Skip to content

Commit b967516

Browse files
rgommersrgommers
committed
CI: harden workflows
1 parent 2420876 commit b967516

5 files changed

Lines changed: 51 additions & 34 deletions

File tree

‎.github/dependabot.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,3 +11,5 @@ updates:
1111
- "*" # Group all Actions updates into a single larger pull request
1212
schedule:
1313
interval: monthly
14+
cooldown:
15+
default-days: 7

‎.github/workflows/emscripten.yml‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,9 @@ jobs:
4141
if: github.repository == 'PyWavelets/pywt'
4242
steps:
4343
- name: Check out repository
44-
uses: actions/checkout@v7.0.1
44+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
45+
with:
46+
persist-credentials: false
4547

4648
- name: Build and test PyWavelets
4749
uses: pypa/cibuildwheel@4726cd35bb13f7bde50cf2761f2499ac7b3aa32c # v4.1.1
@@ -54,11 +56,11 @@ jobs:
5456
# WARNING: this job will overwrite existing wheels.
5557
- name: Push wheels to Anaconda PyPI index
5658
if: >-
57-
(github.repository == 'PyWavelets/pywt') &&
58-
(github.event_name == 'push' && github.ref == 'refs/heads/main') ||
59+
github.repository == 'PyWavelets/pywt' &&
60+
((github.event_name == 'push' && github.ref == 'refs/heads/main') ||
5961
(github.event_name == 'workflow_dispatch' && github.event.inputs.push_wheels == 'true') ||
60-
(github.event_name == 'schedule')
61-
uses: scientific-python/upload-nightly-action@e76cfec8a4611fd02808a801b0ff5a7d7c1b2d99 # v0.6.4
62+
github.event_name == 'schedule')
63+
uses: scientific-python/upload-nightly-action@e76cfec8a4611fd02808a801b0ff5a7d7c1b2d99 # 0.6.4
6264
with:
6365
artifacts_path: wheelhouse/
6466
anaconda_nightly_upload_token: ${{ secrets.ANACONDA_ORG_UPLOAD_TOKEN }}

‎.github/workflows/lint.yml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,10 +24,12 @@ jobs:
2424
python-version: ["3.13"]
2525

2626
steps:
27-
- uses: actions/checkout@v7.0.1
27+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
28+
with:
29+
persist-credentials: false
2830

2931
- name: Set up Python ${{ matrix.python-version }}
30-
uses: actions/setup-python@v7
32+
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
3133
with:
3234
python-version: ${{ matrix.python-version }}
3335

‎.github/workflows/tests.yml‎

Lines changed: 13 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -70,8 +70,10 @@ jobs:
7070
python-version: "3.14"
7171
OPTIONS_NAME: "editable-install"
7272
steps:
73-
- uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v4.1.2
74-
- uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v5.5.0
73+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
74+
with:
75+
persist-credentials: false
76+
- uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
7577
with:
7678
python-version: ${{ matrix.python-version}}
7779
allow-prereleases: true
@@ -158,8 +160,10 @@ jobs:
158160
matrix:
159161
python-version: ["3.14t", "3.15t-dev"]
160162
steps:
161-
- uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v4.1.2
162-
- uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v5.5.0
163+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
164+
with:
165+
persist-credentials: false
166+
- uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
163167
with:
164168
python-version: ${{ matrix.python-version}}
165169

@@ -197,8 +201,10 @@ jobs:
197201
OPTIONS_NAME: "pre-releases"
198202

199203
steps:
200-
- uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v4.1.2
201-
- uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v5.5.0
204+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
205+
with:
206+
persist-credentials: false
207+
- uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
202208
with:
203209
python-version: ${{ matrix.python-version}}
204210
allow-prereleases: true
@@ -276,7 +282,7 @@ jobs:
276282
# the test run itself is configured in the "Test" step below.
277283
ASAN_OPTIONS: detect_leaks=0
278284
steps:
279-
- uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v4.2.2
285+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
280286
with:
281287
submodules: recursive
282288
fetch-tags: true

‎.github/workflows/wheel_tests_and_release.yml‎

Lines changed: 25 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -50,10 +50,11 @@ jobs:
5050
cibw_python: ["cp312", "cp313", "cp314", "cp314t", "cp315", "cp315t"]
5151
cibw_arch: ["x86_64"]
5252
steps:
53-
- uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v4.1.2
53+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
5454
with:
5555
fetch-depth: 0
56-
- uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v5.5.0
56+
persist-credentials: false
57+
- uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
5758
name: Install Python
5859
with:
5960
python-version: "3.12"
@@ -81,10 +82,11 @@ jobs:
8182
cibw_python: ["cp312", "cp313", "cp314", "cp314t", "cp315", "cp315t"]
8283
cibw_arch: ["aarch64"]
8384
steps:
84-
- uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v4.1.2
85+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
8586
with:
8687
fetch-depth: 0
87-
- uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v5.5.0
88+
persist-credentials: false
89+
- uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
8890
name: Install Python
8991
with:
9092
python-version: "3.12"
@@ -116,11 +118,12 @@ jobs:
116118
- os: macos-15-intel
117119
cibw_arch: "arm64"
118120
steps:
119-
- uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v4.1.2
121+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
120122
with:
121123
fetch-depth: 0
124+
persist-credentials: false
122125

123-
- uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v5.5.0
126+
- uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
124127
name: Install Python
125128
with:
126129
python-version: "3.12"
@@ -166,30 +169,31 @@ jobs:
166169
- os: windows-11-arm
167170
cibw_arch: AMD64
168171
steps:
169-
- uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v4.1.2
172+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
170173
with:
171174
fetch-depth: 0
175+
persist-credentials: false
172176

173-
- uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v5.5.0
177+
- uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
174178
name: Install Python
175179
with:
176180
python-version: "3.12"
177181

178182
- name: Setup MSVC (32-bit)
179183
if: matrix.cibw_arch == 'x86'
180-
uses: bus1/cabuild/action/msdevshell@e22aba57d6e74891d059d66501b6b5aed8123c4d # v1
184+
uses: bus1/cabuild/action/msdevshell@06ea2833eef61e9b0d0ce0d728416e617e4fb1fe # v1
181185
with:
182186
architecture: x86
183187

184188
- name: Setup MSVC (64-bit)
185189
if: matrix.cibw_arch == 'AMD64'
186-
uses: bus1/cabuild/action/msdevshell@e22aba57d6e74891d059d66501b6b5aed8123c4d # v1
190+
uses: bus1/cabuild/action/msdevshell@06ea2833eef61e9b0d0ce0d728416e617e4fb1fe # v1
187191
with:
188192
architecture: x64
189193

190194
- name: Setup MSVC (ARM64)
191195
if: matrix.cibw_arch == 'ARM64'
192-
uses: bus1/cabuild/action/msdevshell@e22aba57d6e74891d059d66501b6b5aed8123c4d # v1
196+
uses: bus1/cabuild/action/msdevshell@06ea2833eef61e9b0d0ce0d728416e617e4fb1fe # v1
193197
with:
194198
architecture: arm64
195199

@@ -215,7 +219,7 @@ jobs:
215219
with:
216220
persist-credentials: false
217221

218-
- uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v5.5.0
222+
- uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
219223
name: Install Python
220224
with:
221225
python-version: "3.12"
@@ -321,11 +325,11 @@ jobs:
321325
print-hash: true
322326
attestations: true
323327

324-
- name: Github release
325-
uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
328+
- name: GitHub release
329+
run: gh release create "${GITHUB_REF_NAME}" --verify-tag --notes ""
326330
env:
327-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
328-
GITHUB_REPOSITORY: ${{ github.repository }}
331+
GH_TOKEN: ${{ github.token }}
332+
GH_REPO: ${{ github.repository }}
329333

330334
deploy_anaconda:
331335
name: Release (Anaconda)
@@ -339,14 +343,15 @@ jobs:
339343
# Run only on pushes to the main branch, on schedule, or when triggered manually
340344
if: >-
341345
github.repository == 'PyWavelets/pywt' &&
342-
(github.event_name == 'push' && github.ref == 'refs/heads/main') ||
346+
((github.event_name == 'push' && github.ref == 'refs/heads/main') ||
343347
(github.event_name == 'workflow_dispatch' && github.event.inputs.push_wheels == 'true') ||
344-
(github.event_name == 'schedule')
348+
github.event_name == 'schedule')
345349
runs-on: ubuntu-latest
346350
steps:
347-
- uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v4.1.2
351+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
348352
with:
349353
fetch-depth: 0
354+
persist-credentials: false
350355

351356
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
352357
id: download
@@ -356,7 +361,7 @@ jobs:
356361
merge-multiple: true
357362

358363
- name: Push to Anaconda PyPI index
359-
uses: scientific-python/upload-nightly-action@e76cfec8a4611fd02808a801b0ff5a7d7c1b2d99 # v0.6.4
364+
uses: scientific-python/upload-nightly-action@e76cfec8a4611fd02808a801b0ff5a7d7c1b2d99 # 0.6.4
360365
with:
361366
artifacts_path: dist/
362367
anaconda_nightly_upload_token: ${{ secrets.ANACONDA_ORG_UPLOAD_TOKEN }}

0 commit comments

Comments
 (0)