: ${{ secrets.JIRA_BASE_URL }}
20+
JIRA_API_TOKEN: ${{ secrets.JIRA_API_TOKEN }}
21+
JIRA_USER_EMAIL: ${{ secrets.JIRA_USER_EMAIL }}

‎.github/workflows/pr_add_jira_summary.yml‎

Lines changed: 11 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,18 @@
11
name: Add JIRA issue summary
22

33
on:
4-
pull_request_target:
4+
pull_request:
55
types: [opened]
66

7+
permissions: {}
8+
79
jobs:
810
call-workflow-add-jira-issue-summary:
9-
uses: MiraGeoscience/CI-tools/.github/workflows/reusable-jira-pr_add_jira_summary.yml@main
10-
secrets: inherit
11+
uses: MiraGeoscience/CI-tools/.github/workflows/reusable-jira-pr_add_jira_summary.yml@v2
12+
permissions:
13+
contents: read
14+
pull-requests: write
15+
secrets:
16+
JIRA_BASE_URL: ${{ secrets.JIRA_BASE_URL }}
17+
JIRA_USER_EMAIL: ${{ secrets.JIRA_USER_EMAIL }}
18+
JIRA_API_TOKEN: ${{ secrets.JIRA_API_TOKEN }}

‎.github/workflows/python_analysis.yml‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,21 +17,29 @@ on:
1717
- feature/**
1818
- hotfix/**
1919

20+
permissions: {}
21+
2022
concurrency:
2123
group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
2224
cancel-in-progress: true
2325

2426
jobs:
2527
call-workflow-static-analysis:
2628
name: Static analysis
27-
uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-static_analysis.yml@main
29+
uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-static_analysis.yml@v2
30+
permissions:
31+
contents: read
32+
pull-requests: read
2833
with:
2934
package-manager: 'conda'
3035
app-name: 'simpeg_drivers'
3136
python-version: '3.10'
3237
call-workflow-pytest:
3338
name: Pytest
34-
uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-pytest.yml@main
39+
uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-pytest.yml@v2
40+
permissions:
41+
contents: read
42+
pull-requests: read
3543
with:
3644
package-manager: 'conda'
3745
python-versions: '["3.10", "3.11", "3.12"]'

‎.github/workflows/python_deploy_dev.yml‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,14 +5,18 @@ on:
55
tags:
66
- 'v*' # Push events to every version tag (eg. v1.0.0)
77

8+
permissions: {}
9+
810
concurrency:
911
group: ${{ github.workflow }}-${{ github.ref || github.run_id }}
1012
cancel-in-progress: true
1113

1214
jobs:
1315
call-workflow-conda-publish:
1416
name: Publish development conda package on JFrog Artifactory
15-
uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_rattler_package.yml@main
17+
uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_rattler_package.yml@v2
18+
permissions:
19+
contents: write
1620
with:
1721
package-name: 'simpeg-drivers'
1822
python-version: '3.10'
@@ -24,7 +28,9 @@ jobs:
2428
JFROG_ARTIFACTORY_TOKEN: ${{ secrets.JFROG_ARTIFACTORY_TOKEN }}
2529
call-workflow-pypi-publish:
2630
name: Publish development pypi package (JFrog Artifactory, TestPyPI)
27-
uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_pypi_package.yml@main
31+
uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_pypi_package.yml@v2
32+
permissions:
33+
contents: write
2834
with:
2935
package-manager: 'poetry'
3036
package-name: 'simpeg-drivers'

‎.github/workflows/python_deploy_prod.yml‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,15 +19,19 @@ on:
1919
type: boolean
2020
default: true
2121

22+
permissions: {}
23+
2224
concurrency:
2325
group: ${{ github.workflow }}-${{ github.event.release.tag_name || github.event.inputs.release-tag || github.run_id }}
2426
cancel-in-progress: true
2527

2628
jobs:
2729
call-workflow-conda-release:
2830
name: Publish production Conda package on JFrog Artifactory
29-
uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-release_conda_assets.yml@main
3031
if: ${{ github.event_name == 'release' || github.event.inputs.publish-conda == 'true' }}
32+
uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-release_conda_assets.yml@v2
33+
permissions:
34+
contents: write
3135
with:
3236
virtual-repo-names: '["public-noremote-conda-prod"]'
3337
release-tag: ${{ github.event.release.tag_name || github.event.inputs.release-tag }}
@@ -37,7 +41,9 @@ jobs:
3741
call-workflow-pypi-release:
3842
name: Publish production PyPI package (JFrog Artifactory, PyPI)
3943
if: ${{ github.event_name == 'release' || github.event.inputs.publish-pypi == 'true' }}
40-
uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-release_pypi_assets.yml@main
44+
uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-release_pypi_assets.yml@v2
45+
permissions:
46+
contents: write
4147
with:
4248
package-name: 'simpeg-drivers'
4349
virtual-repo-names: '["public-pypi-prod", "pypi"]'

‎.github/workflows/security_scan.yml‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
name: Security Scan
2+
3+
on:
4+
pull_request:
5+
types: [opened, synchronize, reopened, ready_for_review]
6+
branches:
7+
- develop
8+
- main
9+
- release/**
10+
- feature/**
11+
- hotfix/**
12+
push:
13+
branches:
14+
- develop
15+
- main
16+
- release/**
17+
- feature/**
18+
- hotfix/**
19+
20+
permissions: {}
21+
22+
concurrency:
23+
group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
24+
cancel-in-progress: true
25+
26+
jobs:
27+
call-workflow-zizmor-annotate:
28+
name: Zizmor analysis (advanced security)
29+
if: ${{ github.event_name != 'pull_request' }}
30+
permissions:
31+
security-events: write
32+
contents: read
33+
actions: read
34+
uses: MiraGeoscience/CI-tools/.github/workflows/reusable-zizmor-advanced-security.yml@v2
35+
36+
call-workflow-zizmor-advanced-security:
37+
name: Zizmor analysis (annotate)
38+
if: ${{ github.event_name == 'pull_request' }}
39+
permissions:
40+
checks: write
41+
contents: read
42+
actions: read
43+
uses: MiraGeoscience/CI-tools/.github/workflows/reusable-zizmor-annotate.yml@v2

‎zizmor.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
rules:

0 commit comments

Comments
 (0)