Skip to content

Commit 90a1d56

Browse files
merschformannmerschformann
authored
Merge pull request #132 from nextmv-io/merschformann/addressing-zizmor
Addresses zizmor issues
2 parents 3631525 + 3c71a51 commit 90a1d56

8 files changed

Lines changed: 59 additions & 36 deletions

File tree

‎.github/workflows/auto-benchmark.yml‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -17,15 +17,17 @@ jobs:
1717
runs-on: ubuntu-latest
1818
steps:
1919
- name: git clone
20-
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
20+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
21+
with:
22+
persist-credentials: false
2123

2224
- name: set up Go
23-
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
25+
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
2426
with:
2527
go-version: ${{ env.GO_VERSION }}
2628

2729
- name: set up Python ${{ env.PYTHON_VERSION }}
28-
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
30+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
2931
with:
3032
python-version: ${{ env.PYTHON_VERSION }}
3133

‎.github/workflows/go-test-lint.yml‎

Lines changed: 9 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -16,23 +16,27 @@ jobs:
1616
runs-on: ubuntu-latest
1717
steps:
1818
- name: git clone
19-
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
19+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
20+
with:
21+
persist-credentials: false
2022
- name: set up go
21-
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
23+
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
2224
with:
2325
go-version: ${{ env.GO_VERSION }}
2426
- name: golangci-lint
25-
uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9.2.0
27+
uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9.2.0
2628
with:
2729
version: v2.9.0
2830
# Job for running tests
2931
go-test:
3032
runs-on: ubuntu-latest
3133
steps:
3234
- name: git clone
33-
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
35+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
36+
with:
37+
persist-credentials: false
3438
- name: set up go
35-
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
39+
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
3640
with:
3741
go-version: ${{ env.GO_VERSION }}
3842
- name: go test (exclude golden file tests from Python package)

‎.github/workflows/header.yml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,10 +14,12 @@ jobs:
1414
language: ["go", "python"]
1515
steps:
1616
- name: git clone
17-
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
17+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
18+
with:
19+
persist-credentials: false
1820

1921
- name: set up Python
20-
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
22+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
2123
with:
2224
python-version: "3.12"
2325

‎.github/workflows/json-lint.yml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,10 +10,12 @@ jobs:
1010
runs-on: ubuntu-latest
1111
steps:
1212
- name: git clone
13-
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
13+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
14+
with:
15+
persist-credentials: false
1416

1517
- name: set up node
16-
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
18+
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
1719
with:
1820
node-version: 18.8
1921

‎.github/workflows/markdown-lint.yml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,8 +10,10 @@ jobs:
1010
runs-on: ubuntu-latest
1111
steps:
1212
- name: git clone
13-
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
13+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
14+
with:
15+
persist-credentials: false
1416

15-
- uses: DavidAnson/markdownlint-cli2-action@6b51ade7a9e4a75a7ad929842dd298a3804ebe8b # v23.1.0
17+
- uses: DavidAnson/markdownlint-cli2-action@6b51ade7a9e4a75a7ad929842dd298a3804ebe8b # v23.1.0
1618
with:
1719
globs: "**/*.md"

‎.github/workflows/python-lint.yml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,10 +10,12 @@ jobs:
1010
runs-on: ubuntu-latest
1111
steps:
1212
- name: git clone
13-
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
13+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
14+
with:
15+
persist-credentials: false
1416

1517
- name: set up Python
16-
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
18+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
1719
with:
1820
python-version: 3.13
1921

‎.github/workflows/python-test.yml‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -27,10 +27,12 @@ jobs:
2727
]
2828
steps:
2929
- name: git clone
30-
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
30+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
31+
with:
32+
persist-credentials: false
3133

3234
- name: set up Python ${{ matrix.python-version }}
33-
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
35+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
3436
with:
3537
python-version: ${{ matrix.python-version }}
3638

@@ -49,7 +51,7 @@ jobs:
4951
# Source:https://github.com/nextmv-io/nextroute/actions/runs/11414952328/job/31764458969?pr=65
5052
- name: set up Go
5153
if: ${{ matrix.platform != 'windows-latest' }}
52-
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
54+
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
5355
with:
5456
go-version: ${{ env.GO_VERSION }}
5557

‎.github/workflows/release.yml‎

Lines changed: 24 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -53,16 +53,18 @@ jobs:
5353
fi
5454
5555
- name: set up Python
56-
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
56+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
5757
with:
5858
python-version: ${{ env.PYTHON_VERSION }}
5959

6060
- name: set up go
61-
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
61+
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
6262
with:
6363
go-version: ${{ env.GO_VERSION }}
6464

6565
- name: configure git with the bot credentials
66+
env:
67+
REF_NAME: ${{ github.ref_name }}
6668
run: |
6769
mkdir -p ~/.ssh
6870
ssh-keyscan github.com >> ~/.ssh/known_hosts
@@ -80,7 +82,7 @@ jobs:
8082
git clone git@github.com:nextmv-io/nextroute.git
8183
8284
cd nextroute
83-
git checkout ${{ github.ref_name }}
85+
git checkout $REF_NAME
8486
8587
git rev-parse --short HEAD
8688
@@ -131,17 +133,18 @@ jobs:
131133
needs: bump-version
132134
runs-on: ubuntu-latest
133135
steps:
134-
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
136+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
135137
with:
136138
ref: ${{ github.ref_name }}
139+
persist-credentials: false
137140

138141
- name: Build sdist
139142
run: pipx run build --sdist
140143

141144
- name: Check metadata
142145
run: pipx run twine check dist/*
143146

144-
- uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
147+
- uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
145148
with:
146149
name: wheels-artifacts-sdist
147150
path: dist/*.tar.gz
@@ -167,29 +170,30 @@ jobs:
167170

168171
steps:
169172
- name: git clone ${{ github.ref_name }}
170-
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
173+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
171174
with:
172175
ref: ${{ github.ref_name }}
176+
persist-credentials: false
173177

174178
- name: set up Python
175-
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
179+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
176180
with:
177181
python-version: ${{ env.PYTHON_VERSION }}
178182

179183
- name: set up go
180-
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
184+
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
181185
with:
182186
go-version: ${{ env.GO_VERSION }}
183187

184188
- name: Build wheels
185189
if: matrix.platform != 'macos-arm64'
186-
uses: pypa/cibuildwheel@8d2b08b68458a16aeb24b64e68a09ab1c8e82084 # v3.4.1
190+
uses: pypa/cibuildwheel@8d2b08b68458a16aeb24b64e68a09ab1c8e82084 # v3.4.1
187191
env:
188192
MACOSX_DEPLOYMENT_TARGET: 13.0
189193

190194
- name: Build wheels
191195
if: matrix.platform == 'macos-arm64'
192-
uses: pypa/cibuildwheel@8d2b08b68458a16aeb24b64e68a09ab1c8e82084 # v3.4.1
196+
uses: pypa/cibuildwheel@8d2b08b68458a16aeb24b64e68a09ab1c8e82084 # v3.4.1
193197
env:
194198
# TODO: default wheel repair does not recognize the arm64 wheel.
195199
# This seems like a bug in delocate-wheel, which is the tool used by cibuildwheel,
@@ -203,7 +207,7 @@ jobs:
203207
shell: bash
204208

205209
- name: Upload wheels
206-
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
210+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
207211
with:
208212
name: wheels-artifacts-${{ matrix.platform }}
209213
path: wheelhouse/*.whl
@@ -225,25 +229,25 @@ jobs:
225229
contents: read
226230
id-token: write # This is required for trusted publishing to PyPI
227231
steps:
228-
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
232+
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
229233
with:
230234
merge-multiple: true
231235
path: dist
232236

233237
- name: Print directory tree for reference
234-
uses: jaywcjlove/github-action-folder-tree@e0a53e98a23389b0019777ed2eb9e66e88817b2b # v1.3.0
238+
uses: jaywcjlove/github-action-folder-tree@e0a53e98a23389b0019777ed2eb9e66e88817b2b # v1.3.0
235239
with:
236240
path: ./
237241

238242
- name: Publish package distributions to PyPI
239243
if: ${{ matrix.target-env == 'pypi' }}
240-
uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
244+
uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
241245
with:
242246
packages-dir: ./dist
243247

244248
- name: Publish package distributions to TestPyPI
245249
if: ${{ matrix.target-env == 'testpypi' }}
246-
uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
250+
uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
247251
with:
248252
repository-url: https://test.pypi.org/legacy/
249253
packages-dir: ./dist
@@ -254,6 +258,9 @@ jobs:
254258
if: ${{ needs.release.result == 'success' && inputs.IS_PRE_RELEASE == false }}
255259
steps:
256260
- name: notify slack
261+
env:
262+
VERSION: ${{ inputs.VERSION }}
263+
SLACK_URL: ${{ secrets.SLACK_URL_MISSION_CONTROL }}
257264
run: |
258-
export DATA="{\"text\":\"Release notification - nextroute ${{ inputs.VERSION }} (see <https://github.com/nextmv-io/nextroute/releases/${{ inputs.VERSION }}|release notes> / <https://pypi.org/project/nextroute|PyPI>)\"}"
259-
curl -X POST -H 'Content-type: application/json' --data "$DATA" ${{ secrets.SLACK_URL_MISSION_CONTROL }}
265+
export DATA="{\"text\":\"Release notification - nextroute $VERSION (see <https://github.com/nextmv-io/nextroute/releases/$VERSION|release notes> / <https://pypi.org/project/nextroute|PyPI>)\"}"
266+
curl -X POST -H 'Content-type: application/json' --data "$DATA" $SLACK_URL

0 commit comments

Comments
 (0)