Merge pull request #286 from ocefpaf/deploy_only_on_releases

Deploy only on releases

Author: ocefpaf

.github/workflows/deploy-docs.yml

@@ -1,32 +1,41 @@
 name: Build and Deploy docs
 
+# no permissions by default
+permissions: {}
+
 on:
   pull_request:
   push:
-    branches: [main]
-  workflow_dispatch:
+    branches:
+      - main
+  release:
+    types:
+      - published
 
 jobs:
   build-docs:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
 
     steps:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
 
       - name: Set up Python
         uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: "3.x"
 
-
       - name: Build documentation
         run: >
           set -e
           && pip install jupyter-book
           && jupyter-book build jupyterbook
 
       - name: GitHub Pages action
-        if: github.ref == 'refs/heads/main'
+        if: success() && github.event_name == 'release'
         uses: peaceiris/actions-gh-pages@4f9cc6602d3f66b9c108549d475ec49e8ef4d45e # v4.0.0
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/docs-linkchecker.yml

@@ -1,5 +1,8 @@
 name: Check linkrot
 
+# no permissions by default
+permissions: {}
+
 on:
   pull_request:
   push:
@@ -11,13 +14,15 @@ jobs:
 
     steps:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          fetch-depth: 0
+          persist-credentials: false
 
       - name: Set up Python
         uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: "3.x"
 
-
       - name: Linkcheck
         run: >
           set -e

.github/workflows/relock.yml

@@ -1,5 +1,8 @@
 name: relock
 
+# no permissions by default
+permissions: {}
+
 on:
   schedule:
     - cron: '0 0 1 * *'

.github/workflows/test-env.yml

@@ -1,5 +1,8 @@
 name: Test Environment
 
+# no permissions by default
+permissions: {}
+
 on:
   pull_request:
 
@@ -17,6 +20,9 @@ jobs:
 
     steps:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          fetch-depth: 0
+          persist-credentials: false
 
       - name: Setup Micromamba
         uses: mamba-org/setup-micromamba@7f29b8b80078b1b601dfa018b0f7425c587c63bb # v2.0.6

.github/workflows/test-install-instructions.yml

@@ -1,5 +1,8 @@
 name: Test Install instructions Section
 
+# no permissions by default
+permissions: {}
+
 on:
   pull_request:
 

.github/workflows/test_data_access_notebooks.yml

@@ -1,5 +1,8 @@
 name: Test Data Access Notebook
 
+# no permissions by default
+permissions: {}
+
 on:
   pull_request:
 
@@ -9,6 +12,9 @@ jobs:
 
     steps:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          fetch-depth: 0
+          persist-credentials: false
 
       - name: Setup Micromamba
         uses: mamba-org/setup-micromamba@7f29b8b80078b1b601dfa018b0f7425c587c63bb # v2.0.6

.github/workflows/test_data_analysis_and_visualization_notebooks.yml

@@ -1,5 +1,8 @@
 name: Test Data Analysis And Visualization Notebooks
 
+# no permissions by default
+permissions: {}
+
 on:
   pull_request:
 
@@ -9,6 +12,9 @@ jobs:
 
     steps:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          fetch-depth: 0
+          persist-credentials: false
 
       - name: Setup Micromamba
         uses: mamba-org/setup-micromamba@7f29b8b80078b1b601dfa018b0f7425c587c63bb # v2.0.6

.github/workflows/test_data_management_notebooks.yml

@@ -1,5 +1,8 @@
 name: Test Data Management Notebooks
 
+# no permissions by default
+permissions: {}
+
 on:
   pull_request:
 
@@ -9,6 +12,9 @@ jobs:
 
     steps:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          fetch-depth: 0
+          persist-credentials: false
 
       - name: Setup Micromamba
         uses: mamba-org/setup-micromamba@7f29b8b80078b1b601dfa018b0f7425c587c63bb # v2.0.6

.pre-commit-config.yaml

@@ -54,6 +54,11 @@ repos:
     hooks:
       - id: nb-strip-paths
 
+  - repo: https://github.com/woodruffw/zizmor-pre-commit
+    rev: v1.12.1
+    hooks:
+      - id: zizmor
+
 ci:
   autofix_commit_msg: |
     [pre-commit.ci] auto fixes from pre-commit.com hooks