Skip to content

Commit 0c041e2

Browse files
joshuadavidthomasjoshuadavidthomas
authored
add zizmor 🌈 workflow (#138)
1 parent 5997d9b commit 0c041e2

File tree

6 files changed

+78
-11
lines changed

6 files changed

+78
-11
lines changed

‎.github/workflows/build.yml‎

Lines changed: 15 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -31,13 +31,15 @@ jobs:
3131
target: ppc64le
3232
steps:
3333
- uses: actions/checkout@v4
34+
with:
35+
persist-credentials: false
3436

3537
- uses: actions/setup-python@v5
3638
with:
3739
python-version: 3.x
3840

3941
- name: Build wheels
40-
uses: PyO3/maturin-action@v1
42+
uses: PyO3/maturin-action@aef21716ff3dcae8a1c301d23ec3e4446972a6e3 # v1.49.1
4143
with:
4244
target: ${{ matrix.platform.target }}
4345
args: --release --out dist --find-interpreter --features extension-module
@@ -65,13 +67,15 @@ jobs:
6567
target: armv7
6668
steps:
6769
- uses: actions/checkout@v4
70+
with:
71+
persist-credentials: false
6872

6973
- uses: actions/setup-python@v5
7074
with:
7175
python-version: 3.x
7276

7377
- name: Build wheels
74-
uses: PyO3/maturin-action@v1
78+
uses: PyO3/maturin-action@aef21716ff3dcae8a1c301d23ec3e4446972a6e3 # v1.49.1
7579
with:
7680
target: ${{ matrix.platform.target }}
7781
args: --release --out dist --find-interpreter --features extension-module
@@ -94,14 +98,16 @@ jobs:
9498
target: x86
9599
steps:
96100
- uses: actions/checkout@v4
101+
with:
102+
persist-credentials: false
97103

98104
- uses: actions/setup-python@v5
99105
with:
100106
python-version: 3.x
101107
architecture: ${{ matrix.platform.target }}
102108

103109
- name: Build wheels
104-
uses: PyO3/maturin-action@v1
110+
uses: PyO3/maturin-action@aef21716ff3dcae8a1c301d23ec3e4446972a6e3 # v1.49.1
105111
with:
106112
target: ${{ matrix.platform.target }}
107113
args: --release --out dist --find-interpreter --features extension-module
@@ -124,13 +130,15 @@ jobs:
124130
target: aarch64
125131
steps:
126132
- uses: actions/checkout@v4
133+
with:
134+
persist-credentials: false
127135

128136
- uses: actions/setup-python@v5
129137
with:
130138
python-version: 3.x
131139

132140
- name: Build wheels
133-
uses: PyO3/maturin-action@v1
141+
uses: PyO3/maturin-action@aef21716ff3dcae8a1c301d23ec3e4446972a6e3 # v1.49.1
134142
with:
135143
target: ${{ matrix.platform.target }}
136144
args: --release --out dist --find-interpreter --features extension-module
@@ -146,9 +154,11 @@ jobs:
146154
runs-on: ubuntu-latest
147155
steps:
148156
- uses: actions/checkout@v4
157+
with:
158+
persist-credentials: false
149159

150160
- name: Build sdist
151-
uses: PyO3/maturin-action@v1
161+
uses: PyO3/maturin-action@aef21716ff3dcae8a1c301d23ec3e4446972a6e3 # v1.49.1
152162
with:
153163
command: sdist
154164
args: --out dist

‎.github/workflows/lint.yml‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,9 +23,11 @@ jobs:
2323
runs-on: ubuntu-24.04
2424
steps:
2525
- uses: actions/checkout@v4
26+
with:
27+
persist-credentials: false
2628

2729
- name: Install uv
28-
uses: astral-sh/setup-uv@v6
30+
uses: astral-sh/setup-uv@6b9c6063abd6010835644d4c2e1bef4cf5cd0fca # v6.0.1
2931
with:
3032
enable-cache: true
3133

‎.github/workflows/release.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,7 @@ jobs:
5050
subject-path: "wheels-*/*"
5151

5252
- name: Publish to PyPI
53-
uses: PyO3/maturin-action@v1
53+
uses: PyO3/maturin-action@aef21716ff3dcae8a1c301d23ec3e4446972a6e3 # v1.49.1
5454
with:
5555
command: upload
5656
args: --non-interactive --skip-existing wheels-*/*

‎.github/workflows/test.yml‎

Lines changed: 19 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -26,22 +26,30 @@ env:
2626
FORCE_COLOR: "1"
2727
PYTHONUNBUFFERED: "1"
2828

29+
permissions: {}
30+
2931
jobs:
3032
generate-matrix:
3133
runs-on: ubuntu-latest
3234
outputs:
3335
matrix: ${{ steps.set-matrix.outputs.matrix }}
36+
permissions:
37+
contents: read
3438
steps:
3539
- uses: actions/checkout@v4
40+
with:
41+
persist-credentials: false
3642

3743
- name: Install uv
38-
uses: astral-sh/setup-uv@v6
44+
uses: astral-sh/setup-uv@6b9c6063abd6010835644d4c2e1bef4cf5cd0fca # v6.0.1
3945
with:
4046
enable-cache: true
4147

4248
- id: set-matrix
49+
env:
50+
OS: ${{ inputs.os }}
4351
run: |
44-
uv run noxfile.py --session gha_matrix -- "${{ inputs.os }}"
52+
uv run noxfile.py --session gha_matrix -- "${OS}"
4553
4654
test:
4755
name: Python ${{ matrix.python-version }}, Django ${{ matrix.django-version }} (${{ matrix.os }})
@@ -50,17 +58,24 @@ jobs:
5058
strategy:
5159
fail-fast: false
5260
matrix: ${{ fromJSON(needs.generate-matrix.outputs.matrix) }}
61+
permissions:
62+
contents: read
5363
steps:
5464
- uses: actions/checkout@v4
65+
with:
66+
persist-credentials: false
5567

5668
- name: Install uv
57-
uses: astral-sh/setup-uv@v6
69+
uses: astral-sh/setup-uv@6b9c6063abd6010835644d4c2e1bef4cf5cd0fca # v6.0.1
5870
with:
5971
enable-cache: true
6072

6173
- name: Run tests
74+
env:
75+
DJANGO_VERSION: ${{ matrix.django-version }}
76+
PYTHON_VERSION: ${{ matrix.python-version }}
6277
run: |
63-
uv run noxfile.py --session "tests(python='${{ matrix.python-version }}', django='${{ matrix.django-version }}')"
78+
uv run noxfile.py --session "tests(python='${PYTHON_VERSION}', django='${DJANGO_VERSION}')"
6479
6580
tests:
6681
runs-on: ubuntu-latest

‎.github/workflows/zizmor.yml‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
name: zizmor 🌈
2+
3+
on:
4+
push:
5+
branches: [main]
6+
pull_request:
7+
branches: ["*"]
8+
9+
jobs:
10+
zizmor:
11+
name: zizmor latest via PyPI
12+
runs-on: ubuntu-latest
13+
permissions:
14+
security-events: write
15+
contents: read # only needed for private repos
16+
actions: read # only needed for private repos
17+
steps:
18+
- uses: actions/checkout@v4
19+
with:
20+
persist-credentials: false
21+
22+
- name: Install uv
23+
uses: astral-sh/setup-uv@c7f87aa956e4c323abf06d5dec078e358f6b4d04
24+
with:
25+
enable-cache: true
26+
27+
- name: Run zizmor 🌈
28+
run: uvx zizmor --format=sarif . > results.sarif
29+
env:
30+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
31+
32+
- name: Upload SARIF file
33+
uses: github/codeql-action/upload-sarif@v3
34+
with:
35+
sarif_file: results.sarif
36+
category: zizmor

‎.pre-commit-config.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,10 @@ repos:
1717
- id: trailing-whitespace
1818
- id: no-commit-to-branch
1919
args: ["--branch", "main"]
20+
- repo: https://github.com/woodruffw/zizmor-pre-commit
21+
rev: v1.6.0
22+
hooks:
23+
- id: zizmor
2024
- repo: local
2125
hooks:
2226
- id: fmt

0 commit comments

Comments
 (0)