Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 7 additions & 14 deletions .github/workflows/ci-pr.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -3,10 +3,6 @@ name: Test PR
on:
pull_request:

permissions:
# Read repository contents for checkout and dependency resolution only.
contents: read

Comment on lines -6 to -9
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not good. You are reverting the latest fixes I did in repo-config to improve security. Without declaring permissions explicitly, actions will have write permission. Please revert.

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I asked Phillip to copy the existing stuff from component-graph-py, where we have verified that this config works for maturin based rust binding builds, and didn't want to research. And at least those two repos haven't diverged from each other.

It would be nice to get repo-config support for rust bindings, because we're likely to get more soon(tm).

This particular item I remember removing very clearly because we talked about it: frequenz-floss/frequenz-microgrid-component-graph-python#16 (comment)

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I asked Phillip to copy the existing stuff from component-graph-py, where we have verified that this config works for maturin based rust binding builds, and didn't want to research. And at least those two repos haven't diverged from each other.

Understood. Still, please be careful about reverting changes related to security, I think the priority should be security, if we need to align, we need to bring the less secure workflow to be like the most secure workflow, not the other way around. And I totally get that this changes are new and you might have been unaware. It is just a heads-up for the future.

It would be nice to get repo-config support for rust bindings, because we're likely to get more soon(tm).

100% agreed, I suggested that too. If you could create an issue it would be helpful (and a PR would be amazing 😆 )

env:
# Please make sure this version is included in the `matrix`, as the
# `matrix` section can't use `env`, so it must be entered manually
Expand All @@ -21,7 +17,7 @@ jobs:

steps:
- name: Run nox
uses: frequenz-floss/gh-action-nox@80a9845a59ffc71d27b9c41099eb6cb55bc7b671 # v1.1.1
uses: frequenz-floss/gh-action-nox@v1.0.1
Comment on lines -24 to +20
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why this? This is not good, we should always pin dependencies (it was also downgraded, but that will be taken care of by dependabot). Can you please revert to use hashes? Same for all the others.

with:
python-version: "3.11"
nox-session: ci_checks_max
Expand All @@ -31,15 +27,15 @@ jobs:
runs-on: ubuntu-24.04
steps:
- name: Setup Git
uses: frequenz-floss/gh-action-setup-git@16952aac3ccc01d27412fe0dea3ea946530dcace # v1.0.0
uses: frequenz-floss/gh-action-setup-git@v1.0.0

- name: Fetch sources
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
uses: actions/checkout@v5
with:
submodules: true

- name: Setup Python
uses: frequenz-floss/gh-action-setup-python-with-deps@e4d0b2ef8f5a1612d7827f3abaef17c931d2b946 # v1.0.2
uses: frequenz-floss/gh-action-setup-python-with-deps@v1.0.1
with:
python-version: ${{ env.DEFAULT_PYTHON_VERSION }}
dependencies: .[dev-mkdocs]
Expand All @@ -48,14 +44,11 @@ jobs:
env:
MIKE_VERSION: gh-${{ github.job }}
run: |
# mike is installed as a console script, not a runnable module.
# Run the installed script under isolated mode to avoid importing from
# the workspace when building docs from checked-out code.
python -I "$(command -v mike)" deploy "$MIKE_VERSION"
python -I "$(command -v mike)" set-default "$MIKE_VERSION"
mike deploy $MIKE_VERSION
mike set-default $MIKE_VERSION

- name: Upload site
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
uses: actions/upload-artifact@v5
with:
name: docs-site
path: site/
Expand Down
Loading
Loading