From b991e33ac0ac59c81fa08adc1d0b37b346d2b80c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Joris=20Pelgr=C3=B6m?= Date: Tue, 5 May 2026 23:07:13 +0200 Subject: [PATCH 1/4] Update and pin actions --- .github/workflows/linting.yml | 4 ++-- .github/workflows/release.yml | 12 ++++++------ .github/workflows/testing.yml | 6 +++--- .github/workflows/typing.yml | 4 ++-- 4 files changed, 13 insertions(+), 13 deletions(-) diff --git a/.github/workflows/linting.yml b/.github/workflows/linting.yml index 23d7f4a..70f683b 100644 --- a/.github/workflows/linting.yml +++ b/.github/workflows/linting.yml @@ -16,12 +16,12 @@ jobs: runs-on: ubuntu-latest steps: - name: Check out code - uses: actions/checkout@v4 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Set up Poetry run: pipx install poetry - name: Set up Python id: python - uses: actions/setup-python@v5 + uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 with: python-version: ${{ env.DEFAULT_PYTHON }} cache: "poetry" diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index d438a29..1a6459d 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -14,12 +14,12 @@ jobs: runs-on: ubuntu-latest steps: - name: Check out code - uses: actions/checkout@v4 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Set up Poetry run: pipx install poetry - name: Set up Python id: python - uses: actions/setup-python@v5 + uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 with: python-version: ${{ env.DEFAULT_PYTHON }} cache: "poetry" @@ -34,7 +34,7 @@ jobs: - name: Build package run: poetry build --no-interaction - name: Store the distribution packages - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: python-package-distributions path: dist/ @@ -50,14 +50,14 @@ jobs: contents: write steps: - name: Download the distribution packages - uses: actions/download-artifact@v4 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: python-package-distributions path: dist/ - name: Publish to PyPi - uses: pypa/gh-action-pypi-publish@release/v1 + uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0 - name: Sign published artifacts - uses: sigstore/gh-action-sigstore-python@v3.0.0 + uses: sigstore/gh-action-sigstore-python@04cffa1d795717b140764e8b640de88853c92acc # v3.3.0 with: inputs: ./dist/*.tar.gz ./dist/*.whl release-signing-artifacts: true diff --git a/.github/workflows/testing.yml b/.github/workflows/testing.yml index c77b0af..c1f833b 100644 --- a/.github/workflows/testing.yml +++ b/.github/workflows/testing.yml @@ -16,15 +16,15 @@ jobs: runs-on: ubuntu-latest strategy: matrix: - python: ["3.12", "3.13", "3.14"] + python: [ "3.12", "3.13", "3.14" ] steps: - name: Check out code - uses: actions/checkout@v4 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Set up Poetry run: pipx install poetry - name: Set up Python ${{ matrix.python }} id: python - uses: actions/setup-python@v5 + uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 with: python-version: ${{ matrix.python }} cache: "poetry" diff --git a/.github/workflows/typing.yml b/.github/workflows/typing.yml index 2fe97d6..5239067 100644 --- a/.github/workflows/typing.yml +++ b/.github/workflows/typing.yml @@ -16,12 +16,12 @@ jobs: runs-on: ubuntu-latest steps: - name: Check out code - uses: actions/checkout@v4 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Set up Poetry run: pipx install poetry - name: Set up Python id: python - uses: actions/setup-python@v5 + uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 with: python-version: ${{ env.DEFAULT_PYTHON }} cache: "poetry" From 2bb53d4baeafbb9fe2c7bb0cded890c49c2b4953 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Joris=20Pelgr=C3=B6m?= Date: Mon, 28 Sep 2026 11:35:25 +0200 Subject: [PATCH 2/4] Update actions, again --- .github/workflows/linting.yml | 4 ++-- .github/workflows/release.yml | 4 ++-- .github/workflows/testing.yml | 4 ++-- .github/workflows/typing.yml | 4 ++-- 4 files changed, 8 insertions(+), 8 deletions(-) diff --git a/.github/workflows/linting.yml b/.github/workflows/linting.yml index 70f683b..0a691aa 100644 --- a/.github/workflows/linting.yml +++ b/.github/workflows/linting.yml @@ -16,12 +16,12 @@ jobs: runs-on: ubuntu-latest steps: - name: Check out code - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Poetry run: pipx install poetry - name: Set up Python id: python - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: ${{ env.DEFAULT_PYTHON }} cache: "poetry" diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 1a6459d..eed8bec 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -55,9 +55,9 @@ jobs: name: python-package-distributions path: dist/ - name: Publish to PyPi - uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0 + uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2 - name: Sign published artifacts - uses: sigstore/gh-action-sigstore-python@04cffa1d795717b140764e8b640de88853c92acc # v3.3.0 + uses: sigstore/gh-action-sigstore-python@790bc6befb9d733738f18d8f895854b453640ec9 # v3.5.0 with: inputs: ./dist/*.tar.gz ./dist/*.whl release-signing-artifacts: true diff --git a/.github/workflows/testing.yml b/.github/workflows/testing.yml index c1f833b..890bc2b 100644 --- a/.github/workflows/testing.yml +++ b/.github/workflows/testing.yml @@ -19,12 +19,12 @@ jobs: python: [ "3.12", "3.13", "3.14" ] steps: - name: Check out code - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Poetry run: pipx install poetry - name: Set up Python ${{ matrix.python }} id: python - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: ${{ matrix.python }} cache: "poetry" diff --git a/.github/workflows/typing.yml b/.github/workflows/typing.yml index 5239067..36d231a 100644 --- a/.github/workflows/typing.yml +++ b/.github/workflows/typing.yml @@ -16,12 +16,12 @@ jobs: runs-on: ubuntu-latest steps: - name: Check out code - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Poetry run: pipx install poetry - name: Set up Python id: python - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: python-version: ${{ env.DEFAULT_PYTHON }} cache: "poetry" From 0958dba07b20675a3b8f37fb974bd178f0152931 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Joris=20Pelgr=C3=B6m?= Date: Mon, 28 Sep 2026 11:44:56 +0200 Subject: [PATCH 3/4] Apply various zizmor suggestions --- .github/workflows/linting.yml | 4 ++++ .github/workflows/release.yml | 6 +++++- .github/workflows/testing.yml | 4 ++++ .github/workflows/typing.yml | 4 ++++ 4 files changed, 17 insertions(+), 1 deletion(-) diff --git a/.github/workflows/linting.yml b/.github/workflows/linting.yml index 0a691aa..489e987 100644 --- a/.github/workflows/linting.yml +++ b/.github/workflows/linting.yml @@ -8,6 +8,8 @@ on: pull_request: workflow_dispatch: +permissions: {} + env: DEFAULT_PYTHON: "3.14" @@ -17,6 +19,8 @@ jobs: steps: - name: Check out code uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Set up Poetry run: pipx install poetry - name: Set up Python diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index eed8bec..7865b25 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -15,6 +15,8 @@ jobs: steps: - name: Check out code uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false - name: Set up Poetry run: pipx install poetry - name: Set up Python @@ -26,8 +28,10 @@ jobs: - name: Install dependencies run: poetry install --no-interaction - name: Set package version + env: + TAG_NAME: ${{ github.event.release.tag_name }} run: | - version="${{ github.event.release.tag_name }}" + version="${TAG_NAME}" version="${version,,}" version="${version#v}" poetry version --no-interaction "${version}" diff --git a/.github/workflows/testing.yml b/.github/workflows/testing.yml index 890bc2b..1138758 100644 --- a/.github/workflows/testing.yml +++ b/.github/workflows/testing.yml @@ -8,6 +8,8 @@ on: pull_request: workflow_dispatch: +permissions: {} + env: DEFAULT_PYTHON: "3.14" @@ -20,6 +22,8 @@ jobs: steps: - name: Check out code uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Set up Poetry run: pipx install poetry - name: Set up Python ${{ matrix.python }} diff --git a/.github/workflows/typing.yml b/.github/workflows/typing.yml index 36d231a..202518f 100644 --- a/.github/workflows/typing.yml +++ b/.github/workflows/typing.yml @@ -8,6 +8,8 @@ on: pull_request: workflow_dispatch: +permissions: {} + env: DEFAULT_PYTHON: "3.14" @@ -17,6 +19,8 @@ jobs: steps: - name: Check out code uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Set up Poetry run: pipx install poetry - name: Set up Python From beb9f2f6e564fbae90fd3378dbaa3636234c415f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Joris=20Pelgr=C3=B6m?= Date: Mon, 28 Sep 2026 11:58:59 +0200 Subject: [PATCH 4/4] One more zizmor suggestion --- .github/workflows/release.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 7865b25..1772086 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -6,6 +6,8 @@ on: types: - published +permissions: {} + env: DEFAULT_PYTHON: "3.14"