From d56ca6e4e4b431bb4f3058eea429eddf3e6f7767 Mon Sep 17 00:00:00 2001 From: Henry Schreiner Date: Thu, 13 Aug 2026 11:40:13 -0400 Subject: [PATCH] chore: secure CI Assisted-by: ClaudeCode:claude-opus-5 --- .github/dependabot.yml | 4 +++- .github/workflows/cd.yml | 21 ++++++++++++++------- .github/workflows/ci.yml | 20 +++++++++++++------- .pre-commit-config.yaml | 23 +++++++++++++++-------- pyproject.toml | 4 ++++ 5 files changed, 49 insertions(+), 23 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 6c4b369..ea58ef7 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -4,8 +4,10 @@ updates: - package-ecosystem: "github-actions" directory: "/" schedule: - interval: "weekly" + interval: "monthly" groups: actions: patterns: - "*" + cooldown: + default-days: 7 diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml index 4bbd53d..7cc20db 100644 --- a/.github/workflows/cd.yml +++ b/.github/workflows/cd.yml @@ -6,17 +6,24 @@ on: types: - published +permissions: {} + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + jobs: dist: name: Distribution build runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 + persist-credentials: false - - uses: hynek/build-and-inspect-python-package@v2 + - uses: hynek/build-and-inspect-python-package@2abe76da66d0a6a4a227101f9348ee855797cfa5 # v3.0.1 publish: name: Publish @@ -25,21 +32,21 @@ jobs: name: pypi url: https://pypi.org/p/flake8-errmsg permissions: - id-token: write - attestations: write + id-token: write # trusted publishing to PyPI + attestations: write # artifact attestations runs-on: ubuntu-latest if: github.event_name == 'release' && github.event.action == 'published' steps: - - uses: actions/download-artifact@v8 + - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: Packages path: dist - name: Generate artifact attestation for sdist and wheel - uses: actions/attest-build-provenance@v4 + uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2 with: subject-path: "dist/*" - - uses: pypa/gh-action-pypi-publish@release/v1 + - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2 with: attestations: true diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 1013737..53098de 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -11,13 +11,17 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true +permissions: {} + jobs: pylint: name: PyLint runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 - - uses: astral-sh/setup-uv@v9.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0 - name: Run PyLint run: uvx nox -s pylint -- --output-format=github @@ -31,16 +35,17 @@ jobs: runs-on: [ubuntu-latest, macos-latest, windows-latest] steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 + persist-credentials: false - - uses: actions/setup-python@v7 + - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: ${{ matrix.python-version }} allow-prereleases: true - - uses: astral-sh/setup-uv@v9.0.0 + - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0 - name: Test package run: | @@ -52,8 +57,9 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 + persist-credentials: false - - uses: hynek/build-and-inspect-python-package@v2 + - uses: hynek/build-and-inspect-python-package@2abe76da66d0a6a4a227101f9348ee855797cfa5 # v3.0.1 diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index e5f1023..4c3d0ca 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -5,7 +5,7 @@ ci: repos: - repo: https://github.com/pre-commit/pre-commit-hooks - rev: v6.0.0 + rev: 3e8a8703264a2f4a69428a0aa4dcb512790b2c8c # frozen: v6.0.0 hooks: - id: check-added-large-files - id: check-case-conflict @@ -19,7 +19,7 @@ repos: - id: trailing-whitespace - repo: https://github.com/pre-commit/pygrep-hooks - rev: v1.10.0 + rev: 3a6eb0fadf60b3cccfd80bad9dbb6fae7e47b316 # frozen: v1.10.0 hooks: - id: python-check-blanket-noqa - id: python-check-blanket-type-ignore @@ -30,43 +30,50 @@ repos: - id: rst-inline-touching-normal - repo: https://github.com/rbubley/mirrors-prettier - rev: "v3.9.4" + rev: "0ee178619d696787ca73d210cc191d720868c631" # frozen: v3.9.6 hooks: - id: prettier types_or: [yaml, markdown, html, css, scss, javascript, json] args: [--prose-wrap=always] - repo: https://github.com/adamchainz/blacken-docs - rev: 1.20.0 + rev: fda77690955e9b63c6687d8806bafd56a526e45f # frozen: 1.20.0 hooks: - id: blacken-docs additional_dependencies: [black==25.*] - repo: https://github.com/astral-sh/ruff-pre-commit - rev: "v0.15.20" + rev: "39d9ac5938dadb73df0564a45f163e25ff9fa6e2" # frozen: v0.16.1 hooks: - id: ruff-check args: ["--fix", "--show-fixes"] - id: ruff-format - repo: https://github.com/pre-commit/mirrors-mypy - rev: v2.1.0 + rev: 41e691678310dfd3833f7ab4e180ddb014310356 # frozen: v2.3.0 hooks: - id: mypy files: src args: [] - repo: https://github.com/codespell-project/codespell - rev: v2.4.2 + rev: 57b21406f092110c18776e39b0bda50d37c945c8 # frozen: v2.4.3 hooks: - id: codespell args: ["-w"] - repo: https://github.com/shellcheck-py/shellcheck-py - rev: v0.11.0.1 + rev: 745eface02aef23e168a8afb6b5737818efbea95 # frozen: v0.11.0.1 hooks: - id: shellcheck + - repo: https://github.com/zizmorcore/zizmor-pre-commit + rev: 451b56af716f9f0d0c2b816503a3fd0cf8b036fa # frozen: v1.29.0 + hooks: + - id: zizmor + files: "^\\.github" + args: [--persona=pedantic] + - repo: local hooks: - id: disallow-caps diff --git a/pyproject.toml b/pyproject.toml index 4718012..59ed93d 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -60,6 +60,10 @@ envs.default.dependencies = [ ] +[tool.uv] +exclude-newer = "7 days" + + [tool.pytest.ini_options] minversion = "7.0" addopts = ["-ra", "--showlocals", "--strict-markers", "--strict-config"]