sec: pin SHA commits in workflows

Author: narenaryan

.github/workflows/release.yml

@@ -17,10 +17,10 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
 
       - name: Set up Python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # v4
         with:
           python-version: '3.10'
 

.github/workflows/security.yml

@@ -14,10 +14,10 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
 
       - name: Set up Python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # v4
         with:
           python-version: "3.10"
 

.github/workflows/test.yml

@@ -14,10 +14,10 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
 
       - name: Set up Python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # v4
         with:
           python-version: "3.10"
 

src/whispr/logging.py

@@ -24,17 +24,29 @@ def _default_log_path() -> str:
 
 def _resolve_log_path() -> str:
     log_path = _default_log_path()
-    log_dir = Path(log_path).parent
-    try:
-        log_dir.mkdir(parents=True, exist_ok=True)
+    if _ensure_writable_log_path(log_path):
         return log_path
+
+    if platform.system() == "Darwin":
+        fallback_dir = Path.home() / "Library" / "Logs" / "whispr"
+    else:
+        fallback_dir = Path.home() / ".local" / "state" / "whispr"
+    fallback_path = str(fallback_dir / "access.log")
+    if _ensure_writable_log_path(fallback_path):
+        return fallback_path
+
+    return str(Path.cwd() / "whispr_access.log")
+
+
+def _ensure_writable_log_path(log_path: str) -> bool:
+    log_file = Path(log_path)
+    try:
+        log_file.parent.mkdir(parents=True, exist_ok=True)
+        with log_file.open("a", encoding="utf-8"):
+            pass
+        return True
     except OSError:
-        if platform.system() == "Darwin":
-            fallback_dir = Path.home() / "Library" / "Logs" / "whispr"
-        else:
-            fallback_dir = Path.home() / ".local" / "state" / "whispr"
-        fallback_dir.mkdir(parents=True, exist_ok=True)
-        return str(fallback_dir / "access.log")
+        return False
 
 
 def setup_structlog() -> structlog.BoundLogger: