Skip to content

Update action versions, pin to commit hashes, add zizmor to pre-commi… #23

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
m-aciek wants to merge 3 commits into
base: main
Choose a base branch
from
Open

Update action versions, pin to commit hashes, add zizmor to pre-commi… #23

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
817a0fb
Update action versions, pin to commit hashes, add zizmor to pre-commi…
m-aciek Jun 1, 2026
3054be5
Add permissions for GitHub Pages deployment in build and schedule con…
m-aciek Jun 2, 2026
b68f758
Add required permissions for GitHub Actions in schedule configuration
m-aciek Jun 2, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
125 changes: 78 additions & 47 deletions .github/workflows/build.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,7 @@ on:
description: 'Publish to GitHub Pages'
required: false
default: false
type: boolean
python_version:
description: 'Python version used to generate docs'
required: false
Expand All @@ -38,8 +39,8 @@ on:
type: string
publish:
description: 'Publish to GitHub Pages'
default: 'false'
type: string
default: false
type: boolean
python_version:
description: 'Python version used to generate docs'
default: '3'
Expand All @@ -52,10 +53,7 @@ on:
description: 'JSON array of language-specific sphinxopts'
default: '[]'
type: string
permissions:
contents: read
pages: write
id-token: write
permissions: {}
Comment thread
m-aciek marked this conversation as resolved.
jobs:
prepare:
runs-on: ubuntu-latest
Expand All @@ -65,13 +63,14 @@ jobs:
translation_ref: ${{ steps.resolve-translation.outputs.translation_ref }}
translation_repository: ${{ steps.resolve-translation.outputs.translation_repository }}
steps:
- uses: actions/setup-python@master
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
with:
python-version: ${{ inputs.python_version }}
- uses: actions/checkout@master
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
repository: ${{ inputs.repository }}
ref: ${{ inputs.reference }}
persist-credentials: false
- id: get-version
run: |
echo "dist_version=$(python tools/extensions/patchlevel.py --short)" >> "$GITHUB_OUTPUT"
Expand Down Expand Up @@ -120,20 +119,22 @@ jobs:
needs: prepare
runs-on: ubuntu-latest
steps:
- uses: actions/setup-python@master
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
with:
python-version: ${{ inputs.python_version }}
- uses: actions/checkout@master
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
repository: ${{ inputs.repository }}
ref: ${{ inputs.reference }}
persist-credentials: false
- name: Checkout translation sources
if: ${{ inputs.language != 'en' }}
uses: actions/checkout@master
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
repository: ${{ needs.prepare.outputs.translation_repository }}
ref: ${{ needs.prepare.outputs.translation_ref }}
path: Doc/locale/${{ inputs.language }}/LC_MESSAGES
persist-credentials: false
- id: build-settings
env:
LANGUAGE_TAG: ${{ inputs.language }}
Expand Down Expand Up @@ -173,15 +174,17 @@ jobs:
PY
- run: make venv
working-directory: ./Doc
- run: make dist-html SPHINXERRORHANDLING= SPHINXOPTS="${{ steps.build-settings.outputs.common_sphinxopts }}"
- run: make dist-html SPHINXERRORHANDLING= SPHINXOPTS="${STEPS_BUILD_SETTINGS_OUTPUTS_COMMON_SPHINXOPTS}"
working-directory: ./Doc
- uses: actions/upload-artifact@master
env:
STEPS_BUILD_SETTINGS_OUTPUTS_COMMON_SPHINXOPTS: ${{ steps.build-settings.outputs.common_sphinxopts }}
- uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
if: always()
with:
name: python-${{ needs.prepare.outputs.dist_version }}${{ steps.build-settings.outputs.artifact_suffix }}-docs-html.zip
path: ./Doc/dist/python-${{ needs.prepare.outputs.dist_version }}*-docs-html.zip
if-no-files-found: ignore
- uses: actions/upload-artifact@master
- uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
if: always()
with:
name: python-${{ needs.prepare.outputs.dist_version }}${{ steps.build-settings.outputs.artifact_suffix }}-docs-html.tar.bz2
Expand All @@ -191,20 +194,22 @@ jobs:
needs: prepare
runs-on: ubuntu-latest
steps:
- uses: actions/setup-python@master
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
with:
python-version: ${{ inputs.python_version }}
- uses: actions/checkout@master
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
repository: ${{ inputs.repository }}
ref: ${{ inputs.reference }}
persist-credentials: false
- name: Checkout translation sources
if: ${{ inputs.language != 'en' }}
uses: actions/checkout@master
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
repository: ${{ needs.prepare.outputs.translation_repository }}
ref: ${{ needs.prepare.outputs.translation_ref }}
path: Doc/locale/${{ inputs.language }}/LC_MESSAGES
persist-credentials: false
- id: build-settings
env:
LANGUAGE_TAG: ${{ inputs.language }}
Expand Down Expand Up @@ -244,15 +249,17 @@ jobs:
PY
- run: make venv
working-directory: ./Doc
- run: make dist-text SPHINXERRORHANDLING= SPHINXOPTS="${{ steps.build-settings.outputs.common_sphinxopts }}"
- run: make dist-text SPHINXERRORHANDLING= SPHINXOPTS="${STEPS_BUILD_SETTINGS_OUTPUTS_COMMON_SPHINXOPTS}"
working-directory: ./Doc
- uses: actions/upload-artifact@master
env:
STEPS_BUILD_SETTINGS_OUTPUTS_COMMON_SPHINXOPTS: ${{ steps.build-settings.outputs.common_sphinxopts }}
- uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
if: always()
with:
name: python-${{ needs.prepare.outputs.dist_version }}${{ steps.build-settings.outputs.artifact_suffix }}-docs-text.zip
path: ./Doc/dist/python-${{ needs.prepare.outputs.dist_version }}*-docs-text.zip
if-no-files-found: ignore
- uses: actions/upload-artifact@master
- uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
if: always()
with:
name: python-${{ needs.prepare.outputs.dist_version }}${{ steps.build-settings.outputs.artifact_suffix }}-docs-text.tar.bz2
Expand All @@ -262,20 +269,22 @@ jobs:
needs: prepare
runs-on: ubuntu-latest
steps:
- uses: actions/setup-python@master
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
with:
python-version: ${{ inputs.python_version }}
- uses: actions/checkout@master
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
repository: ${{ inputs.repository }}
ref: ${{ inputs.reference }}
persist-credentials: false
- name: Checkout translation sources
if: ${{ inputs.language != 'en' }}
uses: actions/checkout@master
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
repository: ${{ needs.prepare.outputs.translation_repository }}
ref: ${{ needs.prepare.outputs.translation_ref }}
path: Doc/locale/${{ inputs.language }}/LC_MESSAGES
persist-credentials: false
- id: build-settings
env:
LANGUAGE_TAG: ${{ inputs.language }}
Expand Down Expand Up @@ -316,15 +325,17 @@ jobs:
- run: make venv
working-directory: ./Doc
- run: sudo apt-get update && sudo apt-get install -y texinfo
- run: make dist-texinfo SPHINXERRORHANDLING= SPHINXOPTS="${{ steps.build-settings.outputs.common_sphinxopts }}"
- run: make dist-texinfo SPHINXERRORHANDLING= SPHINXOPTS="${STEPS_BUILD_SETTINGS_OUTPUTS_COMMON_SPHINXOPTS}"
working-directory: ./Doc
- uses: actions/upload-artifact@master
env:
STEPS_BUILD_SETTINGS_OUTPUTS_COMMON_SPHINXOPTS: ${{ steps.build-settings.outputs.common_sphinxopts }}
- uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
if: always()
with:
name: python-${{ needs.prepare.outputs.dist_version }}${{ steps.build-settings.outputs.artifact_suffix }}-docs-texinfo.zip
path: ./Doc/dist/python-${{ needs.prepare.outputs.dist_version }}*-docs-texinfo.zip
if-no-files-found: ignore
- uses: actions/upload-artifact@master
- uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
if: always()
with:
name: python-${{ needs.prepare.outputs.dist_version }}${{ steps.build-settings.outputs.artifact_suffix }}-docs-texinfo.tar.bz2
Expand All @@ -334,20 +345,22 @@ jobs:
needs: prepare
runs-on: ubuntu-latest
steps:
- uses: actions/setup-python@master
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
with:
python-version: ${{ inputs.python_version }}
- uses: actions/checkout@master
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
repository: ${{ inputs.repository }}
ref: ${{ inputs.reference }}
persist-credentials: false
- name: Checkout translation sources
if: ${{ inputs.language != 'en' }}
uses: actions/checkout@master
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
repository: ${{ needs.prepare.outputs.translation_repository }}
ref: ${{ needs.prepare.outputs.translation_ref }}
path: Doc/locale/${{ inputs.language }}/LC_MESSAGES
persist-credentials: false
- id: build-settings
env:
LANGUAGE_TAG: ${{ inputs.language }}
Expand Down Expand Up @@ -387,9 +400,11 @@ jobs:
PY
- run: make venv
working-directory: ./Doc
- run: make dist-epub SPHINXERRORHANDLING= SPHINXOPTS="${{ steps.build-settings.outputs.common_sphinxopts }}"
- run: make dist-epub SPHINXERRORHANDLING= SPHINXOPTS="${STEPS_BUILD_SETTINGS_OUTPUTS_COMMON_SPHINXOPTS}"
working-directory: ./Doc
- uses: actions/upload-artifact@master
env:
STEPS_BUILD_SETTINGS_OUTPUTS_COMMON_SPHINXOPTS: ${{ steps.build-settings.outputs.common_sphinxopts }}
- uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
if: always()
with:
name: python-${{ needs.prepare.outputs.dist_version }}${{ steps.build-settings.outputs.artifact_suffix }}-docs.epub
Expand All @@ -399,20 +414,22 @@ jobs:
needs: prepare
runs-on: ubuntu-latest
steps:
- uses: actions/setup-python@master
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
with:
python-version: ${{ inputs.python_version }}
- uses: actions/checkout@master
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
repository: ${{ inputs.repository }}
ref: ${{ inputs.reference }}
persist-credentials: false
- name: Checkout translation sources
if: ${{ inputs.language != 'en' }}
uses: actions/checkout@master
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
repository: ${{ needs.prepare.outputs.translation_repository }}
ref: ${{ needs.prepare.outputs.translation_ref }}
path: Doc/locale/${{ inputs.language }}/LC_MESSAGES
persist-credentials: false
- id: build-settings
env:
LANGUAGE_TAG: ${{ inputs.language }}
Expand Down Expand Up @@ -464,8 +481,10 @@ jobs:
ko) sudo apt-get install -y texlive-lang-korean ;;
ja) sudo apt-get install -y texlive-lang-japanese texlive-luatex fonts-noto-cjk-extra ;;
esac
- run: make dist-pdf SPHINXERRORHANDLING= SPHINXOPTS="${{ steps.build-settings.outputs.pdf_sphinxopts }}"
- run: make dist-pdf SPHINXERRORHANDLING= SPHINXOPTS="${STEPS_BUILD_SETTINGS_OUTPUTS_PDF_SPHINXOPTS}"
working-directory: ./Doc
env:
STEPS_BUILD_SETTINGS_OUTPUTS_PDF_SPHINXOPTS: ${{ steps.build-settings.outputs.pdf_sphinxopts }}
- name: Dump LaTeX log tails on failure
if: failure()
run: |
Expand All @@ -474,57 +493,66 @@ jobs:
echo "===== $f (tail) ====="
tail -n 80 "$f" || true
done
- uses: actions/upload-artifact@master
- uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
if: always()
with:
name: python-${{ needs.prepare.outputs.dist_version }}${{ steps.build-settings.outputs.artifact_suffix }}-pdf-logs.zip
path: |
./Doc/build/latex/*.log
./Doc/build/latex/*.tex
- uses: actions/upload-artifact@master
- uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
if: always()
with:
name: python-${{ needs.prepare.outputs.dist_version }}${{ steps.build-settings.outputs.artifact_suffix }}-docs-pdf-a4.zip
path: ./Doc/dist/python-${{ needs.prepare.outputs.dist_version }}*-docs-pdf-a4.zip
if-no-files-found: ignore
- uses: actions/upload-artifact@master
- uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
if: always()
with:
name: python-${{ needs.prepare.outputs.dist_version }}${{ steps.build-settings.outputs.artifact_suffix }}-docs-pdf-a4.tar.bz2
path: ./Doc/dist/python-${{ needs.prepare.outputs.dist_version }}*-docs-pdf-a4.tar.bz2
if-no-files-found: ignore
publish:
needs: [prepare, build-html, build-text, build-texinfo, build-epub, build-pdf]
if: ${{ !cancelled() && inputs.publish == 'true' }}
if: ${{ !cancelled() && inputs.publish }}
permissions:
pages: write # to deploy to Pages
id-token: write # to verify the deployment originates from an appropriate source
runs-on: ubuntu-latest
environment:
name: github-pages
url: ${{ steps.deployment.outputs.page_url }}
steps:
- name: Configure Pages
uses: actions/configure-pages@v6
uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0

- name: Checkout existing gh-pages content
id: checkout-pages
uses: actions/checkout@v6
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
ref: gh-pages
path: _site
persist-credentials: false
continue-on-error: true

- name: Normalize language tag for publishing
id: normalize-lang
run: echo "tag=$(echo '${{ inputs.language }}' | tr '_' '-' | tr '[:upper:]' '[:lower:]')" >> "$GITHUB_OUTPUT"
run: echo "tag=$(echo '${INPUTS_LANGUAGE}' | tr '_' '-' | tr '[:upper:]' '[:lower:]')" >> "$GITHUB_OUTPUT"

@chatgpt-codex-connector chatgpt-codex-connector Bot Jun 2, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Expand the language env var before publishing

When build.yaml is run with publish: true, this command writes the literal string ${inputs-language} to steps.normalize-lang.outputs.tag because ${INPUTS_LANGUAGE} is inside single quotes within the shell command substitution. As a result the publish job creates and copies archives under _site/${inputs-language}/<version>/ instead of the requested language such as _site/fr-fr/<version>/, breaking manual/reusable publishes for every language.

Useful? React with 👍 / 👎.

env:
INPUTS_LANGUAGE: ${{ inputs.language }}

- name: Prepare site directory
run: |
mkdir -p _site/${{ steps.normalize-lang.outputs.tag }}/${{ needs.prepare.outputs.major_minor }}
mkdir -p _site/${STEPS_NORMALIZE_LANG_OUTPUTS_TAG}/${NEEDS_PREPARE_OUTPUTS_MAJOR_MINOR}
# Remove git metadata; safe even if checkout above did not succeed
rm -rf _site/.git
env:
STEPS_NORMALIZE_LANG_OUTPUTS_TAG: ${{ steps.normalize-lang.outputs.tag }}
NEEDS_PREPARE_OUTPUTS_MAJOR_MINOR: ${{ needs.prepare.outputs.major_minor }}

- name: Download all artifacts
# Collect all build artifacts then merge into the publish directory
uses: actions/download-artifact@v8
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
path: artifacts/

Expand All @@ -534,7 +562,10 @@ jobs:
# excluding PDF build logs which are for debugging only.
find artifacts/ -type f \( -name "*.zip" -o -name "*.tar.bz2" -o -name "*.epub" \) \
! -name "python-*-pdf-logs.zip" \
-exec cp {} _site/${{ steps.normalize-lang.outputs.tag }}/${{ needs.prepare.outputs.major_minor }}/ \;
-exec cp {} _site/${STEPS_NORMALIZE_LANG_OUTPUTS_TAG}/${NEEDS_PREPARE_OUTPUTS_MAJOR_MINOR}/ \;
env:
STEPS_NORMALIZE_LANG_OUTPUTS_TAG: ${{ steps.normalize-lang.outputs.tag }}
NEEDS_PREPARE_OUTPUTS_MAJOR_MINOR: ${{ needs.prepare.outputs.major_minor }}

- name: Generate per-version directory listing
run: |
Expand Down Expand Up @@ -584,10 +615,10 @@ jobs:
PY

- name: Upload Pages artifact
uses: actions/upload-pages-artifact@v5
uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
with:
path: _site

- name: Deploy to GitHub Pages
id: deployment
uses: actions/deploy-pages@v5
uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0
Loading
Loading