From 71f4bffa3169812273d024985405fc9f60858755 Mon Sep 17 00:00:00 2001 From: zssherman Date: Mon, 12 Oct 2026 14:48:36 -0500 Subject: [PATCH 1/2] CI: Update to use immutable hashes and update versions, add dependabot. --- .github/dependabot.yml | 10 ++++++++++ .github/workflows/antivirus.yml | 17 +++++++++++++++++ .../{codeql-analysis.yml => codeql.yml} | 8 ++++---- .github/workflows/deploy.yml | 8 ++++---- .github/workflows/virus.yml | 12 ------------ 5 files changed, 35 insertions(+), 20 deletions(-) create mode 100644 .github/dependabot.yml create mode 100644 .github/workflows/antivirus.yml rename .github/workflows/{codeql-analysis.yml => codeql.yml} (87%) delete mode 100644 .github/workflows/virus.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 00000000..d15c975e --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,10 @@ +version: 2 +updates: + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "weekly" + groups: + actions: + patterns: + - "*" diff --git a/.github/workflows/antivirus.yml b/.github/workflows/antivirus.yml new file mode 100644 index 00000000..104ff8e9 --- /dev/null +++ b/.github/workflows/antivirus.yml @@ -0,0 +1,17 @@ +on: + pull_request: + types: [opened, synchronize, reopened] + +permissions: + contents: read + +jobs: + gitavscan: + runs-on: ubuntu-latest + name: AV scan + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - name: Git AV Scan + uses: djdefi/gitavscan@66a83ba98eca422f37322bc9851fa56195b252f3 # v23 + with: + full: '--full' diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql.yml similarity index 87% rename from .github/workflows/codeql-analysis.yml rename to .github/workflows/codeql.yml index 86b54ea2..4dc9f0ee 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql.yml @@ -38,11 +38,11 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v3 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@v2 + uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2 with: languages: ${{ matrix.language }} # If you wish to specify custom queries, you can do so here or in a config file. @@ -56,7 +56,7 @@ jobs: # Autobuild attempts to build any compiled languages (C/C++, C#, or Java). # If this step fails, then you should remove it and run the build manually (see below) - name: Autobuild - uses: github/codeql-action/autobuild@v2 + uses: github/codeql-action/autobuild@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2 # ℹī¸ Command-line programs to run using the OS shell. # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun @@ -69,4 +69,4 @@ jobs: # ./location_of_script_within_repo/buildscript.sh - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v2 + uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2 diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index 03894668..a589e93b 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -17,13 +17,13 @@ jobs: strategy: matrix: os: [ubuntu-latest] - python-version: [3.12] + python-version: [3.14] steps: - - uses: actions/checkout@v2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 # Install dependencies - name: Set up Python ${{ matrix.python-version }} - uses: actions/setup-python@v1 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: ${{ matrix.python-version }} - name: Install dependencies @@ -35,7 +35,7 @@ jobs: jupyter-book build . # Deploy the book's HTML to gh-pages branch - name: GitHub Pages action - uses: peaceiris/actions-gh-pages@v3.6.1 + uses: peaceiris/actions-gh-pages@84c30a85c19949d7eee79c4ff27748b70285e453 # v4.1.0 if: github.ref == 'refs/heads/main' with: github_token: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/virus.yml b/.github/workflows/virus.yml deleted file mode 100644 index 95e5f691..00000000 --- a/.github/workflows/virus.yml +++ /dev/null @@ -1,12 +0,0 @@ -on: - pull_request: - types: [assigned, opened, synchronize, reopened, closed] - -jobs: - gitavscan: - runs-on: ubuntu-latest - name: AV scan - steps: - - uses: actions/checkout@v2 - - name: Git AV Scan - uses: djdefi/gitavscan@main From 1db81e46c16b5a37d46d8aad38e40eee5180a451 Mon Sep 17 00:00:00 2001 From: zssherman Date: Fri, 16 Oct 2026 14:35:47 -0500 Subject: [PATCH 2/2] CI: Updating a few more things. --- .github/workflows/antivirus.yml | 2 ++ .github/workflows/codeql.yml | 2 ++ .github/workflows/deploy.yml | 2 ++ 3 files changed, 6 insertions(+) diff --git a/.github/workflows/antivirus.yml b/.github/workflows/antivirus.yml index 104ff8e9..d62257da 100644 --- a/.github/workflows/antivirus.yml +++ b/.github/workflows/antivirus.yml @@ -11,6 +11,8 @@ jobs: name: AV scan steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Git AV Scan uses: djdefi/gitavscan@66a83ba98eca422f37322bc9851fa56195b252f3 # v23 with: diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 4dc9f0ee..b1e7ad4e 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -39,6 +39,8 @@ jobs: steps: - name: Checkout repository uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index a589e93b..cfab6d70 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -20,6 +20,8 @@ jobs: python-version: [3.14] steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false # Install dependencies - name: Set up Python ${{ matrix.python-version }}