Skip to content

Commit a9740e0

Browse files
JulianJulian
committed
zizmor fixes and try building more wheels.
1 parent b84713f commit a9740e0

File tree

3 files changed

+149
-50
lines changed

3 files changed

+149
-50
lines changed

‎.github/workflows/CI.yml

Lines changed: 141 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -5,13 +5,15 @@ on:
55
branches-ignore:
66
- "wip*"
77
tags:
8-
- "v*"
8+
- "v[0-9].*"
99
pull_request:
1010
schedule:
1111
# Daily at 6:33
1212
- cron: "33 6 * * *"
1313
workflow_dispatch:
1414

15+
permissions: {}
16+
1517
jobs:
1618
list:
1719
runs-on: ubuntu-latest
@@ -21,12 +23,13 @@ jobs:
2123
- uses: actions/checkout@v4
2224
with:
2325
persist-credentials: false
24-
- name: Set up nox
25-
uses: wntrblm/[email protected]
26+
- uses: astral-sh/setup-uv@bd01e18f51369d5a26f1651c3cb451d3417e3bba
27+
with:
28+
enable-cache: ${{ github.ref_type != 'tag' }} # zizmor: ignore[cache-poisoning]
2629
- id: noxenvs-matrix
2730
run: |
2831
echo >>$GITHUB_OUTPUT noxenvs=$(
29-
nox --list-sessions --json | jq '[.[].session]'
32+
uvx nox --list-sessions --json | jq '[.[].session]'
3033
)
3134
3235
test:
@@ -57,26 +60,29 @@ jobs:
5760
3.11
5861
3.12
5962
3.13
63+
3.13t
6064
3.14
65+
3.14t
6166
pypy3.9
6267
pypy3.10
6368
pypy3.11
6469
allow-prereleases: true
6570

66-
- name: Set up uv
67-
uses: hynek/setup-cached-uv@v2
68-
- name: Set up nox
69-
uses: wntrblm/[email protected]
70-
71+
- uses: astral-sh/setup-uv@bd01e18f51369d5a26f1651c3cb451d3417e3bba
72+
with:
73+
enable-cache: ${{ github.ref_type != 'tag' }} # zizmor: ignore[cache-poisoning]
7174
- name: Run nox
72-
run: nox -s "${{ matrix.noxenv }}"
75+
run: uvx nox -s "${{ matrix.noxenv }}" -- ${{ matrix.posargs }} # zizmor: ignore[template-injection]
7376

7477
manylinux:
7578
needs: test
7679
runs-on: ubuntu-latest
80+
7781
strategy:
82+
fail-fast: false
7883
matrix:
7984
target: [x86_64, x86, aarch64, armv7, s390x, ppc64le]
85+
8086
steps:
8187
- uses: actions/checkout@v4
8288
with:
@@ -89,17 +95,19 @@ jobs:
8995
3.11
9096
3.12
9197
3.13
98+
3.13t
9299
3.14
100+
3.14t
93101
pypy3.9
94102
pypy3.10
95103
pypy3.11
96104
allow-prereleases: true
97105
- name: Build wheels
98-
uses: PyO3/maturin-action@v1
106+
uses: PyO3/maturin-action@e10f6c464b90acceb5f640d31beda6d586ba7b4a # v1.49.3
99107
with:
100108
target: ${{ matrix.target }}
101-
args: --release --out dist --interpreter '3.9 3.10 3.11 3.12 3.13 3.14 pypy3.9 pypy3.10 pypy3.11'
102-
sccache: "true"
109+
args: --release --out dist --interpreter '3.9 3.10 3.11 3.12 3.13 3.13t 3.14 3.14t pypy3.9 pypy3.10 pypy3.11'
110+
sccache: ${{ github.ref_type != 'tag' }} # zizmor: ignore[cache-poisoning]
103111
manylinux: auto
104112
- name: Upload wheels
105113
uses: actions/upload-artifact@v4
@@ -110,12 +118,15 @@ jobs:
110118
musllinux:
111119
needs: test
112120
runs-on: ubuntu-latest
121+
113122
strategy:
123+
fail-fast: false
114124
matrix:
115125
target:
116126
- aarch64-unknown-linux-musl
117127
- i686-unknown-linux-musl
118128
- x86_64-unknown-linux-musl
129+
119130
steps:
120131
- uses: actions/checkout@v4
121132
with:
@@ -128,18 +139,20 @@ jobs:
128139
3.11
129140
3.12
130141
3.13
142+
3.13t
131143
3.14
144+
3.14t
132145
pypy3.9
133146
pypy3.10
134147
pypy3.11
135148
allow-prereleases: true
136149
- name: Build wheels
137-
uses: PyO3/maturin-action@v1
150+
uses: PyO3/maturin-action@e10f6c464b90acceb5f640d31beda6d586ba7b4a # v1.49.3
138151
with:
139152
target: ${{ matrix.target }}
140-
args: --release --out dist --interpreter '3.9 3.10 3.11 3.12 3.13 3.14 pypy3.9 pypy3.10 pypy3.11'
153+
args: --release --out dist --interpreter '3.9 3.10 3.11 3.12 3.13 3.13t 3.14 3.14t pypy3.9 pypy3.10 pypy3.11'
141154
manylinux: musllinux_1_2
142-
sccache: "true"
155+
sccache: ${{ github.ref_type != 'tag' }} # zizmor: ignore[cache-poisoning]
143156
- name: Upload wheels
144157
uses: actions/upload-artifact@v4
145158
with:
@@ -149,9 +162,12 @@ jobs:
149162
windows:
150163
needs: test
151164
runs-on: windows-latest
165+
152166
strategy:
167+
fail-fast: false
153168
matrix:
154169
target: [x64, x86] # x86 is not supported by pypy
170+
155171
steps:
156172
- uses: actions/checkout@v4
157173
with:
@@ -171,23 +187,118 @@ jobs:
171187
allow-prereleases: true
172188
architecture: ${{ matrix.target }}
173189
- name: Build wheels
174-
uses: PyO3/maturin-action@v1
190+
uses: PyO3/maturin-action@e10f6c464b90acceb5f640d31beda6d586ba7b4a # v1.49.3
175191
with:
176192
target: ${{ matrix.target }}
177-
args: --release --out dist --interpreter '3.9 3.10 3.11 3.12 3.13 3.14' --interpreter ${{ matrix.target == 'x64' && 'pypy3.9 pypy3.10 pypy3.11' || '' }}
178-
sccache: "true"
193+
args: --release --out dist --interpreter '3.9 3.10 3.11 3.12 3.13 3.14' --interpreter ${{ matrix.target == 'x64' && 'pypy3.9 pypy3.10' || '' }}
194+
sccache: ${{ github.ref_type != 'tag' }} # zizmor: ignore[cache-poisoning]
179195
- name: Upload wheels
180196
uses: actions/upload-artifact@v4
181197
with:
182198
name: dist-${{ github.job }}-${{ matrix.target }}
183199
path: dist
184200

201+
windows-arm:
202+
needs: test
203+
runs-on: windows-11-arm
204+
205+
strategy:
206+
fail-fast: false
207+
matrix:
208+
target:
209+
- aarch64-pc-windows-msvc
210+
211+
steps:
212+
- uses: actions/checkout@v4
213+
with:
214+
persist-credentials: false
215+
# Install each python version seperatly so that the paths can be passed to maturin. (otherwise finds pre-installed x64 versions)
216+
- uses: actions/setup-python@v5
217+
id: cp311
218+
with:
219+
python-version: 3.11
220+
allow-prereleases: true
221+
architecture: arm64
222+
- uses: actions/setup-python@v5
223+
id: cp312
224+
with:
225+
python-version: 3.12
226+
allow-prereleases: true
227+
architecture: arm64
228+
- uses: actions/setup-python@v5
229+
id: cp313
230+
with:
231+
python-version: 3.13
232+
allow-prereleases: true
233+
architecture: arm64
234+
- uses: actions/setup-python@v5
235+
id: cp314
236+
with:
237+
python-version: 3.14
238+
allow-prereleases: true
239+
architecture: arm64
240+
# rust toolchain is not currently installed on windopws arm64 images: https://github.com/actions/partner-runner-images/issues/77
241+
- name: Setup rust
242+
id: setup-rust
243+
run: |
244+
Invoke-WebRequest https://static.rust-lang.org/rustup/dist/aarch64-pc-windows-msvc/rustup-init.exe -OutFile .\rustup-init.exe
245+
.\rustup-init.exe -y
246+
Add-Content $env:GITHUB_PATH "$env:USERPROFILE\.cargo\bin"
247+
- name: Build wheels
248+
uses: PyO3/maturin-action@e10f6c464b90acceb5f640d31beda6d586ba7b4a # v1.49.3
249+
with:
250+
target: ${{ matrix.target }}
251+
args: --release --out dist --interpreter ${{ steps.cp311.outputs.python-path }} ${{ steps.cp312.outputs.python-path }} ${{ steps.cp313.outputs.python-path }} ${{ steps.cp314.outputs.python-path }}
252+
sccache: ${{ github.ref_type != 'tag' }} # zizmor: ignore[cache-poisoning]
253+
- name: Upload wheels
254+
uses: actions/upload-artifact@v4
255+
with:
256+
name: dist-${{ github.job }}-${{ matrix.target }}
257+
path: dist
258+
259+
# free-threaded and normal builds share a site-packages folder on Windows so
260+
# we must build free-threaded separately
261+
windows-free-threaded:
262+
needs: test
263+
runs-on: windows-latest
264+
265+
strategy:
266+
fail-fast: false
267+
matrix:
268+
target: [x64, x86] # x86 is not supported by pypy
269+
270+
steps:
271+
- uses: actions/checkout@v4
272+
with:
273+
persist-credentials: false
274+
- uses: actions/setup-python@v5
275+
with:
276+
python-version: |
277+
3.13t
278+
3.14t
279+
allow-prereleases: true
280+
architecture: ${{ matrix.target }}
281+
- name: Build wheels
282+
uses: PyO3/maturin-action@e10f6c464b90acceb5f640d31beda6d586ba7b4a # v1.49.3
283+
with:
284+
target: ${{ matrix.target }}
285+
args: --release --out dist --interpreter '3.13t 3.14t'
286+
sccache: ${{ github.ref_type != 'tag' }} # zizmor: ignore[cache-poisoning]
287+
- name: Upload wheels
288+
uses: actions/upload-artifact@v4
289+
with:
290+
name: dist-${{ github.job }}-${{ matrix.target }}-free-threaded
291+
path: dist
292+
185293
macos:
186294
needs: test
187295
runs-on: macos-latest
296+
188297
strategy:
298+
fail-fast: false
189299
matrix:
190300
target: [x86_64, aarch64]
301+
191302
steps:
192303
- uses: actions/checkout@v4
193304
with:
@@ -200,17 +311,19 @@ jobs:
200311
3.11
201312
3.12
202313
3.13
314+
3.13t
203315
3.14
316+
3.14t
204317
pypy3.9
205318
pypy3.10
206319
pypy3.11
207320
allow-prereleases: true
208321
- name: Build wheels
209-
uses: PyO3/maturin-action@v1
322+
uses: PyO3/maturin-action@e10f6c464b90acceb5f640d31beda6d586ba7b4a # v1.49.3
210323
with:
211324
target: ${{ matrix.target }}
212-
args: --release --out dist --interpreter '3.9 3.10 3.11 3.12 3.13 3.14 pypy3.9 pypy3.10 pypy3.11'
213-
sccache: "true"
325+
args: --release --out dist --interpreter '3.9 3.10 3.11 3.12 3.13 3.13t 3.14 3.14t pypy3.9 pypy3.10 pypy3.11'
326+
sccache: ${{ github.ref_type != 'tag' }} # zizmor: ignore[cache-poisoning]
214327
- name: Upload wheels
215328
uses: actions/upload-artifact@v4
216329
with:
@@ -226,19 +339,9 @@ jobs:
226339
persist-credentials: false
227340
- uses: actions/setup-python@v5
228341
with:
229-
python-version: |
230-
3.9
231-
3.10
232-
3.11
233-
3.12
234-
3.13
235-
3.14
236-
pypy3.9
237-
pypy3.10
238-
pypy3.11
239-
allow-prereleases: true
342+
python-version: 3.13
240343
- name: Build an sdist
241-
uses: PyO3/maturin-action@v1
344+
uses: PyO3/maturin-action@e10f6c464b90acceb5f640d31beda6d586ba7b4a # v1.49.3
242345
with:
243346
command: sdist
244347
args: --out dist
@@ -249,7 +352,8 @@ jobs:
249352
path: dist
250353

251354
release:
252-
needs: [manylinux, musllinux, windows, macos]
355+
needs:
356+
[manylinux, musllinux, windows, windows-arm, windows-free-threaded, macos]
253357
runs-on: ubuntu-latest
254358
if: "startsWith(github.ref, 'refs/tags/')"
255359
environment:
@@ -265,13 +369,13 @@ jobs:
265369
pattern: dist-*
266370
merge-multiple: true
267371
- name: Publish to PyPI
268-
uses: PyO3/maturin-action@v1
372+
uses: PyO3/maturin-action@e10f6c464b90acceb5f640d31beda6d586ba7b4a # v1.49.3
269373
with:
270374
command: upload
271375
args: --non-interactive --skip-existing *
272376
- name: Create a GitHub Release
273377
if: github.event_name == 'push' && startsWith(github.event.ref, 'refs/tags')
274-
uses: softprops/action-gh-release@v2
378+
uses: softprops/action-gh-release@72f2c25fcb47643c292f7107632f7a47c1df5cd8
275379
with:
276380
files: |
277381
*

‎.github/workflows/zizmor.yml

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,8 @@ on:
66
pull_request:
77
branches: ["**"]
88

9+
permissions: {}
10+
911
jobs:
1012
zizmor:
1113
runs-on: ubuntu-latest
@@ -14,21 +16,19 @@ jobs:
1416
security-events: write
1517

1618
steps:
17-
- name: Checkout repository
18-
uses: actions/checkout@v4
19+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
1920
with:
2021
persist-credentials: false
21-
- name: Setup Rust
22-
uses: actions-rust-lang/setup-rust-toolchain@v1
23-
- name: Install zizmor
24-
run: cargo install zizmor
22+
23+
- uses: astral-sh/setup-uv@bd01e18f51369d5a26f1651c3cb451d3417e3bba # v6.3.1
2524
- name: Run zizmor 🌈
26-
run: zizmor --format sarif . > results.sarif
25+
run: uvx zizmor --format=sarif . > results.sarif
26+
2727
env:
2828
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
2929

3030
- name: Upload SARIF file
31-
uses: github/codeql-action/upload-sarif@v3
31+
uses: github/codeql-action/upload-sarif@181d5eefc20863364f96762470ba6f862bdef56b # v3.29.2
3232
with:
3333
sarif_file: results.sarif
3434
category: zizmor

‎.github/zizmor.yml

Lines changed: 0 additions & 5 deletions
This file was deleted.

0 commit comments

Comments
 (0)